Week 28, 2026

6 July to 12 July 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 1,491
Critical: 146
High: 581
Added to KEV: 6

Critical 146High 581Medium 686Low 77Not scored 1All 1,491 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-56291
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
balbooa.com · balbooa.com Balbooa Forms extension for Joomla
ExploitedCritical10.0
CVE-2026-48939
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
icagenda.com · iCagenda extension for Joomla
ExploitedCritical10.0
CVE-2026-48282
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Adobe · ColdFusion 2025
ExploitedCritical10.0
CVE-2026-56290
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
joomlack.fr · JoomlaCK.fr Page Builder CK extension for Joomla
ExploitedCritical10.0
CVE-2026-48908
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
joomshaper.net · SP Page Builder extension for Joomla
ExploitedCritical10.0
CVE-2026-55255
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
langflow-ai · langflow
ExploitedHigh8.4

Most severe new CVEsBy CVSS score

CVE-2026-56291
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
balbooa.com · balbooa.com Balbooa Forms extension for Joomla
ExploitedCritical10.0
CVE-2026-57827
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
rsjoomla.com · rsjoomla.com RSFiles extension for Joomla
Critical10.0
CVE-2026-61447
PraisonAI before 1.6.78 Remote Code Execution via CodeAgent
MervinPraison · PraisonAI
Critical10.0
CVE-2026-59726
Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment
ruvnet · ruflo
Critical10.0
CVE-2026-48316
ColdFusion | Improper Input Validation (CWE-20)
Adobe · ColdFusion 2025
Critical10.0
CVE-2026-57572
Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
unclecode · crawl4ai
Critical10.0
CVE-2026-54769
Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent
langroid · langroid
Critical10.0
CVE-2026-54782
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
CoreWCF · CoreWCF
Critical10.0
CVE-2026-59827
Metabase: Unsafe Deserialization of H2 Query Results
metabase · metabase
Critical9.9
CVE-2026-34038
Coolify authenticated remote command injection leading to RCE and secret exfiltration
coollabsio · coolify
Critical9.9

Week 28, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses