July 2026 CVE Landscape
- CVEs
- CVE-2025-3248CVE-2008-4128CVE-2017-17215CVE-2018-0802CVE-2021-4034CVE-2021-27137CVE-2023-4346CVE-2025-55182CVE-2025-68686CVE-2026-0770CVE-2026-15409CVE-2026-15410CVE-2026-16232CVE-2026-16812CVE-2026-20316CVE-2026-25089CVE-2026-34486CVE-2026-39808CVE-2026-39987CVE-2026-46817CVE-2026-48282CVE-2026-48907CVE-2026-48908CVE-2026-48939CVE-2026-50522CVE-2026-55255CVE-2026-56155CVE-2026-56164CVE-2026-56290CVE-2026-56291CVE-2026-58644CVE-2026-60137CVE-2026-63030CVE-2021-3156CVE-2021-29441CVE-2025-6389CVE-2025-9491CVE-2025-32432CVE-2025-34152CVE-2025-49113CVE-2025-66376CVE-2026-0257CVE-2026-0740CVE-2026-3055CVE-2026-6875CVE-2026-12569CVE-2026-29014CVE-2026-42897CVE-2026-45659CVE-2026-31843CVE-2013-3307CVE-2016-20016CVE-2017-5259CVE-2017-7269CVE-2018-11511CVE-2018-14558CVE-2020-8515CVE-2020-22653CVE-2020-22658CVE-2020-25499CVE-2020-36847CVE-2021-31755CVE-2021-32305CVE-2022-35733CVE-2023-25717CVE-2024-42009CVE-2025-9528CVE-2025-12057CVE-2025-12352CVE-2025-13486CVE-2025-28137CVE-2026-1357CVE-2026-3395CVE-2026-3844CVE-2026-16723CVE-2026-29059CVE-2026-33824CVE-2021-24139CVE-2025-7852CVE-2026-1969CVE-2025-7443
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2008-4128 | Cross-Site Request Forgery in Cisco IOS 12.4 HTTP Management Interface | 8.1 | 34% | KEVPoC ×3 | KEV |
| CVE-2016-20016 | MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI | 9.8 | 86% | PoC ×2 | |
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
| CVE-2017-5259 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path… | 8.8 | 31% | ||
| CVE-2017-7269 | Buffer Overflow in Microsoft IIS 6.0 via WebDAV PROPFIND Header | 9.8 | 100% | KEVPoC ×5 | KEV |
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor | 7.8 | 93% | KEVRansomwarePoC ×3 | KEV |
| CVE-2018-11511 | The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope'… | 9.8 | 11% | PoC ×2 | |
| CVE-2018-14558 | Unauthenticated Command Injection in Tenda AC7, AC9, and AC10 Routers | 9.8 | 9% | KEVPoC | KEV |
CVE-2020-22653+1 related CVE | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s… | 9.8 | <1% | ||
| CVE-2020-25499 | TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command' | 8.8 | 4% | PoC | |
| CVE-2020-36847 | Unauthenticated Remote Code Execution in Simple File List WordPress Plugin | 9.8 | 44% | PoC ×2 | |
| CVE-2020-8515 | Unauthenticated Command Injection RCE in DrayTek Vigor3900/2960/300B Routers | 9.8 | 100% | KEVPoC | KEV |
| CVE-2021-24139 | Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php… | 9.8 | 6% | ||
| CVE-2021-27137 | Unauthenticated Stack-Based Buffer Overflow in DD-WRT UPnP (SSDP M-SEARCH) | 8.1 | 4% | KEVPoC ×4 | KEV |
| CVE-2021-29441 | Nacos: When configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce… | 9.8 | 83% | PoC ×2 | |
| CVE-2021-3156 | Heap-Based Buffer Overflow in Sudo Enables Local Privilege Escalation (CVE-2021-3156) | 7.8 | 100% | KEVPoC ×12 | KEV |
| CVE-2021-31755 | Unauthenticated Stack Overflow RCE in Tenda AC11 Router via /goform/setmac | 9.8 | 87% | KEVPoC | KEV |
| CVE-2021-32305 | WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter | 9.8 | 87% | PoC | |
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) | 7.8 | 95% | KEVRansomwarePoC ×4 | KEV |
| CVE-2022-35733 | Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13… | 9.8 | 2% | ||
| CVE-2023-25717 | Unauthenticated RCE via Command Injection in Ruckus Wireless Admin ≤10.4 | 9.8 | 98% | KEVPoC | KEV |
| CVE-2023-4346 | KNX Connection Authorization Option 1 Flaw Enables Permanent Device Lockout | 7.5 | 1% | KEV | KEV |
| CVE-2024-42009 | Cross-Site Scripting in Roundcube Webmail Lets Attackers Steal Emails | 9.3 | 83% | KEV | KEV |
| CVE-2025-12057 | The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing… | 9.8 | <1% | ||
| CVE-2025-12352 | The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all… | 9.8 | 1% | ||
| CVE-2025-13486 | Unauthenticated RCE in WordPress Advanced Custom Fields: Extended Plugin | 9.8 | 68% | ||
| CVE-2025-28137 | Pre-auth Command Injection RCE in TOTOLINK A810R Router Firmware | 9.8 | 34% | PoC ×3 | |
| CVE-2025-32432 | Code Injection Enables Remote Code Execution in Craft CMS | 10.0 | 100% | KEVPoC ×3 | KEV |
| CVE-2025-3248 | Unauthenticated RCE in Langflow /api/v1/validate/code | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2025-34152 | Unauthenticated OS Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater | 9.4 | 69% | ||
| CVE-2025-49113 | Authenticated PHP Object Deserialization RCE in Roundcube Webmail | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
| CVE-2025-6389 | Unauthenticated Remote Code Execution in Sneeit Framework WordPress Plugin | 9.8 | 76% | ||
| CVE-2025-66376 | Stored Cross-Site Scripting in Synacor Zimbra Collaboration Suite Classic UI | 6.1 | 20% | KEV | KEV |
