Weekly report · exploited in the wild
Newly exploited vulnerabilities: week of 20 to 26 July 2026 (week 30)
Final report, published . It does not change.
In the week of 20 to 26 July 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Wordpress (2), followed by Check Point Multi-Domain Security Management (1) and Check Point Quantum Security Management (1).
- Newly exploited
- 6
- Critical
- 6
- Technologies hit
- 11
Newly exploited this week
- CVE-2026-16232: Check Point SmartConsole authentication bypass in login processcriticalCVSS 9.8Exploited since Published Check Point Multi-Domain Security Management, Check Point Quantum Security Management, Check Point SmartConsole
- CVE-2026-50522: Microsoft SharePoint remote code execution via unsafe deserializationcriticalCVSS 9.8Exploited since Published Microsoft SharePoint, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019
- CVE-2026-63030: WordPress REST API route confusion and SQL injection leading to RCEcriticalCVSS 7.5Exploited since Published Wordpress, Wordpress
- CVE-2026-60137: WordPress SQL injection in WP_Query author__not_in parametercriticalCVSS 9.1Exploited since Published Wordpress, Wordpress
- CVE-2021-27137: DD-WRT stack buffer overflow in UPnP SSDP parsercriticalCVSS 8.1Exploited since Published DD-WRT
- CVE-2026-0770: Langflow remote code execution in validate endpointcriticalCVSS 9.8Exploited since Published Langflow, langflow (PyPI)
Technologies hit most
- 1.Wordpress2 vulnerabilities
- 2.Check Point Multi-Domain Security Management1 vulnerability
- 3.Check Point Quantum Security Management1 vulnerability
- 4.Check Point SmartConsole1 vulnerability
- 5.DD-WRT1 vulnerability
- 6.Langflow1 vulnerability
- 7.langflow (PyPI)1 vulnerability
- 8.Microsoft SharePoint1 vulnerability
- 9.Microsoft SharePoint Enterprise Server 20161 vulnerability
- 10.Microsoft SharePoint Server 20191 vulnerability
- 11.Microsoft SharePoint Server Subscription Edition1 vulnerability
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so. The date it was first recorded as exploited is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/exploited/2026-07-20.json, and this page as text at https://junglewise.ai/threats/exploited/2026-07-20.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 20 to 26 July 2026 (week 30)", https://junglewise.ai/threats/exploited/2026-07-20, 2 October 2026.