Security Box Score — July 26, 2026

15 CVEs published, led by Microsoft (3).

15 CVEs published July 26, 2026: 1 critical, 7 high, 1 medium, 6 low; 0 in the KEV catalog at press time; 1 with a public exploit reference; 0 awaiting enrichment.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	7959	20362	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

850 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	804	2284	203	1211	637	1	11	2	0.1	7.8	.0016	+292 ▲
microsoft	663	1420	105	981	320	14	286	24	1.7	7.8	.0047	+443 ▲
google	119	1384	156	633	556	39	77	6	0.4	7.8	.0025	-588 ▼
red hat	117	339	16	130	170	23	2	0	0.0	6.5	.0032	+9 ▲
apple	3	107	2	30	73	2	88	7	6.5	6.5	.0032	-12 ▼
canonical	7	27	3	8	11	5	0	0	0.0	5.6	.0014	+1 ▲
suse	8	21	4	12	4	1	0	0	0.0	8.5	.0039	+4 ▲
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	-2 ▼

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	15	37	8	18	11	0	56	11	29.7	7.5	.0057	+5 ▲
ubiquiti	25	36	14	21	1	0	3	3	8.3	8.8	.0049	+17 ▲
palo alto networks	14	25	1	3	14	7	13	2	8.0	4.7	.0028	+5 ▲
netgear	6	23	0	0	22	1	0	0	0.0	4.6	.0024	-11 ▼
fortinet	13	22	6	6	10	0	28	5	22.7	7.3	.0039	+11 ▲
f5	8	16	5	8	3	0	4	1	6.3	8.6	.0057	+2 ▲
vmware	8	12	1	8	2	1	7	1	8.3	8.2	.0039	+5 ▲
checkpoint	3	12	3	6	3	0	3	2	16.7	7.7	.0455	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	103	258	55	102	89	11	33	1	0.4	7.5	.0058	-1 ▼
mozilla	71	127	51	42	34	0	9	0	0.0	8.1	.0031	+22 ▲
drupal	46	51	6	5	35	5	4	1	2.0	5.9	.0026	+46 ▲
gitlab	7	38	0	5	27	6	4	2	5.3	4.7	.0032	-17 ▼
github	5	11	1	2	8	0	0	0	0.0	6.0	.0042	+4 ▲
docker	0	7	0	5	2	0	0	0	0.0	8.2	.0016	-4 ▼
wordpress	2	2	1	0	1	0	2	2	100.0	7.9	.8879	+2 ▲
kubernetes	1	1	0	0	0	1	0	0	0.0	2.4	.0035	+1 ▲

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	1109	1379	343	653	322	61	27	3	0.2	8.1	.0036	+867 ▲
adobe	95	239	26	104	105	4	19	3	1.3	7.7	.0026	-37 ▼
ibm	37	161	52	54	55	0	6	0	0.0	7.5	.0036	+5 ▲
progress	28	37	6	24	7	0	6	0	0.0	7.5	.0037	+23 ▲
solarwinds	15	22	16	3	3	0	10	4	18.2	9.1	.0058	+12 ▲
zohocorp	3	6	2	2	2	0	0	0	0.0	7.8	.0146	+2 ▲
veeam	1	5	2	3	0	0	1	0	0.0	8.6	.0051	0
atlassian	3	3	0	3	0	0	13	0	0.0	8.0	.0026	+3 ▲

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
rockwell automation	17	24	4	18	2	0	0	8.7	.0029	+10 ▲
synology	0	23	2	5	13	3	0	5.6	.0025	-5 ▼
d-link	8	20	0	5	9	6	3	5.5	.0105	-1 ▼
siemens	7	16	1	8	7	0	0	7.6	.0024	0
abb	1	7	0	4	3	0	0	7.2	.0018	-5 ▼
schneider electric	0	6	0	4	2	0	0	7.8	.0042	-6 ▼
hikvision	5	5	0	3	2	0	0	7.2	.0038	+5 ▲
moxa	0	5	0	3	2	0	0	7.0	.0029	-5 ▼

