The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Microsoft Patch Tuesday July 2026 - The AI Apocalypse is Here

Published: 2026-07-14

Last Updated: 2026-07-14 19:14:58 UTC

by Johannes Ullrich (Version: 1)

This patch Tuesday includes a staggering 622 vulnerabilities, not including another 427 vulnerabilities in Chromium, affecting Microsoft's Edge browser. 62 of the vulnerabilities are rated critical. One was disclosed before today, and two have already been exploited.

Given the large number of vulnerabilities, it is difficult to point out "noteworthy" issues.

Already exploited vulnerabilities:

CVE-2026-56155: Active Directory Federation Services Elevation of Privilege Vulnerability. This is an important (not critical) vulnerability.

CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege Vulnerability. Microsoft considers this vulnerability's severity only moderate.

Disclosed but not yet exploited:

CVE-2026-50661: Windows BitLocker Security Feature Bypass Vulnerability. It is not clear right now if this is one of the Nightmare Eclipse vulnerabilities. "Anonymous" is credited with discovering the vulnerability.

Random Interesting Vulnerabilities:

CVE-2026-54128: Windows DHCP Client Remote Code Execution Vulnerability. A critical vulnerability, but it will require the victim to connect to a network exposed to a malicious DHCP server. Certainly interesting for "public wifi network" attacks. There are also a few critical DHCP server RCE vulnerabilities being addressed in this update.

CVE-2026-54982, CVE-2026-54995: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability. Two critical vulnerabilities. Just like DHCP, the exploit will typically require network-adjacent attackers. I have seen several similar vulnerabilities in MSFT updates in the past, but not seen exploits.

A quick word on how to deal with this flood of new vulnerabilities: You still own the same number of Microsoft products. Many products (Office..) are affected by a large number of vulnerabilities. Patching the product should not take a lot more time just because the patch addresses more vulnerabilities.

Read the full entry: https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+July+2026+The+AI+Acopolypse+is+Here/33154/

Someone Is Scanning for Your MCP Servers and AI Assistant Credentials

Published: 2026-07-13

Last Updated: 2026-07-13 04:22:02 UTC

by Manuel Humberto Santander Pelaez (Version: 1)

The setup

I pulled 14 days of Apache and ModSecurity logs from a single small web host. Nothing special about it. A handful of low-traffic virtual hosts. A WordPress site, a couple of custom application backends, a static devotional site. The kind of server that exists by the millions and that nobody would call a high-value target. Server IP and hostnames are anonymized throughout this diary.

The point of looking was not to find a breach. It was to see what the background radiation of internet scanning looks like in 2026. Most of it is exactly what you would expect. WordPress xmlrpc floods. Endless .env probing. Git config fishing. But mixed into the noise was a category of scanning I had not seen documented before. Someone is systematically looking for Model Context Protocol servers, AI assistant configuration files, and locally exposed LLM endpoints. On a server that runs none of those things.

The overall picture

Figure 1 breaks down the reconnaissance categories that ModSecurity flagged over the two-week window. I split them into two groups. The classic cloud and application recon that every server sees, and the newer AI-agent recon that is the subject of this diary.

Read the full entry: https://isc.sans.edu/diary/Someone+Is+Scanning+for+Your+MCP+Servers+and+AI+Assistant+Credentials/33150/

"Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?

Published: 2026-07-10

Last Updated: 2026-07-10 09:09:29 UTC

by Jan Kopriva (Version: 1)

Anyone who deals with phishing messages caught by basic security filters knows that most phishing samples tend to blend into one another, since only a small set of techniques and approaches keeps reappearing in them. That is precisely why it is worth pausing on the occasional message that does something a little out of the ordinary.

One such unusual message was caught on Tuesday by an e-mail security solution used by one of my clients. At first glance, both the e-mail body and the attached credential-stealing HTML page looked entirely generic, however, the fact that the attachment was fairly large, and that Outlook claimed the date on which the e-mail had been sent was “None”, caught my attention and made me take a second look… Which was fortunate, because it appears that the large size of the attachment might be connected to the increasing role that AI is playing in e-mail security in an interesting way.

Before we get to the attachment, however, the phishing message itself deserves a brief mention, since several small details in its headers suggest that it was not sent through any normal mail path, but rather generated by a simple, homemade script.

