CVE Tools
Sign in
month report

July 2026

Data as of Aug 3, 2026, 05:00 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

July 2026 closed with 10,240 published CVEs — +150.6% YoY . 1,218 criticals, 26 added to CISA KEV. oracle led volume, mostly via oracle coherence. Biggest breakout: oracle at ×13.6 their 12-month median. Top weakness class — CWE-284 (913 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
10,240
+23.2% MoM+150.6% YoY
Severity mix
1,218 / 3,888
critical / high
KEV added
26
0 ransomware-linked
Nuclei coverage
0.2%
18 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
7.2
n=13
Within 7 days
46.2%
Within 30 days
100.0%
Days → KEV (median)
0
n=13
Detection gap

KEV pressure, no Nuclei coverage

July 2026 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in July 2026

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

284CWE-28479XSS862Missing Authorization89SQL Injection306Missing Auth for Critical Func…416Use After Free200Information Exposure22Path Traversal863Incorrect Authorization20Improper Input Validationoracle corporation6821036258111717oracle6821036257111717linux78microsoft2618728141336310google141319210592apache software foundation512543912329apache312533911227apple1121318514red hat519413353npm671563117224adobe1432161210ibm181262821

Most discussed CVEs — July 2026

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1oracle↑3
    1,108 CVE210 critCVSS 7.4
    ×13.6
    oracle coherence (98) · coherence (93) · webcenter content (54)
  • 2linux·
    837 CVE88 critCVSS 7.9
    linux (837) · linux kernel (93)
  • 3microsoft·
    664 CVE35 critCVSS 7.3
    ×4.8KEV 4
    windows server 2025 (server core installation) (388) · windows server 2025 (388) · windows 11 version 26h1 (382)
  • 4google↓3
    496 CVE78 critCVSS 6.8
    ×4.7
    chrome (487) · mcp-toolbox (5) · mcp toolbox for databases (googleapis/mcp-toolbox) (2)
  • 5apache software foundation↑2
    181 CVE46 critCVSS 7.7
    ×8.2
    apache traffic server (39) · apache camel (22) · apache thrift (15)
  • 6apple↑11
    167 CVE55 critCVSS 7.7
    macos (159) · ios and ipados (84) · ipados (84)
  • 7redhat↓1
    164 CVE6 critCVSS 6.3
    red hat enterprise linux 9 (87) · red hat enterprise linux 10 (86) · red hat enterprise linux 8 (84)
  • 8npm↑2
    158 CVE
    n8n (34) · openclaw (29) · @budibase/server (19)
  • 9apache↓1
    116 CVE31 critCVSS 7.7
    ×5.8
    camel (34) · thrift (15) · traffic server (12)
  • 10adobe↓5
    107 CVE15 critCVSS 7.2
    coldfusion (16) · commerce (14) · adobe bridge (14)
  • 11ibm·
    105 CVE25 critCVSS 7.1
    Nuclei 1
    langflow oss (26) · websphere application server (14) · websphere application server - liberty (14)
  • 12mozilla↑6
    71 CVE39 critCVSS 8.7
    ×3.5
    firefox (67) · thunderbird (66) · firefox mobile (3)
  • 13surrealdb—
    57 CVECVSS 6.1
    NEW
    surrealdb (57)
  • 14symfony—
    56 CVE8 critCVSS 7.0
    NEW
    symfony (29) · twig (17) · ux (9)
  • 15praison—
    54 CVE11 critCVSS 7.8
    praisonai (38) · praisonai-platform (16) · praisonaiagents (2)
  • 16sourcecodester↑3
    49 CVECVSS 6.1
    class and exam timetabling system (23) · multi-vendor online grocery management system (6) · simple and nice shopping cart script (5)
  • 17drupal—
    46 CVE5 critCVSS 5.9
    ×4.4
    drupal (5) · drupal core (5) · drupal canvas (2)
  • 18openclaw↓4
    44 CVECVSS 7.4
    openclaw (41) · msteams (3) · feishu (2)
  • 19dell↑4
    43 CVE5 critCVSS 5.5
