CVE Tools
Sign in
month report

July 2026

Data as of Jul 13, 2026, 05:00 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

July 2026 closed with 2,608 published CVEs — -36.2% YoY . 232 criticals, 7 added to CISA KEV. google led volume, mostly via chrome. Biggest breakout: drupal at ×4.4 their 12-month median. Top weakness class — CWE-79 (281 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Projected total
4,756
-42.8% MoM+16.4% YoY· proj
Severity mix
232 / 906
critical / high
KEV added
7
0 ransomware-linked
Nuclei coverage
0.1%
3 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
7.2
n=1
Within 7 days
0.0%
Within 30 days
100.0%
Days → KEV (median)
1
n=1
Weakness × Vendor

What's spreading where in July 2026

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS862Missing Authorization89SQL Injection416Use After Free22Path Traversal122Heap Buffer Overflow863Incorrect Authorization918SSRF639Auth Bypass via User Key200Information Exposuremicrosoft162214011123630google23051adobe14252931apache software foundation461658apache45658red hat1241231npm19212324drupal139232symfony61141gitea1418233linuxnvidia132

Most discussed CVEs — July 2026

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1google·
    79 CVE16 critCVSS 7.9
    chrome (79)
  • 2apache software foundation↑5
    61 CVE18 critCVSS 7.7
    apache camel (22) · apache iotdb (10) · apache airflow (6)
  • 3microsoft·
    53 CVE5 critCVSS 7.5
    microsoft edge (chromium-based) (47) · edge chromium (45) · azure openai (1)
  • 4apache↑4
    51 CVE14 critCVSS 7.6
    camel (34) · airflow (6) · lucene.net (3)
  • 5npm↑5
    48 CVE
    openclaw (29) · @asymmetric-effort/specifyjs (5) · better-auth (3)
  • 6drupal—
    46 CVE
    ×4.4
    drupal core (5) · ai (artificial intelligence) (2) · paragraphs (2)
  • 7gitea—
    40 CVE11 critCVSS 7.7
    ×4.2Nuclei 1
    gitea open source git server (40)
  • 8linux↓6
    38 CVE
    linux (38)
  • 9redhat↓3
    36 CVE4 critCVSS 6.4
    red hat enterprise linux 9 (19) · red hat enterprise linux 8 (19) · red hat enterprise linux 6 (17)
  • 10coolify↑86
    34 CVE4 critCVSS 7.2
    ×3.1
    coolify (34)
  • 11dell↑12
    33 CVE3 critCVSS 5.5
    powerprotect data domain (25) · data domain operating system (25) · unisphere for powermax (3)
  • 12crates.io↑116
    29 CVE
    surrealdb (20) · zebrad (3) · jxl-oxide (1)
  • 13foxitsoftware—
    28 CVECVSS 7.4
    pdf editor (28) · pdf reader (28)
  • 14foxit software inc.—
    28 CVECVSS 7.4
    foxit pdf editor (28) · foxit pdf reader (28)
  • 15sourcecodester↑4
    28 CVECVSS 6.8
    class and exam timetabling system (8) · multi-vendor online grocery management system (6) · onlne examination & learning management system (5)
  • 16code-projects↑37
    27 CVECVSS 6.9
    real state services (7) · hotel and tourism reservation (6) · assessment management (4)
  • 17ubiquiti inc—
    25 CVE7 critCVSS 8.5
    ×3.1
    dream routers (7) · cloud gateways (7) · dream machines (7)
  • 18ui—
    25 CVE7 critCVSS 8.4
    NEW×4.2
    enterprise network video recorder core firmware (6) · unifi network video recorder pro firmware (6) · enterprise network video recorder firmware (6)
  • 19mediawiki—
    24 CVE3 critCVSS 6.6
    ×3.0
    mediawiki (21) · cargo (3)
  • 20capgo↓7
    22 CVECVSS 6.3
    capgo (22)
  • 21guardian—
    22 CVE19 critCVSS 9.1
    NEW
    language-system (22)
  • 22juniper—
    22 CVECVSS 5.9
    PoC 22
    junos os (18) · junos os evolved (8)
  • 23coder—
    20 CVE1 critCVSS 6.9
    NEW
    coder (20)
  • 24grokability—
    20 CVECVSS 5.9
    NEW
    snipe-it (20)
  • 25curl—
    18 CVE8 critCVSS 8.3
    NEW
    curl (18)
  • 26geovision inc.↑23
    18 CVECVSS 8.3
    geowebplayer (18)
  • 27haxx—
    18 CVE8 critCVSS 8.3
    NEW
    curl (18)
  • 28imagemagick↓6
    18 CVECVSS 4.3
    imagemagick (18)
  • 29praison—
    18 CVE4 critCVSS 7.5
    praisonai (18)
  • 30samsung mobile↑47
    18 CVE
    samsung mobile devices (13) · inputsharing (1) · samsung health (1)
  • 31wikimedia foundation—
    18 CVE1 critCVSS 6.4
    mediawiki (11) · timeline (2) · syntaxhighlight_geshi (1)
  • 32fossbilling↑103
    17 CVE
    NEW
    fossbilling (17)
  • 33nvidia—
    17 CVE3 critCVSS 8.3
    nemo megatron bridge (11) · megatron-bridge (11) · connectx lts22 (2)
  • 34open-webui↑24
    17 CVECVSS 5.4
    open-webui (17)
  • 35watchguard—
    17 CVECVSS 6.0
    fireware os (17) · fireware (11) · mobile vpn with ssl (1)
  • 36picklescan↓10
    16 CVECVSS 8.1
    picklescan (16)
  • 37openwebui↑29
    15 CVECVSS 5.5
    open webui (15)
  • 38palo alto networks↑122
    14 CVECVSS 7.5
    PoC 14
    pan-os (10) · cloud ngfw (10) · prisma access (10)
  • 39corewcf—
    13 CVE1 critCVSS 6.6
    NEW
    corewcf (13)
  • 40n8n↓8
    13 CVECVSS 6.3
    n8n (13)
  • 41cisco↑86
    12 CVECVSS 7.4
    PoC 8
    secure endpoint (7) · cisco secure endpoint (7) · rv110w firmware (4)
  • 42codeastro↓8
    12 CVECVSS 6.5
    apartment visitor management system (7) · ecommerce website (3) · simple online leave management system (2)
  • 43getgrav—
    12 CVECVSS 5.9
    grav (12)
  • 44joomla—
    12 CVECVSS 6.6
    joomla\! (12)
  • 45joomla! project—
    12 CVECVSS 6.6
    joomla! cms (12)
  • 46linuxfoundation—
    12 CVE2 critCVSS 6.9
    containerd (6) · nats-server (3) · opentelemetry instrumentation for java (2)
  • 47nats-io—
    12 CVECVSS 6.6
    nats-server (12)
  • 48wireshark—
    12 CVECVSS 5.3
    wireshark (12)
  • 49wireshark foundation—
    12 CVECVSS 5.3
    wireshark (11) · ciscodump (1)
  • 50craftcms↑147
    11 CVE
    cms (11)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79281·
2CWE-862168↑2
3CWE-89163·
4CWE-22107↑3
5CWE-863102↑12
6CWE-7494↑8
7CWE-63990↑6
8CWE-7882↑4
9CWE-91878↑6
10CWE-28474↓5
11CWE-20068↓2
12CWE-41668↓10
13CWE-2067↓7
14CWE-50256↓4
15CWE-9455↑3
16CWE-78749·
17CWE-28547↑15
18CWE-77044↑7
19CWE-28742↑5
20CWE-30642↓9