The e-mail presented itself as a Microsoft Teams notification about a document shared over SharePoint, with another document attached directly to the message (note the text “None” in the upper right corner where a date should be).

Read the full entry: https://isc.sans.edu/diary/Comment+stuffing+in+an+HTML+phishing+attachment+as+a+mechanism+for+evading+AIbased+detection/33144/

Recent DShield SIEM Update (2026.07.14)

https://isc.sans.edu/diary/Recent+DShield+SIEM+Update/33156/

Wireshark 4.6.7 Released (2026.07.11)

https://isc.sans.edu/diary/Wireshark+467+Released/33146/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

Microsoft Patch Tuesday - As noted in the Internet Storm Center diary above, this month's Patch Tuesday release addresses 622 vulnerabilities, as well as an additional 427 vulnerabilities in Chromium. For obvious reasons, the list below includes just the more severe of those vulnerabilities.

CVE-2026-56291 - Balbooa Forms for Joomla is vulnerable to unauthenticated arbitrary file uploads enabling full remote code execution.

Product: Balbooa Forms

CVSS Score: 9.8

** KEV since 2026-07-10 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56291

NVD References:

- https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291

CVE-2026-56155 - Active Directory Federation Services Elevation of Privilege Vulnerability

Product: Microsoft Windows 10 1607

CVSS Score: 7.8

** KEV since 2026-07-14 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56155

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155

NVD References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155

CVE-2026-56164 - Microsoft SharePoint Server Elevation of Privilege Vulnerability

Product: Microsoft SharePoint Server

CVSS Score: 5.3

** KEV since 2026-07-14 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56164

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164

NVD References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164

CVE-2026-15409 - SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. Product: SonicWall SMA1000 Appliances CVSS Score: ** KEV since 2026-07-14 ** CVE: https://www.cve.org/CVERecord?id=CVE-2026-15409 References:

- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409

CVE-2026-15410 - SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. Product: SonicWall SMA1000 Appliances CVSS Score: ** KEV since 2026-07-14 ** NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15410 ISC Diary: ISC Podcast: NVD References:

- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410

CVE-2026-20744 - The charging station websocket endpoint accepts connections without

proper authentication, which could lead to privilege escalation.

Product: Charging Station WebSocket Endpoint

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20744

NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-01

NVD References: https://www.hydroquebec.com/nous-joindre/

CVE-2026-14480 - OpenPLC Runtime v3 is vulnerable to an authenticated arbitrary file write flaw, allowing an attacker to write malicious files that can lead to arbitrary native code execution.

Product: OpenPLC Runtime v3

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14480

NVD References:

- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-190-01.json

- https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-01

CVE-2026-14740 - DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment

Product: Perl DBI

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14740

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14740

NVD References: https://github.com/perl5-dbi/dbi/security/advisories/GHSA-35f4-f8m9-w8xg

CVE-2026-9547 - SSH improper host validation

Product: libcurl

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9547

CVE-2026-8924 - trailing dot domain super cookie

Product: curl

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8924

CVE-2026-8926 - password leak with netrc and user in URL

Product: curl

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8926

CVE-2026-38968 - ntopng through 6.6 is vulnerable to Predictable Session Identifier, allowing for Session Hijacking due to weak time-seeded pseudo-randomness in HTTP session creation.

Product: ntopng

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-38968

CVE-2026-60121, CVE-2026-61498 - Unauthenticated OS command injection vulnerabilities in Vitec Flamingo 4.12.2

Product: Vitec Flamingo 4.12.2

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-60121

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61498

NVD References:

- https://damiri.fr/en/cve/CVE-2026-60121

- https://damiri.fr/en/cve/CVE-2026-61498

CVE-2026-33264 - Apache Airflow had a vulnerability in `BaseSerialization.deserialize()` that allowed malicious triggers to gain remote code execution, fixed in version 3.3.0 with a mitigation for restricted DAG-author trust.

Product: Apache Airflow

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33264

NVD References: https://lists.apache.org/thread/otvdw8qt2y7xy2n5nq9xby9ky4rf5ltj

CVE-2026-41041, CVE-2026-41042 - Vulnerabilities in Apache Gravitino.

