By publication date
Exploited and new serious CVEs: July 2026
408 records · 23 KEV. In publication order.
Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.
Month boundaries are UTC, the same rule as the publication date on each record page.
Page 5 of 5
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
19Monitor | CVE-2026-16105No exploit | Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpointsredhat · build of keycloak · CWE-639 | Medium4.9 | — | 0.4% | Jul 31, 2026 |
37Monitor | CVE-2026-58048Proof of concept | Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.webpros · cpanel · CWE-89 | Critical9.4 | — | 0.5% | Jul 31, 2026 |
39Monitor | CVE-2026-67822Proof of concept | Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint.CWE-121 | Critical9.8 | — | 0.5% | Jul 31, 2026 |
37Monitor | CVE-2026-17351Proof of concept | pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)pgadmin · pgadmin 4 · CWE-89 | Critical9.4 | — | 0.4% | Jul 31, 2026 |
37Monitor | CVE-2026-17566Proof of concept | pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)pgadmin · pgadmin 4 · CWE-78 | Critical9.4 | — | 0.6% | Jul 31, 2026 |
30Monitor | CVE-2026-52856Proof of concept | Wings: Maliciously crafted packet during SFTP connection handshake causes denial of servicepterodactyl · wings · CWE-129 | High7.5 | — | 0.6% | Jul 31, 2026 |
39Monitor | CVE-2026-52134Proof of concept | An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a cCWE-284 | Critical9.8 | — | 0.8% | Jul 31, 2026 |
37Monitor | CVE-2026-68771Proof of concept | ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserializationcomfy-org · comfyui · CWE-502 | Critical9.3 | — | 1.1% | Jul 31, 2026 |
- CVE-2026-1610519Monitor
Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints
MediumCVSS 4.9No exploitEPSS 0%redhat · build of keycloakJul 31, 2026
- CVE-2026-5804837Monitor
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
CriticalCVSS 9.4Proof of conceptEPSS 0%webpros · cpanelJul 31, 2026
- CVE-2026-6782239Monitor
Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint.
CriticalCVSS 9.8Proof of conceptEPSS 0%Jul 31, 2026
- CVE-2026-1735137Monitor
pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)
CriticalCVSS 9.4Proof of conceptEPSS 0%pgadmin · pgadmin 4Jul 31, 2026
- CVE-2026-1756637Monitor
pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
CriticalCVSS 9.4Proof of conceptEPSS 0%pgadmin · pgadmin 4Jul 31, 2026
- CVE-2026-5285630Monitor
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
HighCVSS 7.5Proof of conceptEPSS 0%pterodactyl · wingsJul 31, 2026
- CVE-2026-5213439Monitor
An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a c
CriticalCVSS 9.8Proof of conceptEPSS 0%Jul 31, 2026
- CVE-2026-6877137Monitor
ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization
CriticalCVSS 9.3Proof of conceptEPSS 1%comfy-org · comfyuiJul 31, 2026