| CVE-2025-68686 | Unauthenticated Info-Exposure Bypass of Symlink Patch in Fortinet FortiOS | 5.9 | 29% | KEV | KEV |
| CVE-2025-7443 | The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to… | 8.1 | <1% | ||
| CVE-2025-7852 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via… | 9.8 | 2% | ||
| CVE-2025-9491 | LNK File UI Misrepresentation RCE in Microsoft Windows | 4.6 | 69% | ||
| CVE-2025-9528 | OS Command Injection in Linksys E1700 Router Firmware 1.0.0.4.003 | 2.0 | 54% | PoC ×2 | |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 95% | KEVRansomware | KEV |
| CVE-2026-0740 | Unauthenticated Arbitrary File Upload RCE in Ninja Forms File Uploads WordPress Plugin | 9.8 | 63% | ||
| CVE-2026-0770 | Unauthenticated Remote Code Execution in Langflow validate Endpoint | 9.8 | 63% | KEV | KEV |
| CVE-2026-12569 | Unauthenticated RCE in PTC Windchill and FlexPLM | 9.3 | 46% | KEVRansomware | KEV |
| CVE-2026-1357 | Unauthenticated RCE in WPvivid Backup & Migration WordPress Plugin | 9.8 | 33% | ||
CVE-2026-15409+1 related CVE | Unauthenticated SSRF in SonicWall SMA1000 Appliances | 10.0 group max | 7% | KEVRansomwarePoC | KEV |
| CVE-2026-16232 | Authentication Bypass in Check Point SmartConsole Grants Full Admin Access | 9.3 | 4% | KEV | KEV |
| CVE-2026-16723 | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83 | 9.0 | <1% | PoC ×3 | |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-1969 | The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload… | 5.3 | <1% | ||
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
| CVE-2026-25089 | Unauthenticated OS Command Injection RCE in Fortinet FortiSandbox | 9.8 | 76% | KEV | KEV |
| CVE-2026-29014 | Unauthenticated PHP Code Injection RCE in MetInfo CMS | 9.3 | 39% | PoC ×2 | |
| CVE-2026-29059 | Windmill: An unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint… | 6.9 | 3% | ||
| CVE-2026-3055 | Out-of-Bounds Read in Citrix NetScaler ADC and Gateway When Used as SAML IDP | 9.3 | 91% | KEVPoC | KEV |
| CVE-2026-31843 | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated… | 10.0 | 1% | ||
| CVE-2026-33824 | Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension | 9.8 | 77% | KEV | KEV |
| CVE-2026-3395 | A flaw has been found in MaxSite CMS up to 109.1 | 5.5 | 4% | ||
| CVE-2026-34486 | EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat | 7.5 | 99% | KEV | KEV |
| CVE-2026-3844 | Unauthenticated Arbitrary File Upload in Breeze Cache WordPress Plugin | 9.8 | 28% | ||
| CVE-2026-39808 | Unauthenticated OS Command Injection in Fortinet FortiSandbox 4.4 | 9.8 | 93% | KEVPoC ×3 | KEV |
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook | 9.3 | 100% | KEVPoC ×8 | KEV |
| CVE-2026-42897 | Cross-Site Scripting in Microsoft Exchange Server Actively Exploited by Laundry Bear | 6.1 | 71% | KEV | KEV |
| CVE-2026-45659 | Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited) | 8.8 | 80% | KEVRansomware | KEV |
| CVE-2026-46817 | Unauthenticated Takeover of Oracle Payments in Oracle E-Business Suite (CVE-2026-46817) | 9.8 | 12% | KEV | KEV |
| CVE-2026-48282 | Path Traversal Leading to RCE in Adobe ColdFusion | 10.0 | 42% | KEV | KEV |
| CVE-2026-48907 | Unauthenticated PHP Code Upload and Execution in Joomla Content Editor (JCE) | 10.0 | 85% | KEVPoC ×3 | KEV |
| CVE-2026-48908 | Unauthenticated File Upload RCE in JoomShaper SP Page Builder for Joomla | 10.0 | 89% | KEVPoC | KEV |
| CVE-2026-48939 | Unauthenticated File-Upload RCE in Joomlic iCagenda for Joomla | 10.0 | 20% | KEVPoC | KEV |
CVE-2026-58644+1 related CVE | Unauthenticated Deserialization RCE in Microsoft SharePoint Server | 9.8 | 16% | KEV | KEV |
| CVE-2026-55255 | IDOR Authorization Bypass in Langflow Lets Attackers Run Other Users' Flows | 8.4 | <1% | KEVPoC | KEV |
| CVE-2026-56155 | Local Privilege Escalation in Microsoft Active Directory Federation Services | 7.8 | <1% | KEV | KEV |
| CVE-2026-56164 | Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation | 9.8 | 1% | KEV | KEV |
| CVE-2026-56290 | Improper Access Control Enables Unauthenticated RCE in Joomlack Page Builder | 10.0 | 31% | KEVPoC | KEV |
| CVE-2026-56291 | Unauthenticated File Upload RCE in Balbooa Forms (Joomla) | 10.0 | 15% | KEVPoC | KEV |
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×7 | KEV |
| CVE-2026-6875 | Unauthenticated Remote Code Execution in ServiceNow AI Platform | 9.5 | 1% | PoC |
From the original article
7 min read at recordedfuture.com
In July 2026, Insikt Group® identified 85 high-impact vulnerabilities that should be prioritized for remediation , 36 of which had a Very Critical Recorded Future Risk Score. This represents a 44% increase from last month.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.