Product: Apache Gravitino

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41041 (URL path injection)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41042 (improper input validation)

NVD References:

- https://lists.apache.org/thread/4dnwg1qzb2yns1fkfmq0z45vmwyzytgz

- https://lists.apache.org/thread/vdh88wc6j5b38v65ncb111wbbnkf6bvm

CVE-2026-28564, CVE-2026-40005, CVE-2026-40008 - Multiple vulnerabilities in Apache IoTDB.

Product: Apache IoTDB

CVSS Scores: 9.1 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28564 (insufficient session expiration)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-40005 (path traversal)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-40008 (unsafe reflection vulnerability)

NVD References:

- https://lists.apache.org/thread/l38wpy7flvvfwv4rkps87l5z8gprnfy0

- https://lists.apache.org/thread/zw2vkbmy5xkf5y8g237v81hrs4c6b5lq

- https://lists.apache.org/thread/fm8cpvzbox2qqy99ztglm8wkk1nrg9ng

CVE-2026-59083, CVE-2026-59084 - Vulnerabilities in Apache Tomcat is vulnerable to an improper handling of URL encoding issue that allows for security constraint bypass in certain configurations, affecting versions 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0.M1 through 9.0.119, and 8.5.0 through 8.5.100.

Product: Apache Tomcat

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59083 (improper handling of URL encoding)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59084 (insufficient technical documentation)

NVD References:

- https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq

- https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7

CVE-2026-58319 - Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication, allowing unauthenticated attackers to potentially disrupt cluster integrity and availability.

Product: Apache Doris

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58319

NVD References: https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4

CVE-2026-53481, CVE-2026-53483 - Dell PowerProtect Data Domain Vulnerabilities

Product: Dell Data Domain Operating System

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53481 (path traversal)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53483 (improper authentication)

NVD References: https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

CVE-2026-56688 - Dell PowerFlex Manager prior to version 5.1.0.1 allows remote attackers to execute arbitrary commands as root via OS Command Injection vulnerability in OS Repository processing, potentially leading to full appliance compromise.

Product: Dell PowerFlex Manager

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56688

NVD References: https://www.dell.com/support/kbdoc/en-us/000477538/dsa-2026-066-security-update-for-powerflex-software-multiple-vulnerabilities

CVE-2026-44024 - Fluentd allowed attackers to potentially achieve remote code execution by dynamically constructing file paths with insufficient validation of tags before version 1.19.3.

Product: Fluentd

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44024

NVD References: https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3

CVE-2026-57156, CVE-2026-57158 - FreeRDP clients prior to version 3.28.0 on 32-bit builds are vulnerable to an integer overflow leading to a heap buffer overflow.

Product: FreeRDP

CVSS Scores: 9.1 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57156 (integer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57158 (remote code execution)

NVD References:

- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mp3f-59pg-c5pp

- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v5wf-j8j4-77h7

CVE-2026-45488, CVE-2026-45489, CVE-2026-55945, CVE-2026-56645, CVE-2026-56646, CVE-2026-57974, CVE-2026-57975, CVE-2026-57977, CVE-2026-57981, CVE-2026-57983 through CVE-2026-57988, CVE-2026-57991, CVE-2026-57992, CVE-2026-57993, CVE-2026-58276, CVE-2026-58278, CVE-2026-58281 through CVE-2026-58300, CVE-2026-58522 through CVE-2026-58525, CVE-2026-58596, CVE-2026-58597 - Multiple vulnerabilities in Microsoft Edge / Microsoft Edge for Android

Product: Microsoft Edge

CVSS Scores: 4.3 - 9.0

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45488

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45489

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55945

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56645

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56646

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57974

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57975

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57977

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57981

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57983

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57984

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57985

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57986

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57987

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57988

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57992

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57993

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58276

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58278

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58281

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58282

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58283

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58284

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58285

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58286

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58287

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58288

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58289

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58290

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58291

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58292

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58293

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58294

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58295

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58296

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58297

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58298

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58299

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58300

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58522

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58523

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58524

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58525

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58596

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58597

CVE-2026-27690 - SAP Approuter is vulnerable to HTTP Request Smuggling, allowing unauthenticated attackers to desynchronize requests, potentially exposing user responses and causing system downtime.

