boxscore/security
Sunday, July 26, 2026 · all times UTC← 2026-07-25 · archive · 2026-07-27 →

15 CVEs published July 26, 2026: 1 critical, 7 high, 1 medium, 6 low; 0 in KEV; 1 with a public exploit reference; 0 awaiting enrichment.

Standings

League
MTDYTD2025 same span2025 full
CVEs published4254700313682563
KEV catalog size1670

133 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; medians are over each vendor's YTD disclosures.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux636155420311079802730.27.8.0016+396
microsoft65613591049293018378322.47.8.0039+437
red hat761759857110400.07.1.0028+34
apple3801195219378.86.5.0036+3
google26356241173514.38.8.0030+23
canonical330210000.07.8.0013+3
android010100161100.08.4.0171-1
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
cisco7194610961263.28.6.2459+4
fortinet1017248028529.46.3.0051+9
palo alto networks1015017514213.34.7.0028+7
vmware7716002100.08.7.0044+7
f51540007120.09.2.04020
ivanti051000335100.010.0.8152-1
checkpoint3431003250.09.2.4696+2
broadcom2400204250.05.1.0877+2
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
mozilla67724226401300.09.1.0031+67
apache275914331204011.77.5.0058+11
docker030120100.05.7.0015-3
wordpress22101052100.07.9.8435+2
gitlab02000042100.0—.44510
github110010000.04.7.0017+1
kubernetes110001000.02.4.0024+1
drupal01100051100.09.8.88320
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
oracle11091113212539304574030.37.6.0031+1107
ibm32401611130700.08.4.0028+31
adobe16279104075414.88.6.0144+9
solarwinds15191511011421.19.1.0044+14
progress181831050900.07.8.0031+18
atlassian3303001300.08.0.0026+3
zohocorp331110000.07.1.0048+3
veeam110100400.08.4.0013+1
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
d-link78006126112.55.5.0073+7
hikvision5603202116.77.2.0024+5
bosch220200000.08.0.0018+2
rockwell automation111000000.09.2.0030+1
siemens010100100.08.7.00320
dahua00000020———0
qnap00000080———0
schneider electric00000010———0
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
surrealdb5757326253000.07.1.0025+57
grafana841214223000.06.5.0033+2
open ises037214210000.06.9.00210
netty103262411000.07.5.0051-4
regularlabs.com292961490000.07.5.0022+29
watchguard172811890400.07.3.0026+17
nlnet labs242704176000.05.9.0024+24
mongodb262611771200.07.1.0023+26

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-48282.992499.9—
CVE-2026-63030.956099.99.8
CVE-2026-39808.912199.8—
CVE-2026-48908.881399.810.0
CVE-2026-56290.832599.710.0
CVE-2026-48939.825099.610.0
CVE-2026-50522.769899.59.8
CVE-2026-15410.763599.57.2
CVE-2026-56291.760799.510.0
CVE-2026-15409.742299.410.0
Highest CVSS
CVECVSSEPSSNote
CVE-2026-4890810.0.8813KEV
CVE-2026-5629010.0.8325KEV
CVE-2026-4893910.0.8250KEV
CVE-2026-5629110.0.7607KEV
CVE-2026-1540910.0.7422KEV
CVE-2026-898510.0.0660
CVE-2026-651610.0.0473
CVE-2026-4766810.0.0434
CVE-2026-4435910.0.0100
CVE-2025-7138910.0.0093
Most disclosures (vendor)
VendorCVEs
oracle1109
microsoft656
linux637
red hat89
mozilla67
surrealdb57
apple40
ibm39
regularlabs.com29
apache27
Most KEV additions (YTD)
VendorKEV
microsoft32
cisco12
apple7
fortinet5
google5
ivanti5
adobe4
langflow4
solarwinds4
synacor4
Most-affected ecosystems
EcosystemAdvisories
Maven15
crates.io1
npm1
Fastest to KEV
CVEVendorDays
CVE-2008-4128Cisco0
CVE-2021-27137DD-WRT0
CVE-2023-4346KNX Association0
CVE-2026-0770Langflow0
CVE-2026-15409SonicWall0
CVE-2026-15410SonicWall0
CVE-2026-16232checkpoint0
CVE-2026-25089Fortinet0
CVE-2026-39808Fortinet0
CVE-2026-45659Microsoft0
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104Accellion2021-11-171712
CVE-2021-27102Accellion2021-11-171712
CVE-2021-27101Accellion2021-11-171712
CVE-2021-27103Accellion2021-11-171712
CVE-2021-21017Adobe2021-11-171712
CVE-2021-28550Adobe2021-11-171712
CVE-2021-42013Apache2021-11-171712
CVE-2021-41773Apache2021-11-171712
CVE-2021-30858Apple2021-11-171712
CVE-2021-30860Apple2021-11-171712

Transactions

EXPLOIT PUBLISHED — CVE-2026-16735 (release-it conventional-changelog). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-65700 (h2oai h2ogpt). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-65707 (likeadmin-likeshop likeshop). Public exploit reference added.

DUE DATE PASSED — CVE-2026-16232 (checkpoint Quantum Security Management). CISA remediation deadline was July 25, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-50522 (Microsoft SharePoint Enterprise Server 2016). CISA remediation deadline was July 25, 2026; still in catalog.

