Week 29, 2026

13–19 July 2026

New CVEs: 2,729
Critical: 286
High: 1,334
Newly exploited: 10
Advisories: 885
Malicious pkgs: 542

Newly exploited 10

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2026-58644 KEV Jul 16, 2026 Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 16%
Critical 9.1
CVE-2026-39808 KEV Jul 16, 2026 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may all…
Fortinet · FortiSandbox · FortiSandbox PaaS

EPSS 93%
Critical 9.1
CVE-2026-25089 KEV Jul 16, 2026 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiS…
Fortinet · FortiSandbox · FortiSandbox PaaS · FortiSandbox Cloud

EPSS 76%
Critical 9.8
CVE-2026-46817 KEV Jul 15, 2026 Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15…
Oracle · Oracle Payments

EPSS 12%
High 7.5
CVE-2023-4346 KEV Jul 15, 2026 KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable …
KNX Association · KNX Protocol Connection Authorization Option 1

EPSS 1.4%
Critical 10.0
CVE-2026-15409 KEV Jul 14, 2026 · ransomware A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could p…
SonicWall · SMA1000

EPSS 6.8%
High 7.8
CVE-2026-56155 KEV Jul 14, 2026 Active Directory Federation Services Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
High 7.2
CVE-2026-15410 KEV Jul 14, 2026 · ransomware Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AM…
SonicWall · SMA1000

EPSS 12%
Medium 5.3
CVE-2026-56164 KEV Jul 14, 2026 Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 1%
High 8.1
CVE-2008-4128 KEV Jul 13, 2026 Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow r…
EPSS 34%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.1
CVE-2026-55040 Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 70%
Critical 9.3
CVE-2026-48356 Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe · Adobe Commerce · Adobe Commerce B2B · Magento Open Source

EPSS 47%
Critical 9.8
CVE-2026-9198 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
IBM · Langflow OSS

EPSS 29%
Critical 9.3
CVE-2026-9586 Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
Sangoma · Switchvox SMB Edition

EPSS 19%
Critical 9.8
CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 16%
Critical 9.8
CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
WordPress · WordPress

EPSS 11%
Critical 10.0
CVE-2026-15409 A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could p…
SonicWall · SMA1000

EPSS 6.8%
Critical 9.1
CVE-2026-62327 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats
decolua · 9Router

EPSS 6.3%
Critical 9.8
CVE-2026-30623 LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a …
EPSS 6%
Critical 9.8
CVE-2026-58479 Sustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command Injection
Dan-in-CA · SIP

EPSS 4.4%
Critical 9.3
CVE-2026-59865 Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Microsoft · kiota

EPSS 4.4%
Critical 9.8
CVE-2026-61498 Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php
VITEC · Flamingo

EPSS 4%
Critical 9.8
CVE-2026-13001 Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
eteubert · Podlove Podcast Publisher

EPSS 3.8%
Critical 9.8
CVE-2026-60121 Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php
VITEC · Flamingo

EPSS 3.3%
Critical 9.8
CVE-2026-9103 Unauthenticated Superuser Token Issuance via Auto-Login Endpoint
IBM · Langflow OSS

EPSS 3.2%

All 286 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.2
CVE-2026-15410 Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AM…
SonicWall · SMA1000

EPSS 12%
High 8.1
CVE-2026-42533 NGINX Map directive and Regex matching vulnerability
F5 · NGINX Plus · NGINX Open Source

EPSS 6.3%
Medium 5.9
CVE-2026-60137 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
WordPress · WordPress

EPSS 5.3%
High 7.8
CVE-2026-50646 .NET Framework Remote Code Execution Vulnerability
Microsoft · Microsoft Visual Studio 2022 version 17.14 · Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2

EPSS 4%
High 7.8
CVE-2026-50649 .NET Remote Code Execution Vulnerability
Microsoft · Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.8 · Microsoft .NET Framework 3.5 AND 4.7.2

EPSS 4%
High 8.1
CVE-2021-27137 An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote …
DD-WRT · DD-WRT

EPSS 4%
High 7.8
CVE-2026-50509 Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 3.5%
High 8.8
CVE-2026-35152 Apache Fineract: SQL injection in runreports endpoint
Apache Software Foundation · Apache Fineract

EPSS 3.3%

Advisories

SSA-019113 SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 431 CVEs
WID-SEC-2026-2316 Microsoft Windows Produkte: Mehrere Schwachstellen 419 CVEs
ICSA-26-209-04 Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP 352 CVEs
WID-SEC-2026-2317 Microsoft Office Produkte: Mehrere Schwachstellen 95 CVEs
NCSC-2026-0237 Kwetsbaarheden verholpen in Microsoft Office 94 CVEs
openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media 93 CVEs
USN-8547-1 linux-gcp-5.15, linux-intel-iotg-5.15 vulnerabilities 65 CVEs
SUSE-SU-2026:2914-1 Security update for the Linux Kernel 65 CVEs
USN-8546-1 linux-raspi vulnerabilities 62 CVEs
USN-8545-1 linux-hwe-6.17 vulnerabilities 62 CVEs