Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 6 to 12 July 2026 (week 28)
Final report, published . It does not change.
In the week of 6 to 12 July 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Adobe ColdFusion (1), followed by Icagenda.com iCagenda (1) and Joomlack Page Builder (1).
- Newly exploited
- 6
- Critical
- 6
- Technologies hit
- 7
Newly exploited this week
- CVE-2026-56291: Balbooa Forms for Joomla unauthenticated file upload RCEcriticalCVSS 10Exploited since Published
- CVE-2026-48939: Joomla iCagenda arbitrary file upload in file attachment featurecriticalCVSS 10Exploited since Published Icagenda.com iCagenda
- CVE-2026-48282: Adobe ColdFusion path traversal in multiple versionscriticalCVSS 10Exploited since Published Adobe ColdFusion
- CVE-2026-56290: Joomlack Page Builder CK unauthenticated arbitrary file uploadcriticalCVSS 10Exploited since Published Joomlack Page Builder, Joomlack.fr Page Builder CK
- CVE-2026-55255: Langflow IDOR in responses endpoint allows cross-user flow executioncriticalCVSS 9.9Exploited since Published Langflow, langflow (PyPI)
- CVE-2026-48908: JoomShaper SP Page Builder arbitrary file upload in JoomlacriticalCVSS 10Exploited since Published JoomShaper SP Page Builder
Technologies hit most
- 1.Adobe ColdFusion1 vulnerability
- 2.Icagenda.com iCagenda1 vulnerability
- 3.Joomlack Page Builder1 vulnerability
- 4.Joomlack.fr Page Builder CK1 vulnerability
- 5.JoomShaper SP Page Builder1 vulnerability
- 6.Langflow1 vulnerability
- 7.langflow (PyPI)1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-07-06.json, and this page as text at https://junglewise.ai/threats/exploited/2026-07-06.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 6 to 12 July 2026 (week 28)", https://junglewise.ai/threats/exploited/2026-07-06, 2 October 2026.