ENRICHED — CVE-2020-19909. Received CVSS 3.3 and CPE data from NVD.

Yesterday's Results

15 CVEs published. 15 box scores, 0 table rows — nothing truncated.

CVE-2026-57990HIGH
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  H  N  N    7.4   .0092   57.4     —
AFFECTED
  Product                          Versions  Fixed
  Microsoft Edge (Chromium-based)  - –       —
TIMELINE
  Jun 26  Reserved by CNA
  Jul 26  Published (CNA: microsoft)
CWE-552 · CNA: microsoft · 1 reference · NVD status: Analyzed
CVE-2026-64530CRITICAL
Linux Linux — net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0051   41.1     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    172ba7d46c202e679f3ccb10264c67416aaeb1c4 –  —
  Linux    6.8 –                                       5.15.212
TIMELINE
  Jul 19  Reserved by CNA
  Jul 26  Published (CNA: Linux)
CNA: Linux · 7 references · NVD status: Received
CVE-2026-17497HIGH
codexu NoteGen — NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  C  H  H  H    8.3   .0046   37.7     —
AFFECTED
  Product  Versions     Fixed
  NoteGen  unspecified  —
TIMELINE
  Jul 26  Reserved by CNA
  Jul 26  Published (CNA: JFROG)
CWE-78, CWE-276, CWE-1249 · CNA: JFROG · 3 references · NVD status: Awaiting Analysis
CVE-2026-57989HIGH
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  H  N  N    7.4   .0043   35.8     —
AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —
TIMELINE
  Jun 26  Reserved by CNA
  Jul 26  Published (CNA: microsoft)
CWE-346 · CNA: microsoft · 1 reference · NVD status: Analyzed
CVE-2026-63720HIGH
koxudaxi datamodel-code-generator — datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   A   H   H   H    7.5   .0042   35.3     —
AFFECTED
  Product                   Versions     Fixed
  datamodel-code-generator  unspecified  —
TIMELINE
  Jul 17  Reserved by CNA
  Jul 26  Published (CNA: VulnCheck)
CWE-94 · CNA: VulnCheck · 5 references · NVD status: Deferred
CVE-2026-15962HIGH
techjewel Fluent Forms Pro Add On Pack — Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0038   31.3     —
AFFECTED
  Product                       Versions     Fixed
  Fluent Forms Pro Add On Pack  unspecified  —
TIMELINE
  Jul 16  Reserved by CNA
  Jul 26  Published (CNA: Wordfence)
CWE-502 · CNA: Wordfence · 2 references · NVD status: Deferred
CVE-2026-17459LOW
perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   N    2.1   .0032   24.6     —
AFFECTED
  Product  Versions  Fixed
  spark    2.9.0 –   —
TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)
CWE-59, CWE-61 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-17457LOW
mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   N    2.1   .0032   24.3     —
AFFECTED
  Product      Versions  Fixed
  openclaw-cn  0.2.0 –   —
TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)
CWE-200, CWE-284 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-17496HIGH
codexu NoteGen — NoteGen chat preview XSS via unsanitized AI/skill HTML rendering
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  N    8.1   .0030   22.6     —
AFFECTED
  Product  Versions     Fixed
  NoteGen  unspecified  —
TIMELINE
  Jul 26  Reserved by CNA
  Jul 26  Published (CNA: JFROG)
CWE-79 · CNA: JFROG · 3 references · NVD status: Awaiting Analysis
CVE-2026-17432LOW
NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   L   N   L   L   L    1.3   .0023   14.1     —
AFFECTED
  Product       Versions    Fixed
  hermes-agent  2026.6.5 –  —
TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)
CWE-266, CWE-284 · CNA: VulDB · 9 references · NVD status: Deferred
CVE-2026-17458LOW
mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0023   13.8     —
AFFECTED
  Product      Versions  Fixed
  openclaw-cn  0.2.0 –   —
TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)
CWE-918 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-17434LOW
nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0021   12.1     —
AFFECTED
  Product   Versions  Fixed
  NanoClaw  2.0.0 –   —
TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)
CWE-266, CWE-285 · CNA: VulDB · 8 references · NVD status: Deferred
CVE-2026-57978MEDIUM
Microsoft Edge (Chromium-based) Spoofing Vulnerability
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  L  L  N    5.4   .0021   11.7     —
AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —
TIMELINE
  Jun 26  Reserved by CNA
  Jul 26  Published (CNA: microsoft)
CWE-346 · CNA: microsoft · 1 reference · NVD status: Analyzed
CVE-2024-14040HIGH
Linux Linux — net: nexthop: Increase weight to u16
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0011    1.5     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    283a72a5599e80750699d2021830a294ed9ab3f3 –  —
  Linux    5.13 –                                      6.12
TIMELINE
  Jul 26  Reserved by CNA
  Jul 26  Published (CNA: Linux)
CNA: Linux · 1 reference · NVD status: Received
CVE-2026-17433LOW
nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0010    1.1     —
AFFECTED
  Product   Versions  Fixed
  NanoClaw  2.0.0 –   —
TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)
CWE-266, CWE-285 · CNA: VulDB · 6 references · NVD status: Deferred

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-07-26 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.