Product: SAP Approuter

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-27690

CVE-2026-44747 - SAP NetWeaver Application Server ABAP is susceptible to memory corruption through logical errors, enabling an attacker to potentially access, modify, or disrupt the system, compromising confidentiality, integrity, and availability.

Product: SAP NetWeaver Application Server ABAP

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44747

CVE-2026-44761 - SAP Commerce Cloud has a vulnerability where publicly available sample OAuth2 client credentials can be used by an attacker to access and manipulate data.

Product: SAP Commerce Cloud

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44761

CVE-2026-3014 - XProtect® has a security vulnerability in its Management Server API, allowing users with edit permissions to execute arbitrary code within the Management Server Service.

Product: Milestone XProtect®

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-3014

CVE-2026-13019 - Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux, and Kubernetes are vulnerable to a missing authentication flaw, enabling remote attackers to access unprotected APIs.

Product: Esri Portal For Arcgis

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13019

NVD References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/june-2026-arcgis-security-bulletin

CVE-2026-46354 - Coder allows organizations to provision remote development environments via Terraform, with versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 being vulnerable to accepting forged workspace agent session tokens without authentication.

Product: Coder

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-46354

NVD References: https://github.com/coder/coder/security/advisories/GHSA-6x44-w3xg-hqqf

CVE-2026-9695 - DELMIA Apriso from Release 2020 through Release 2026 is vulnerable to unauthorized privileged access due to an Improper Authentication flaw.

Product: DELMIA Apriso

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9695

NVD References: https://www.3ds.com/trust-center/security/security-advisories/cve-2026-9695

CVE-2026-14454 - Imager versions before 1.033 for Perl mishandle large EXIF IFD entry counts, potentially allowing an attacker to craft an image that kills a worker process.

Product: Imager

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14454

CVE-2026-15062 - The SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 may allow authenticated low-privilege users to execute unauthorized SQL queries and potentially compromise the source database.

Product: Snowflake Snowpark Python SDK

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15062

CVE-2026-9074 - IBM API Connect versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 is vulnerable to unauthenticated SQL injection in the password reset feature.

Product: IBM API Connect

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9074

CVE-2026-15113 - Google Chrome on Android prior to 150.0.7871.115 allows a remote attacker to potentially escape the sandbox through a crafted HTML page.

Product: Google Chrome

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15113

NVD References: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html

CVE-2026-47646 - Dynamics 365 Customer Voice is vulnerable to cross-site scripting, allowing unauthorized attackers to spoof over a network.

Product: Microsoft Dynamics 365 Customer Voice

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-47646

NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47646

CVE-2026-47826 - BOSH CLI tool versions prior to v7.10.4 are vulnerable to blobs.yml path key traversal, enabling attackers to write arbitrary files and extract sensitive data.

Product: BOSH CLI

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-47826

NVD References: https://www.cloudfoundry.org/blog/cve-2026-47826-blobs-yaml-path-traversal-allows-file-writes/

CVE-2026-59826 - Metabase failed to validate unsafe H2 connection properties on a specific code path, allowing an authenticated administrator to execute arbitrary Java code on the server in versions prior to 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2.

Product: Metabase

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59826

NVD References: https://github.com/metabase/metabase/security/advisories/GHSA-8wx2-rxp2-4x35

CVE-2026-59827 - Metabase instances with an H2 database connection prior to versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4 allow authenticated users to execute arbitrary code on the server by deserializing Java objects returned in H2 native query results without validation.

Product: Metabase

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59827

NVD References: https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36

CVE-2026-0284 - Palo Alto Networks PAN-OS® software is vulnerable to XML injection in LSVPN, allowing network attackers to inject malicious content and potentially compromise LSVPN satellite data.

Product: Palo Alto Networks PAN-OS®

CVSS Score: 9.9

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-0284

NVD References: https://security.paloaltonetworks.com/CVE-2026-0284

CVE-2026-15143, CVE-2026-15378 - Server-side request forgery vulnerabilities in Guardrails-detectors.

