Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Week 30, 2026

20 July to 26 July 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
2,806
Critical
477
High
1,224
Added to KEV
6

Critical 477High 1,224Medium 936Low 115Not scored 54All 2,806 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2026-50522

    Microsoft SharePoint Remote Code Execution Vulnerability

    Microsoft · Microsoft SharePoint Enterprise Server 2016

    ExploitedCritical9.8
  • CVE-2026-16232

    Authentication Bypass in the SmartConsole Login Process Using an Application Token

    checkpoint · Quantum Security Management

    ExploitedCritical9.3
  • CVE-2026-63030

    WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

    WordPress · WordPress

    ExploitedCritical9.8
  • CVE-2026-0770

    Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

    Langflow · Langflow

    ExploitedCritical9.8
  • CVE-2021-27137

    An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote…

    DD-WRT · DD-WRT

    ExploitedHigh8.1
  • CVE-2026-60137

    WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

    WordPress · WordPress

    ExploitedMedium5.9

Most severe new CVEsBy CVSS score

  • CVE-2026-8985

    Unauthenticated Command Injection

    Autel · MaxiCharger Single

    Critical10.0
  • CVE-2026-6516

    Remote Code Execution

    Zohocorp · ManageEngine ADAudit Plus

    Critical10.0
  • CVE-2026-47668

    DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

    dbgate · dbgate

    Critical10.0
  • CVE-2025-71389

    Cal.com before 5.9.9 Remote Code Execution via RSC

    calcom · cal.diy

    Critical10.0
  • CVE-2026-58275

    Azure DNS Elevation of Privilege Vulnerability

    Microsoft · Azure DNS

    Critical10.0
  • CVE-2026-62825

    Azure Key Vault Elevation of Privilege Vulnerability

    Microsoft · Azure Key Vault

    Critical10.0
  • CVE-2026-8984

    Unauthenticated RCE

    Autel · MaxiCharger Single

    Critical10.0
  • CVE-2026-56163

    Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

    Microsoft · Azure Kubernetes Service

    Critical10.0
  • CVE-2026-57106

    Data Quality Elevation of Privilege Vulnerability

    Microsoft · Microsoft Purview Data Governance

    Critical10.0
  • CVE-2026-56191

    Microsoft Exchange Online Tampering Vulnerability

    Microsoft · Microsoft Exchange Online

    Critical10.0

Vendors with the most CVEs

  1. Oracle Corporation1,108
  2. Linux334
  3. Mozilla65
  4. Red Hat52
  5. surrealdb31
  6. regularlabs.com29
  7. MongoDB26
  8. Apache Software Foundation25
  9. Google25
  10. MervinPraison25

Most common weaknesses

  1. CWE-284 Improper access control738
  2. CWE-306 Missing authentication for a critical function281
  3. CWE-269 Improper privilege management174
  4. CWE-79 Cross-site scripting (XSS)162
  5. CWE-200 Exposure of sensitive information145
  6. CWE-862 Missing authorization113
  7. CWE-400 Uncontrolled resource consumption95
  8. CWE-287 Improper authentication92
  9. CWE-416 Use after free75
  10. CWE-125 Out-of-bounds read74