Week 27, 2026

29 June – 5 July 2026

New CVEs: 1,893
Critical: 214
High: 717
Newly exploited: 2
Advisories: 578
Malicious pkgs: 233

Newly exploited 2

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 8.8
CVE-2026-45659 KEV Jul 1, 2026 · ransomware Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 80%
Critical 10.0
CVE-2026-48558 KEV Jun 29, 2026 SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
SimpleHelp · SimpleHelp

EPSS 80%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 10.0
CVE-2026-48282 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Adobe · ColdFusion 2023 · ColdFusion 2025

EPSS 42%
Critical 10.0
CVE-2026-56290 Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
joomlack.fr · JoomlaCK.fr Page Builder CK extension for Joomla

EPSS 31%
Critical 9.8
CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
conductor-oss · conductor

EPSS 9.1%
Critical 9.8
CVE-2026-58455 Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php
Notifiarr · dockwatch

EPSS 8%
Critical 9.9
CVE-2026-7873 Code Injection Vulnerability in Code Validation Endpoint
IBM · Langflow OSS

EPSS 6.2%
Critical 10.0
CVE-2026-56415 OS Command Injection in StoneFly Storage Concentrator
StoneFly · Storage Concentrator Virtual Machine · Storage Concentrator

EPSS 4.4%
Critical 10.0
CVE-2026-56413 OS Command Injection in StoneFly Storage Concentrator
StoneFly · Storage Concentrator · Storage Concentrator Virtual Machine

EPSS 4.2%
Critical 9.8
CVE-2026-56782 Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
gorse-io · gorse

EPSS 3.6%
Critical 9.8
CVE-2026-5524 Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
Divi Engine · Divi Form Builder

EPSS 3.5%
Critical 9.3
CVE-2026-48313 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Adobe · ColdFusion 2025 · ColdFusion 2023

EPSS 3%
Critical 9.8
CVE-2026-58457 Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp
Shenzhen Aitemi E Commerce · M300 Wi-Fi Repeater

EPSS 2.9%
Critical 9.8
CVE-2026-20896 Gitea Docker image trusts spoofable reverse-proxy headers by default
Gitea · Gitea Open Source Git Server

EPSS 2.8%
Critical 9.8
CVE-2026-7840 UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE)
uvnc · UltraVNC

EPSS 2.6%
Critical 9.8
CVE-2026-56700 Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection
Grav · Grav

EPSS 2.5%
Critical 10.0
CVE-2026-10134 Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows
IBM · Langflow OSS

EPSS 2.3%

All 214 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.8
CVE-2026-8451 Insufficient input validation leading to memory overread
NetScaler · ADC · Gateway

EPSS 14%
Medium 6.0
CVE-2026-13773 IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol
IBM · WebSphere Extreme Scale

EPSS 6.1%
High 8.8
CVE-2026-13545 D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection
D-Link · DCS-935L

EPSS 5.5%
Medium 6.1
CVE-2026-50229 Apache Tomcat: XSS in number guess example
Apache Software Foundation · Apache Tomcat

EPSS 4.1%
High 7.3
CVE-2026-55957 Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
Apache Software Foundation · Apache Tomcat

EPSS 2.9%
High 8.8
CVE-2026-58452 JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint
JAIOTlink · C492A-W6 Wi-Fi IP Camera

EPSS 2.7%
High 7.2
CVE-2026-9834 WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter
databasebackup · WP Database Backup – Unlimited Database & Files Backup by Backup for WP

EPSS 2.7%
High 7.2
CVE-2026-56808 DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root …
AVTECH Security · DGM3103SCT

EPSS 2.5%

Advisories

USN-8499-1 linux-xilinx vulnerabilities 516 CVEs
openSUSE-SU-2026:11184-1 chromedriver-150.0.7871.46-1.1 on GA media 433 CVEs
USN-8497-1 linux-lowlatency, linux-lowlatency-hwe-6.8 vulnerabilities 321 CVEs
USN-8492-2 linux-aws-6.8, linux-gcp-6.8, linux-gke, linux-gkeop, linux-ibm-6.8, linux-nvidia-lowlatency, linux-oracle-6.8 vulnerabilities 299 CVEs
USN-8492-1 linux, linux-aws, linux-aws-fips, linux-gcp, linux-gcp-fips, linux-ibm, linux-nvidia, linux-nvidia-6.8, linux-oracle, linux-realtime, linux-realtime-6.8 vulnerabilities 299 CVEs
USN-8498-1 linux-nvidia-tegra vulnerabilities 297 CVEs
USN-8488-2 linux-raspi vulnerabilities 236 CVEs
USN-8488-1 linux, linux-aws, linux-gcp, linux-ibm, linux-oracle, linux-realtime vulnerabilities 236 CVEs
SUSE-SU-2026:2238-1 Security update for the Linux Kernel 204 CVEs
SUSE-SU-2026:22433-1 Security update for the Linux Kernel 169 CVEs