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	49	120	0	0	62	58	0	0	0.0	5.5	.0034	+12 ▲
openclaw	44	111	0	58	39	14	0	0	0.0	7.0	.0026	-17 ▼
dell	43	99	5	47	44	3	2	1	1.0	7.1	.0021	+5 ▲
capgo	22	83	2	42	38	1	0	0	0.0	7.1	.0037	-24 ▼
nvidia	41	80	12	52	16	0	0	0	0.0	7.8	.0037	+35 ▲
imagemagick	33	74	1	5	56	12	0	0	0.0	5.3	.0018	-2 ▼
spring	0	73	2	31	39	1	0	0	0.0	6.5	.0024	-72 ▼
itsourcecode	18	71	0	0	19	52	0	0	0.0	2.1	.0033	-4 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-50522	.8461	99.7	9.8
CVE-2026-15409	.8366	99.7	10.0
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-6875	.7758	99.5	9.5
CVE-2026-25089	.7611	99.5	9.8
CVE-2026-45659	.7608	99.5	8.8
CVE-2026-0770	.6342	99.1	9.8
CVE-2026-48282	.4239	98.6	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-15409	10.0	.8366	KEV
CVE-2026-48282	10.0	.4239	KEV
CVE-2026-56290	10.0	.3038	KEV
CVE-2026-48939	10.0	.1973	KEV
CVE-2026-48908	10.0	.1482	KEV
CVE-2026-56291	10.0	.1459	KEV
CVE-2026-59726	10.0	.0688
CVE-2026-8985	10.0	.0660
CVE-2026-13773	10.0	.0610
CVE-2026-6516	10.0	.0486

Most disclosures (vendor)
Vendor	CVEs
oracle	1109
linux	805
microsoft	664
google	502
red hat	137
apache	120
adobe	105
ibm	80
mozilla	72
sourcecodester	61

Most KEV additions (YTD)
Vendor	KEV
microsoft	24
cisco	11
apple	7
google	6
fortinet	5
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	63
PyPI	5
NuGet	3
npm	3
Packagist	1
crates.io	1

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2026-0770	Langflow	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-16232	checkpoint	0
CVE-2026-25089	Fortinet	0
CVE-2026-45659	Microsoft	0
CVE-2026-46817	Oracle Corporation	0
CVE-2026-48282	Adobe	0
CVE-2026-48558	SimpleHelp	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1712
CVE-2021-27102	n/a	2021-11-17	1712
CVE-2021-27101	n/a	2021-11-17	1712
CVE-2021-27103	n/a	2021-11-17	1712
CVE-2021-21017	Adobe	2021-11-17	1712
CVE-2021-28550	Adobe	2021-11-17	1712
CVE-2021-42013	Apache Software Foundation	2021-11-17	1712
CVE-2021-41773	Apache Software Foundation	2021-11-17	1712
CVE-2021-30858	Apple	2021-11-17	1712
CVE-2021-30860	Apple	2021-11-17	1712

Transactions

EXPLOIT PUBLISHED — CVE-2026-16735 (release-it conventional-changelog). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-65700 (h2oai h2ogpt). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-65707 (likeadmin-likeshop likeshop). Public exploit reference added.

DUE DATE PASSED — CVE-2026-16232 (checkpoint Quantum Security Management). CISA remediation deadline was July 25, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-50522 (Microsoft SharePoint Enterprise Server 2016). CISA remediation deadline was July 25, 2026; still in catalog.

ENRICHED — CVE-2020-19909. Received CVSS 3.3 and CPE data from NVD.