Product: Red Hat Guardrails-detectors

CVSS Score: 9.3

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15143

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15378

NVD References:

- https://access.redhat.com/security/cve/CVE-2026-15143

- https://access.redhat.com/security/cve/CVE-2026-15378

CVE-2026-59792 - In JetBrains IntelliJ IDEA before 2026.1.4,

2026.2 code execution via path traversal in project workspace ID handling was possible

Product: JetBrains IntelliJ IDEA

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59792

NVD References: https://www.jetbrains.com/privacy-security/issues-fixed/

CVE-2026-59151 - Prowler's SAML authentication flow prior to version 5.30.3 could enable an authenticated attacker with a controlled IdP to issue tokens for the wrong tenant, leading to cross-tenant account takeover.

Product: Prowler

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59151

NVD References: https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp

CVE-2026-61459 - MCP Server Kubernetes before 3.9.0 is vulnerable to argument injection in structured tools, enabling attackers to redirect commands to a malicious API server and compromise the entire cluster.

Product: MCP Server Kubernetes

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61459

CVE-2026-9726 - Drupal AlternativeCommerce (Basket) versions from 0.0.0 to 2.1.17 are vulnerable to Object Injection due to improperly controlled modification of dynamically-determined object attributes.

Product: Drupal AlternativeCommerce (Basket)

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9726

NVD References: https://www.drupal.org/sa-contrib-2026-038

CVE-2026-10768 - Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.

Product: Drupal LocalGov Workflows

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-10768

NVD References: https://www.drupal.org/sa-contrib-2026-039

CVE-2026-12535 - Drupal Formatter Field is vulnerable to improper object attribute modification, allowing for object injection in versions 0.0.0 to 2.0.0.

Product: Drupal Formatter Field

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12535

NVD References: https://www.drupal.org/sa-contrib-2026-048

CVE-2026-11913 - Vulnerability in Drupal Mother May I

Product: Drupal Mother May I

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11913

NVD References: https://www.drupal.org/sa-contrib-2026-045

CVE-2026-15089 - Vulnerability in Drupal Commerce guest registration

Product: Drupal Commerce guest registration

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15089

NVD References: https://www.drupal.org/sa-contrib-2026-079

CVE-2026-57827 - RSFiles, a Joomla extension, is vulnerable to an unauthenticated arbitrary file upload, allowing for the upload of executable files and resulting in full RCE.

Product: RSFiles Joomla extension

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57827

CVE-2026-57830 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion.

Product: Helix Ultimate Joomla extension

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57830

CVE-2026-56260 - Crawl4AI before 0.8.7 allows an attacker to write arbitrary files on the server through the Docker API server's /screenshot and /pdf endpoints.

Product: Crawl4AI

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56260

CVE-2026-56271 - Flowise before 3.1.0 uses weak hardcoded default JWT secrets and values, allowing for authentication bypass.

Product: Flowise

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56271

CVE-2026-4769 - WAGO System I/O Field series devices have an undocumented vulnerability that allows an unauthenticated remote attacker to gain access to internal system processes during the initial startup sequence.

Product: WAGO System I/O Field series

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-4769

CVE-2026-14453 - Centreon Infra Monitoring product is vulnerable to critical SSTI in centreon-open-tickets module, allowing authenticated users to execute arbitrary code on the server and potentially disclose environment secrets.

Product: Centreon

CVSS Score: 9.6

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14453

CVE-2026-57433 - Storable versions before 3.41 for Perl are vulnerable to a signed integer overflow when deserializing a crafted SX_HOOK record, potentially leading to a panic and termination of the deserialization process.

Product: Storable

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57433

CVE-2026-51536, CVE-2026-51537, CVE-2026-51538, CVE-2026-51540, CVE-2026-51541 - Multiple vulnerabilities in EIPStackGroup OpENer 2.3.0 (commit 76b95cf)

Product: OpENer

CVSS Scores: 9.1 - 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51536 (stack buffer overflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51537 (out-of-bounds read)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51538 (incorrect access control)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51540 (integer underflow)

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51541 (out-of-bounds read)

NVD References: https://github.com/EIPStackGroup/OpENer/issues/582

NVD References: https://github.com/EIPStackGroup/OpENer/issues/568

NVD References: https://github.com/EIPStackGroup/OpENer/issues/565

NVD References: https://github.com/EIPStackGroup/OpENer/issues/564

NVD References: https://github.com/EIPStackGroup/OpENer/issues/563

CVE-2026-51821 - Shenzhou Shihan Video Conference System v.1.0 is vulnerable to SQL injection, allowing remote attackers to execute arbitrary code via the /user/getUserLogin endpoint.

