Friday, July 31, 2026

Notable advisories

Critical/high or exploited items from national CERTs and vendor PSIRTs.

• highexploitedcisco-psirtCisco Secure Firewall Management Center Software Static Credential Vulnerability
• unknownexploitedjpcertSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updates
• highubuntuUSN-8620-4: Linux kernel (Intel IoTG) vulnerabilities
• highcert-bund[NEU] [hoch] SQLite: Mehrere Schwachstellen
• highcert-bund[UPDATE] [high] PackageKit: Vulnerability allows privilege escalation
• highcert-bund[NEU] [hoch] IBM DB2: Mehrere Schwachstellen
• highcert-bund[NEU] [hoch] Rancher: Mehrere Schwachstellen
• highcert-bund[UPDATE] [hoch] GIMP: Mehrere Schwachstellen ermöglichen Codeausführung
• highcert-bund[UPDATE] [high] Linux Kernel: Multiple vulnerabilities
• highcert-bund[UPDATE] [high] Linux Kernel: Multiple vulnerabilities enable denial of service
• highcert-bund[UPDATE] [high] Linux Kernel: Multiple vulnerabilities allow denial of service
• highcert-bund[NEU] [hoch] Gladinet CentreStack: Mehrere Schwachstellen

Notable CVEs

Highest-severity CVEs published this day from the NVD and GitHub Advisory firehose — the sharpest items behind the day’s numbers.

• criticalCVE-2026-18452CVSS 10DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all
• criticalCVE-2026-52855CVSS 9.9GHSA-pfvc-3p5h-x7h6: Wings exposes node configuration secrets through egg configuration-file templating
• criticalCVE-2026-17566CVSS 9.9pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql vi
• criticalCVE-2026-52855CVSS 9.9Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates a
• criticalCVE-2026-14919CVSS 9.8The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-
• criticalCVE-2026-68771CVSS 9.8ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by up
• criticalCVE-2026-63223CVSS 9.8CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allow
• criticalCVE-2026-17561CVSS 9.8Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. T
• criticalCVE-2026-67822CVSS 9.8Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled '
• criticalCVE-2026-68770CVSS 9.8sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_cla
• criticalCVE-2026-14483CVSS 9.8The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. T
• criticalCVE-2026-43830CVSS 9.8Full details and mitigation steps are currently restricted and will be published at a later date.

Highest exploitation probability

EPSS (FIRST.org) estimated probability of exploitation within 30 days, among CVEs published this day.

• 38%CVE-2026-20079

Where the day’s advisories came from

Curated CERT and PSIRT sources — these add up to the 204 above.

plus 256 CVE records from the NVD/GHSA firehose — not counted above