Week 27, 2026
29 June to 5 July 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,846
- Critical
- 213
- High
- 666
- Added to KEV
- 2
Critical 213High 666Medium 906Low 51Not scored 10All 1,846 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-45659
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedHigh8.8 - CVE-2026-48558
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
SimpleHelp · SimpleHelp
ExploitedCritical9.5
Most severe new CVEsBy CVSS score
- CVE-2026-48282
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Adobe · ColdFusion 2025
ExploitedCritical10.0 - CVE-2026-56290
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
joomlack.fr · JoomlaCK.fr Page Builder CK extension for Joomla
ExploitedCritical10.0 - CVE-2026-56415
OS Command Injection in StoneFly Storage Concentrator
Stonefly · Storage Concentrator
Critical10.0 - CVE-2026-56413
OS Command Injection in StoneFly Storage Concentrator
StoneFly · Storage Concentrator
Critical10.0 - CVE-2026-10134
Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows
IBM · Langflow OSS
Critical10.0 - CVE-2026-50160
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
hoppscotch · hoppscotch
Critical10.0 - CVE-2026-50746
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command…
Ubiquiti Inc · UniFi Connect Application
Critical10.0 - CVE-2026-48281
ColdFusion | Improper Input Validation (CWE-20)
Adobe · ColdFusion 2025
Critical10.0 - CVE-2026-48277
ColdFusion | Improper Input Validation (CWE-20)
Adobe · ColdFusion 2025
Critical10.0 - CVE-2026-48276
ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe · ColdFusion 2025
Critical10.0