CVE Tools
Track your stack

July 2026

10,240 CVEs published, +23% on June 2026 and 2.5× July 2025. CISA added 26 to KEV.

2026 month by month

2026, month by month. Point at another month to read it.
2026: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2026January 2026: 5,244 CVEs17 added to CISA KEVFebruary 2026: 4,931 CVEs28 added to CISA KEVMarch 2026: 6,821 CVEs26 added to CISA KEVApril 2026: 6,440 CVEs31 added to CISA KEVMay 2026: 7,365 CVEs21 added to CISA KEVJune 2026: 8,314 CVEs23 added to CISA KEVJuly 2026: 10,240 CVEs26 added to CISA KEVAugust 2026: 12,909 CVEs31 added to CISA KEVSeptember 2026: 15,180 CVEs43 added to CISA KEVOctober 2026 so far: 9,826 CVEs18 added to CISA KEV87,270+105%so far
Critical
1,21814% of the 8,704 with a CVSS score
Added to CISA KEV
2613 of this month's CVEs are in KEV, listed a median 0 days after publication
Vendors
1,9564,770 products
Top weakness
Improper Access ControlCWE-284 · 913 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1OracleOracle Coherence, Coherence, Webcenter Content1,108210none+3
  2. 2LinuxLinux, Linux Kernel83788none—
  3. 3MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows 11 Version 26h1664354—
  4. 4GoogleChrome, Mcp-toolbox, Mcp Toolbox For Databases (Googleapis/mcp-toolbox)49678none−3
  5. 5Apache Software FoundationApache Traffic Server, Apache Camel, Apache Thrift18146none+2
  6. 6ApplemacOS, iOS and iPadOS, iPadOS16755none+11
  7. 7Red HatRed Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 81646none−1
  8. 8npmN8N, Openclaw, @budibase/server1580none+2
  9. 9ApacheCamel, Thrift, Traffic Server11631none−1
  10. 10AdobeColdfusion, Commerce, Adobe Bridge10715none−5
  11. 11IBMLangflow Oss, Websphere Application Server, Websphere Application Server - Liberty10525none—
  12. 12MozillaFirefox, Thunderbird, Firefox Mobile7139none+6
  13. 13SurrealdbSurrealdb570nonenew
  14. 14SymfonySymfony, Twig, Ux568nonenew
  15. 15PraisonPraisonai, Praisonai-platform, Praisonaiagents5411nonenew
  16. 16SourcecodesterClass and Exam Timetabling System, Multi-vendor Online Grocery Management System, Simple and Nice Shopping Cart Script490none+3
  17. 17DrupalDrupal, Drupal Core, Drupal Canvas465nonenew
  18. 18OpenclawOpenclaw, Msteams, Feishu440none−4
  19. 19DellPowerprotect Data Domain, Data Domain Operating System, Powerprotect Data Manager435none+4
  20. 20NvidiaTensorrt-llm, Megatron-bridge, Nemo Megatron Bridge433nonenew
  21. 21Crates.ioSurrealdb, Zebrad, Hubuum_client410none+107
  22. 22HclsoftwareAftermarket Epc, Mycloud, Intelliops Event Management410none+115
  23. 23GiteaGitea Open Source Git Server4011nonenew
  24. 24GetgravGrav383nonenew
  25. 25ImagemagickImagemagick370none−3

Severity

How this month's CVEs score on CVSS; 1,536 have no score yet. Severity is not exploitation.

  • Critical1,21814%
  • High3,88845%
  • Medium3,22937%
  • Low3694%

Breakouts

Vendors with at least three times their own 12-month median.

  1. Oracle1,10813.6×
  2. Apache Software Foundation1818.2×
  3. Apache1165.8×
  4. Xen295.8×
  5. Hclsoftware415.5×
  6. Microsoft6644.8×
  7. Google4964.7×
  8. Drupal464.4×
  9. Elastic284.3×
  10. Gitea404.2×

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Surrealdb57#13
  2. Symfony56#14
  3. Hclsoftware41#22
  4. Regularlabs.com29#31
  5. Xen29#32
  6. Sensiolabs28#36
  7. Nlnetlabs25#42
  8. Ui25#44
  9. Nlnet Labs24#45
  10. Egor23#48

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-284Improper Access Control913+4
  2. CWE-79XSS765−1
  3. CWE-862Missing Authorization477+1
  4. CWE-89SQL Injection394−1
  5. CWE-306Missing Auth for Critical Function393+6
  6. CWE-200Information Exposure370+3
  7. CWE-22Path Traversal333—
  8. CWE-416Use After Free332−6
  9. CWE-863Incorrect Authorization288+8
  10. CWE-20Improper Input Validation273−4
  11. CWE-918SSRF261+4
  12. CWE-639Auth Bypass via User Key255+1
  13. CWE-269Improper Privilege Mgmt252+8
  14. CWE-125Out-of-bounds Read234−6
  15. CWE-400Resource Consumption222+4
  16. CWE-287Improper Authentication204+8
  17. CWE-122Heap Buffer Overflow196+5
  18. CWE-78OS Command Injection195−6
  19. CWE-94Code Injection184−1
  20. CWE-787Out-of-bounds Write162−4

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

The lighter the cell, the more CVEs. Point at one to read it.

July 2026: weakness classes by vendor and by sector: By vendor
By vendor284Improper Access Control79XSS862Missing Authorization416Use After Free89SQL Injection306Missing Auth for Critical Function200Information Exposure22Path Traversal20Improper Input Validation863Incorrect Authorization
Oracle Corporation6821036258111177
Oracle6821036257111177
Linux711826
Microsoft2618714128336103
Google141392110925
Apache Software Foundation512354912293
Apache312353911272
Apple1121318541
npm681563127422
Red Hat519143335
Adobe1432161012
IBM181262812

In the news

The CVEs security news mentioned most in July 2026.

  1. CVE-2026-56164Microsoft SharePoint Server Elevation of Privilege Vulnerability255.3
  2. CVE-2025-66376Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.177.2
  3. CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code169.8
  4. CVE-2026-56155Active Directory Federation Services Elevation of Privilege Vulnerability167.8
  5. CVE-2026-58644Microsoft SharePoint Remote Code Execution Vulnerability169.8
  6. CVE-2026-50522Microsoft SharePoint Remote Code Execution Vulnerability159.8
  7. CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query155.9
  8. CVE-2026-15409A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make...1410.0
  9. CVE-2026-15410Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could ...147.2
  10. CVE-2026-48282ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)1410.0
  11. CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution149.8
  12. CVE-2026-16232Authentication Bypass in the SmartConsole Login Process Using an Application Token129.8

CVEs published in July 2026

199 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS. Showing 101–199.

Snapshot v1, computed Aug 3, 2026, 05:00 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.