    powerprotect data domain (25) · data domain operating system (25) · powerprotect data manager (6)
  • 20nvidia—
    43 CVE3 critCVSS 7.9
    tensorrt-llm (12) · megatron-bridge (11) · nemo megatron bridge (11)
  • 21crates.io↑107
    41 CVE
    surrealdb (20) · zebrad (3) · hubuum_client (3)
  • 22hclsoftware↑115
    41 CVECVSS 4.4
    NEW×5.5
    aftermarket epc (14) · mycloud (7) · intelliops event management (4)
  • 23gitea—
    40 CVE11 critCVSS 7.7
    ×4.2Nuclei 1
    gitea open source git server (40)
  • 24getgrav—
    38 CVE3 critCVSS 7.2
    grav (38)
  • 25imagemagick↓3
    37 CVECVSS 3.9
    imagemagick (37)
  • 26coolify↑70
    34 CVE4 critCVSS 7.2
    ×3.1
    coolify (34)
  • 27code-projects↑26
    33 CVECVSS 6.7
    real state services (7) · hotel and tourism reservation (6) · online job portal (5)
  • 28n8n↑4
    33 CVE1 critCVSS 6.6
    n8n (33)
  • 29pypi↓20
    33 CVE
    gitpython (9) · jupyterlab (5) · mcp-atlassian (3)
  • 30go↓5
    31 CVE
    github.com/tinfoil-factory/netfoil (4) · github.com/openlistteam/openlist/v4 (3) · github.com/jandedobbeleer/oh-my-posh (2)
  • 31regularlabs.com—
    29 CVE6 critCVSS 7.6
    NEW
    conditional content extension for joomla (5) · geoip extension for joomla (5) · articles anywhere extension for joomla (5)
  • 32xen—
    29 CVE3 critCVSS 7.4
    NEW×5.8
    xen (18) · xapi (6) · windows pv drivers (3)
  • 33elastic—
    28 CVECVSS 5.8
    ×4.3
    kibana (17) · elasticsearch (9) · endpoint security (1)
  • 34foxitsoftware—
    28 CVECVSS 7.4
    pdf reader (28) · pdf editor (28)
  • 35foxit software inc.—
    28 CVECVSS 7.4
    foxit pdf reader (28) · foxit pdf editor (28)
  • 36sensiolabs—
    28 CVE3 critCVSS 7.0
    NEW
    symfony (28)
  • 37zephyrproject↑8
    28 CVECVSS 5.9
    zephyr (28)
  • 38jetbrains↑77
    27 CVE6 critCVSS 7.9
    intellij idea (7) · teamcity (7) · webstorm (4)
  • 39linuxfoundation—
    26 CVE2 critCVSS 6.8
    nats-server (12) · containerd (6) · spinnaker (2)
  • 40mongodb↑34
    26 CVECVSS 6.2
    ×3.7
    mongodb server (25) · mongodb compass (1)
  • 41mediawiki—
    25 CVE3 critCVSS 6.6
    ×3.1
    mediawiki (22) · cargo (3)
  • 42nlnetlabs↑136
    25 CVE2 critCVSS 5.8
    NEW
    unbound (23) · net::dns (2)
  • 43ubiquiti inc—
    25 CVE7 critCVSS 8.5
    ×3.1
    cloud gateways (7) · dream wall (7) · dream machines (7)
  • 44ui—
    25 CVE7 critCVSS 8.4
    NEW×4.2
    unifi dream wall firmware (6) · enterprise network video recorder core firmware (6) · enterprise network video recorder firmware (6)
  • 45nlnet labs↑113
    24 CVE1 critCVSS 5.6
    NEW
    unbound (24)
  • 46nuget—
    24 CVE
    magick.net-q16-hdri-openmp-arm64 (20) · magick.net-q16-hdri-x64 (20) · magick.net-q16-hdri-x86 (20)
  • 47packagist↑4
    24 CVE
    guzzlehttp/guzzle (4) · poweradmin/poweradmin (3) · craftcms/cms (3)
  • 48egor—
    23 CVE7 critCVSS 5.9
    NEW
    data::spatialhash::shared (2) · data::disjointset::shared (2) · data::hashmap::shared (2)
  • 49hcltech↑89
    23 CVECVSS 4.5
    dfxanalytics (9) · dfx server (4) · intelliops event management (4)
  • 50capgo↓37
    22 CVECVSS 6.3
    capgo (22)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-284913↑4
2CWE-79765↓1
3CWE-862477↑1
4CWE-89394↓1
5CWE-306393↑6
6CWE-200370↑3
7CWE-22333·
8CWE-416332↓6
9CWE-863288↑8
10CWE-20273↓4
11CWE-918261↑4
12CWE-639255↑1
13CWE-269252↑8
14CWE-125234↓6
15CWE-400222↑4
16CWE-287204↑8
17CWE-122196↑5
18CWE-78195↓6
19CWE-94184↓1
20CWE-787162↓4