Product: Shenzhou hihan Video Conference System v.1.0

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-51821

CVE-2026-52533 - An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file

Product: D-Link DIR-1253

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-52533

CVE-2026-58102 - Crypt::OpenSSL::X509 versions before 2.1.3 for Perl may allow a heap out-of-bounds read vulnerability due to a long certificate extension OID in hv_exts.

Product: Crypt::OpenSSL::X509 Perl

CVSS Score: 9.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58102

CVE-2026-57898 - Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12 are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API, allowing remote attackers to potentially execute code on the server.

Product: Eclipse BaSyx Java Server SDK

CVSS Score: 9.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57898

CVE-2026-56451 - Opcenter X (All versions < V2604) is vulnerable to a JWT header validation flaw allowing unauthenticated remote attackers to impersonate users and gain unauthorized access.

Product: Opcenter X

CVSS Score: 10.0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56451

NVD References: https://cert-portal.siemens.com/productcert/html/ssa-096828.html

CVE-2026-54982, CVE-2026-54995 - Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerabilities

Product: Reliable Multicast Transport Driver (RMCAST) Integer underflow

CVSS Scores: 8.1 - 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54982

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54995

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details:

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54982

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54995

CVE-2026-50661 - Windows BitLocker Security Feature Bypass Vulnerability

Product: Microsoft Windows BitLocker

CVSS Score: 6.1

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50661

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661

CVE-2026-54128 - Windows DHCP Client Remote Code Execution Vulnerability

Product: Microsoft Windows DHCP Client

CVSS Score: 8.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54128

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54128

CVE-2026-41109 - GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Product: GitHub Copilot

CVSS Score: 8.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41109

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109

CVE-2026-13862 - Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) in Google Chrome on iOS prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page.

Product: Google Chrome

CVSS Score: 0

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13862

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13862

CVE-2026-56002 - libXfont2 PCF Font Parsing Heap Buffer Overflow

Product: X Libxfont

CVSS Score: 8.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56002

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56002

CVE-2026-56003 - libXfont2 computeProps Property Buffer Heap Buffer Overflow

Product: X Libxfont

CVSS Score: 8.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-56003

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56003

CVE-2026-58250 - NATS Server: Pre-auth server crash via double INFO in leafnode handshake

Product: Linux Foundation NATS Server

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58250

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58250

NVD References: https://github.com/nats-io/nats-server/security/advisories/GHSA-3g5q-cfh2-cq67

CVE-2026-58207 - NATS Server: Remote crash via integer overflow in Connz pagination

Product: Linux Foundation NATS Server

CVSS Score: 7.7

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58207

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58207

NVD References: https://github.com/nats-io/nats-server/security/advisories/GHSA-q59r-vq66-pxc2

CVE-2026-15308 - Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Product: Python

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15308

NVD References: https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/

CVE-2026-12413 - IKEv2 Denial of Service via malformed fragmentation

Product: Libreswan pluto daemon

CVSS Score: 7.5

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12413

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12413

CVE-2026-45499 - Azure OpenAI Elevation of Privilege Vulnerability

Product: Azure OpenAI

CVSS Score: 9.9

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45499

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45499

CVE-2026-57100 - Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

Product: Microsoft Entra Provisioning Service

CVSS Score: 9.9

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-57100

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57100

CVE-2026-41106 - Microsoft 365 Copilot Elevation of Privilege Vulnerability

Product: Microsoft Microsoft 365 Copilot

CVSS Score: 9.3

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41106

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41106

CVE-2026-54998 - Microsoft Exchange Online Elevation of Privilege Vulnerability

Product: Microsoft Exchange Online

CVSS Score: 8.8

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54998

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54998

CVE-2026-26145 - Microsoft Azure Synapse Elevation of Privilege Vulnerability

Product: Microsoft Azure Synapse

CVSS Score: 4.8

NO CUSTOMER ACTION REQUIRED

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-26145

ISC Diary: https://isc.sans.edu/diary/33154

MSFT Details: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26145

The following vulnerability needs a manual review:

CVE-2026-50656 - Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as &quot;RoguePlanet &quot;.

Product: Microsoft Malware Protection Engine in Microsoft Defender

CVSS Score: 7.8 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50656

MSFT References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656