Published threat advisories for July 7, 2026

An unauthenticated access vulnerability exists in mem0's openmemory/api component, allowing attackers to read, write, or delete arbitrary user memories. Attackers can also trigger a denial-of-service affecting all users. This issue is relevant for readers to understand potential unauthorized access to sensitive data an

NVD modified: NVD date unavailable

Fire-Boltt Smartwatch firmware has a critical Improper Authentication vulnerability where a device accepts GATT Write Request commands without sufficient validation. This allows previously captured Bluetooth Low Energy (BLE) packets to be replayed from a nearby device, potentially triggering unauthorized functionality.

NVD modified: NVD date unavailable

A critical authentication bypass vulnerability exists in Trueview Security camera firmware due to improper password validation and hard-coded credentials. If reachable, this could allow unauthenticated attackers to gain administrative control of the camera.

NVD modified: NVD date unavailable

A critical vulnerability exists in a Perl database interface module that could lead to application crashes or unpredictable behavior. The issue involves an out-of-bounds read when processing SQL comments, potentially causing faults or unintended data handling. While direct exploitation is considered unlikely due to the

NVD modified: NVD date unavailable

A heap overflow vulnerability exists in a Perl database interface library that can occur when preparsing SQL statements with a vast number of placeholders. This issue could potentially lead to denial-of-service conditions or system compromise if triggered by an attacker. It is important to determine if systems use this

NVD modified: NVD date unavailable

Unauthenticated access to mem0's configuration API endpoints can expose LLM API keys and enable server-side request forgery, allowing attackers to retrieve secrets or target internal systems. This vulnerability is reachable as the affected API endpoints are network-accessible.

NVD modified: NVD date unavailable

A vulnerability in Coder's remote development environment provisioning could allow an unauthenticated attacker to embed malicious content in a certificate to obtain a victim's session token. This requires the attacker to know the target VM's ID.

NVD modified: NVD date unavailable

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint. This allows attackers to fetch arbitrary internal URLs by forcing the server to issue HTTP GET requests to private and loopback addresses, potentially leaking partial response content. This is relevant if L

NVD modified: NVD date unavailable

An improper access control vulnerability in Cognee allows unauthenticated attackers to overwrite the global LLM provider configuration, redirecting all LLM operations to an attacker-controlled endpoint and potentially exfiltrating sensitive data from all users.

NVD modified: NVD date unavailable

An OS command injection vulnerability exists in 9Router software, allowing unauthenticated remote attackers to execute arbitrary commands. This occurs when a `sudoPassword` field in an API request is processed by a shell, and specific conditions bypass the need for a password prompt, leading to potential system comprom

NVD modified: NVD date unavailable

A weakness in Esri Portal for ArcGIS's password recovery mechanism may allow remote attackers to take over user accounts. This vulnerability affects systems running version 12.1 and earlier. While administrator password resets are unaffected, proper configuration of email for self-service recovery is advised.

NVD modified: NVD date unavailable

A critical vulnerability exists in Esri Portal for ArcGIS, enabling remote, unauthenticated attackers to access unprotected APIs. This could impact the confidentiality, integrity, and availability of the system and its managed data. Its common use as an internet-facing geographic information system portal or API gatewa

NVD modified: NVD date unavailable

Dell PowerProtect Data Domain has an improper authentication vulnerability that an unauthenticated remote attacker could exploit for complete system control. This impacts data protection and backup systems, making it critical to confirm relevance and exposure.

NVD modified: NVD date unavailable

A path traversal vulnerability in Dell PowerProtect Data Domain allows unauthenticated remote attackers to gain unauthorized system access, potentially leading to complete control. This critical vulnerability requires prompt attention to mitigate risks associated with unauthorized system compromise.

NVD modified: NVD date unavailable

A vulnerability in a Perl module allows attackers to load arbitrary modules by manipulating module names, potentially leading to arbitrary code execution if an attacker can influence the input to the module loading function. This could result in system compromise. The relevance and exposure of this vulnerability within

NVD modified: NVD date unavailable

A vulnerability exists in Apache Airflow's deserialization process, allowing a malicious DAG author to execute arbitrary code on the API server or scheduler. This could compromise critical orchestration systems, and its relevance hinges on the exposure and trustworthiness of Airflow deployments.

NVD modified: NVD date unavailable

A critical vulnerability exists in certain WordPress plugins, allowing remote code execution. This could enable attackers to compromise affected websites by exploiting a flaw in how extensions are installed or by leveraging vulnerable plugin features. It is important to confirm if these plugins are in use to assess pot

NVD modified: NVD date unavailable

The WPFunnels – Funnel Builder for WooCommerce plugin has a remote code execution vulnerability that unauthenticated attackers can exploit via the 'postData' parameter. This could allow arbitrary code execution on the server if the plugin's logging is enabled and an administrator views the log file.

NVD modified: NVD date unavailable

A compromise in the distribution infrastructure for the Uncanny Automator Pro WordPress plugin introduced a backdoor, allowing unauthenticated attackers to gain administrator sessions and exfiltrate sensitive site information.

NVD modified: NVD date unavailable

An authentication bypass vulnerability exists in Coolify's terminal websocket routes, allowing low-privileged users to execute commands on team servers. This could lead to unauthorized access and control over managed systems. Readers should care due to the potential impact on system integrity and data confidentiality.

NVD modified: NVD date unavailable

A vulnerability in Coolify, a server management tool, allows authenticated users to access unauthorized terminal functions, potentially leading to command execution on unintended resources. This issue impacts systems managing servers and applications, and should be reviewed for relevance and potential exposure.

NVD modified: NVD date unavailable

A critical vulnerability in Coolify allows authenticated users to clone resources across tenant boundaries, potentially exposing and allowing modification of other teams' data. This occurs due to improper authorization when resolving destination resources, making cross-tenant data access possible. Understanding if Cool

NVD modified: NVD date unavailable