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems1,989 CVE
    572 crit15 KEV35 vendorsCVSS 7.7
    linux (837) · red hat enterprise linux 9 (87) · red hat enterprise linux 10 (86)
  • Web & CMS Plugins1,394 CVE
    120 crit4 KEV550 vendorsCVSS 7.5
    easyappointments (6) · ecommerce-codeigniter-bootstrap (6) · mailpit (6)
  • OSS Libraries1,337 CVE
    134 crit234 vendorsCVSS 7.2
    imagemagick (37) · camel (34) · symfony (28)
  • Enterprise Software1,240 CVE
    177 crit12 KEV152 vendorsCVSS 8.0
    microsoft sharepoint enterprise server 2016 (40) · microsoft sharepoint server 2019 (40) · snipe-it (40)
  • Databases1,091 CVE
    277 crit48 vendorsCVSS 8.1
    mysql cluster (85) · mysql server (82) · service delivery platform (36)
  • Consumer Software1,021 CVE
    175 crit56 vendorsCVSS 7.2
    chrome (487) · firefox (67) · microsoft edge (chromium-based) (51)
  • Cloud & SaaS484 CVE
    76 crit108 vendorsCVSS 7.5
    microsoft 365 (72) · n8n (33) · cal.diy (6)
  • Networking Infrastructure441 CVE
    106 crit13 KEV97 vendorsCVSS 8.4
    junos os (18) · fireware os (17) · junos (15)
  • Security Products336 CVE
    61 crit2 KEV95 vendorsCVSS 7.4
    red hat single sign-on 7 (27) · oracle unified directory (22) · oracle access manager (15)
  • AI / ML300 CVE
    53 crit85 vendorsCVSS 8.0
    praisonai (38) · open webui (19) · open-webui (19)
  • DevTools & CI285 CVE
    39 crit53 vendorsCVSS 7.4
    coder (20) · microsoft visual studio 2022 version 17.12 (15) · microsoft visual studio 2022 version 17.14 (15)
  • ICS / OT / IoT196 CVE
    68 crit61 vendorsCVSS 7.9
    charx sec-3000 (20) · charx sec-3050 (20) · charx sec-3100 (20)
  • Communications168 CVE
    42 crit37 vendorsCVSS 7.9
    thunderbird (66) · cyrus imap (9) · webmail (6)
  • Hardware Firmware155 CVE
    27 crit29 vendorsCVSS 7.6
    tensorrt-llm (12) · fastconnect 6900 firmware (11) · fastconnect 7800 firmware (11)
  • Mobile Apps10 CVE
    4 vendorsCVSS 8.8
    mcp-toolbox (5) · google-adk (1) · mdjm event management (1)
  • Unclassified128 CVE
    12 crit45 vendorsCVSS 7.0
    .net 10.0 (14) · kiota (9) · oracle enterprise command center framework (7)
Weakness × Sector

Which weaknesses hit which solution categories in July 2026

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

284CWE-28479XSS862Missing Authorization89SQL Injection306Missing Auth for Critical Func…416Use After Free200Information Exposure22Path Traversal863Incorrect Authorization20Improper Input ValidationOperating Systems431217292305216916Web & CMS Plugins6233618315320255592532Enterprise Software460954379131592232221OSS Libraries35614519192051608545Databases46812171619937353122Consumer Software2441962133231117109Cloud & SaaS1318181013810193111Networking Infrastructure221157685171118Security Products351711522512127AI / ML1072951411437257