Yesterday's Results

How to read these box scores · glossary

15 CVEs published. 15 box scores, 0 table rows — nothing truncated.

CVE-2026-63720HIGH

koxudaxi datamodel-code-generator — datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   A   H   H   H    7.5   .0075   52.2     —

AFFECTED
  Product                   Versions     Fixed
  datamodel-code-generator  unspecified  —

TIMELINE
  Jul 17  Reserved by CNA
  Jul 26  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-64530CRITICAL

Linux Linux — net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0054   42.8     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    172ba7d46c202e679f3ccb10264c67416aaeb1c4 –  —
  Linux    6.8 –                                       5.15.212

TIMELINE
  Jul 19  Reserved by CNA
  Jul 26  Published (CNA: Linux)

CNA: Linux · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-57990HIGH

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  H  N  N    7.4   .0050   40.7     —

AFFECTED
  Product                          Versions  Fixed
  Microsoft Edge (Chromium-based)  - –       —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 26  Published (CNA: microsoft)

CWE-552 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-17497HIGH

codexu NoteGen — NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  C  H  H  H    8.3   .0046   37.5     —

AFFECTED
  Product  Versions     Fixed
  NoteGen  unspecified  —

TIMELINE
  Jul 26  Reserved by CNA
  Jul 26  Published (CNA: JFROG)

CWE-78, CWE-276, CWE-1249 · CNA: JFROG · CVSS v3.1 · 3 references · NVD status: Awaiting Analysis

CVE-2026-15962HIGH

techjewel Fluent Forms Pro Add On Pack — Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0037   29.8     —

AFFECTED
  Product                       Versions     Fixed
  Fluent Forms Pro Add On Pack  unspecified  —

TIMELINE
  Jul 16  Reserved by CNA
  Jul 26  Published (CNA: Wordfence)

CWE-502 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-17459LOW

perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   N    2.1   .0032   24.1     —

AFFECTED
  Product  Versions  Fixed
  spark    2.9.0 –   —

TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)

CWE-59, CWE-61 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-17496HIGH

codexu NoteGen — NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  N    8.1   .0032   24.0     —

AFFECTED
  Product  Versions     Fixed
  NoteGen  unspecified  —

TIMELINE
  Jul 26  Reserved by CNA
  Jul 26  Published (CNA: JFROG)

CWE-79 · CNA: JFROG · CVSS v3.1 · 3 references · NVD status: Awaiting Analysis

CVE-2026-17457LOW

mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   N    2.1   .0030   21.9     —

AFFECTED
  Product      Versions  Fixed
  openclaw-cn  0.2.0 –   —

TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-57989HIGH

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  H  N  N    7.4   .0029   20.9     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 26  Published (CNA: microsoft)

CWE-346 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-17458LOW

mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0028   20.1     —

AFFECTED
  Product      Versions  Fixed
  openclaw-cn  0.2.0 –   —

TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-17432LOW

NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   L   N   L   L   L    1.3   .0023   13.6     —

AFFECTED
  Product       Versions    Fixed
  hermes-agent  2026.6.5 –  —

TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)

CWE-266, CWE-284 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Deferred

CVE-2026-17434LOW

nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0023   13.2     —

AFFECTED
  Product   Versions  Fixed
  NanoClaw  2.0.0 –   —

TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)

CWE-266, CWE-285 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Deferred

CVE-2026-57978MEDIUM

Microsoft Edge (Chromium-based) Spoofing Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  L  L  N    5.4   .0014    3.8     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 26  Published (CNA: microsoft)

CWE-346 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2024-14040HIGH

Linux Linux — net: nexthop: Increase weight to u16

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0011    1.7     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    283a72a5599e80750699d2021830a294ed9ab3f3 –  —
  Linux    5.13 –                                      6.12

TIMELINE
  Jul 26  Reserved by CNA
  Jul 26  Published (CNA: Linux)

CNA: Linux · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-17433LOW

nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0010    1.1     —

AFFECTED
  Product   Versions  Fixed
  NanoClaw  2.0.0 –   —

TIMELINE
  Jul 25  Reserved by CNA
  Jul 26  Published (CNA: VulDB)

CWE-266, CWE-285 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-07-26 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.