Week 31, 2026
27 July to 2 August 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 2,000
- Critical
- 313
- High
- 737
- Added to KEV
- 3
Critical 313High 737Medium 863Low 80Not scored 7All 2,000 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-20316
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
ExploitedMedium5.3 - CVE-2026-16812
VeloCloud Orchestrator OS Command Injection
Arista Networks · VeloCloud Orchestrator On-Prem
ExploitedCritical10.0 - CVE-2025-68686
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0…
Fortinet · FortiOS
ExploitedMedium5.3
Most severe new CVEsBy CVSS score
- CVE-2026-16812
VeloCloud Orchestrator OS Command Injection
Arista Networks · VeloCloud Orchestrator On-Prem
ExploitedCritical10.0 - CVE-2026-66803
Azure Cosmos DB Remote Code Execution Vulnerability
Microsoft · Azure Cosmos DB
Critical10.0 - CVE-2026-48449
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
Adobe · Adobe Campaign Classic
Critical10.0 - CVE-2026-65883
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0
aimy-extensions.com · Aimy Captcha-Less Form Guard plugin for Joomla
Critical10.0 - CVE-2026-11756
Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x
Dassault Systèmes · Station Launcher App in 3DEXPERIENCE platform
Critical10.0 - CVE-2026-65880
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3
balbooa.com · Balbooa Forms component for Joomla
Critical10.0 - CVE-2026-18452
Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials
Rich Source · DMS+ (Non-Mobile)
Critical10.0 - CVE-2026-54735
prebid-server's request forgery vulnerability allows for possible host environment data extraction
prebid · prebid-server
Critical10.0 - CVE-2026-67429
Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
flytohub · flyto-core
Critical10.0 - CVE-2026-16326
consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
HashiCorp · Tooling
Critical10.0