Sectors

Solution categories ranked by distinct CVE count this period.

  • Web & CMS Plugins583 CVE
    33 crit2 KEV247 vendorsCVSS 7.3
    grav (14) · joomla! cms (12) · joomla\! (12)
  • OSS Libraries457 CVE
    40 crit113 vendorsCVSS 7.4
    camel (34) · capgo (25) · curl (18)
  • Consumer Software231 CVE
    20 crit27 vendorsCVSS 8.4
    chrome (79) · microsoft edge (chromium-based) (47) · desktop (1)
  • Operating Systems197 CVE
    13 crit17 vendorsCVSS 7.5
    linux (38) · red hat enterprise linux 8 (19) · red hat enterprise linux 9 (19)
  • Enterprise Software184 CVE
    21 crit57 vendorsCVSS 9.8
    snipe-it (31) · powerprotect data domain (25) · moveit transfer (8)
  • Networking Infrastructure159 CVE
    70 crit37 vendorsCVSS 8.5
    junos os (18) · fireware os (17) · fireware (11)
  • DevTools & CI151 CVE
    24 crit27 vendorsCVSS 7.5
    apache camel (22) · radare2 (9) · hoppscotch (3)
  • Cloud & SaaS150 CVE
    26 crit53 vendorsCVSS 8.6
    coolify (34) · containerd (6) · n8n (4)
  • AI / ML121 CVE
    19 crit43 vendorsCVSS 7.6
    praisonai (18) · open-webui (17) · open webui (15)
  • Security Products113 CVE
    9 crit39 vendorsCVSS 7.3
    zitadel (9) · privileged remote access (4) · red hat single sign-on 7 (4)
  • Hardware Firmware77 CVE
    20 crit19 vendorsCVSS 7.5
    fastconnect 6900 firmware (11) · fastconnect 7800 firmware (11) · megatron-bridge (11)
  • Databases61 CVE
    9 crit13 vendorsCVSS 9.2
    nats-server (12) · rabbitmq-server (11) · red hat data grid 8 (3)
  • ICS / OT / IoT39 CVE
    6 crit13 vendorsCVSS 8.4
    geowebplayer (18) · frigate (1) · m300 wi-fi repeater (1)
  • Communications30 CVE
    14 vendorsCVSS 7.4
    astrbot (3) · markdownify-mcp (2) · misskey (2)
  • Mobile Apps1 CVE
    1 vendors
    samsung health (1)
  • Unclassified35 CVE
    3 crit26 vendorsCVSS 6.3
    assessment management (4) · jodit (3) · luci (3)
Weakness × Sector

Which weaknesses hit which solution categories in July 2026

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS862Missing Authorization89SQL Injection416Use After Free22Path Traversal122Heap Buffer Overflow863Incorrect Authorization918SSRF639Auth Bypass via User Key200Information ExposureWeb & CMS Plugins207102922410243731Operating Systems113213449356329OSS Libraries262569271344211031Consumer Software25246393512735Enterprise Software3624525161812516Cloud & SaaS1214418111912134Networking Infrastructure10362107483DevTools & CI1613310216979AI / ML412521161788Security Products941497431