{"schema_version":1,"title":"Newly exploited vulnerabilities: week of 20 to 26 July 2026 (week 30)","summary":"In the week of 20 to 26 July 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Wordpress (2), followed by Check Point Multi-Domain Security Management (1) and Check Point Quantum Security Management (1).","url":"https://junglewise.ai/threats/exploited/2026-07-20","json_url":"https://junglewise.ai/threats/exploited/2026-07-20.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/exploited/2026-07-20","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so; exploited_since is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.","kind":"exploited_week","total":6,"period":{"end":"2026-07-26","start":"2026-07-20"},"critical":6,"generated_at":"2026-10-02T19:24:09.297469+00:00","technologies":[{"hub":true,"name":"Wordpress","slug":"wordpress","vulnerabilities":2,"url":"https://junglewise.ai/threats/technologies/wordpress"},{"hub":false,"name":"Check Point Multi-Domain Security Management","slug":"multi-domain-security-management","vulnerabilities":1},{"hub":true,"name":"Check Point Quantum Security Management","slug":"quantum-security-management","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/quantum-security-management"},{"hub":false,"name":"Check Point SmartConsole","slug":"smartconsole","vulnerabilities":1},{"hub":false,"name":"DD-WRT","slug":"dd-wrt","vulnerabilities":1},{"hub":true,"name":"Langflow","slug":"langflow","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/langflow"},{"hub":true,"name":"langflow (PyPI)","slug":"pypi-langflow","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/pypi-langflow"},{"hub":true,"name":"Microsoft SharePoint","slug":"sharepoint","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/sharepoint"},{"hub":true,"name":"Microsoft SharePoint Enterprise Server 2016","slug":"sharepoint-enterprise-server-2016","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/sharepoint-enterprise-server-2016"},{"hub":true,"name":"Microsoft SharePoint Server 2019","slug":"sharepoint-server-2019","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/sharepoint-server-2019"},{"hub":true,"name":"Microsoft SharePoint Server Subscription Edition","slug":"sharepoint-server-subscription-edition","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/sharepoint-server-subscription-edition"}],"vulnerabilities":[{"cve":"CVE-2026-16232","cvss":9.8,"slug":"cve-2026-16232-check-point-smartconsole-authentication-bypass-in-login-process","title":"Check Point SmartConsole authentication bypass in login process","severity":"critical","exploited":true,"published_at":"2026-07-22T14:17:15.513+00:00","technologies":[{"hub":false,"name":"Check Point Multi-Domain Security Management","slug":"multi-domain-security-management","vendor":{"name":"Check Point","slug":"check-point"}},{"hub":true,"name":"Check Point Quantum Security Management","slug":"quantum-security-management","vendor":{"name":"Check Point","slug":"check-point"}},{"hub":false,"name":"Check Point SmartConsole","slug":"smartconsole","vendor":{"name":"Check Point","slug":"check-point"}}],"exploited_since":"2026-07-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-16232-check-point-smartconsole-authentication-bypass-in-login-process"},{"cve":"CVE-2026-50522","cvss":9.8,"epss":0.2035,"slug":"cve-2026-50522-microsoft-sharepoint-remote-code-execution-via-unsafe","title":"Microsoft SharePoint remote code execution via unsafe deserialization","severity":"critical","exploited":true,"published_at":"2026-07-14T17:17:01.547+00:00","technologies":[{"hub":true,"name":"Microsoft SharePoint","slug":"sharepoint","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft SharePoint Enterprise Server 2016","slug":"sharepoint-enterprise-server-2016","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft SharePoint Server 2019","slug":"sharepoint-server-2019","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft SharePoint Server Subscription Edition","slug":"sharepoint-server-subscription-edition","vendor":{"name":"Microsoft","slug":"microsoft"}}],"exploited_since":"2026-07-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-50522-microsoft-sharepoint-remote-code-execution-via-unsafe"},{"cve":"CVE-2026-63030","cvss":7.5,"epss":0.0895,"slug":"cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to","title":"WordPress REST API route confusion and SQL injection leading to RCE","severity":"critical","exploited":true,"published_at":"2026-07-17T20:17:28.49+00:00","technologies":[{"hub":true,"name":"Wordpress","slug":"wordpress","vendor":{"name":"Wordpress","slug":"wordpress"}},{"hub":true,"name":"Wordpress","slug":"wordpress","vendor":{"name":"Wordpress","slug":"wordpress"}}],"exploited_since":"2026-07-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to"},{"cve":"CVE-2026-60137","cvss":9.1,"epss":0.0403,"slug":"cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter","title":"WordPress SQL injection in WP_Query author__not_in parameter","severity":"critical","exploited":true,"published_at":"2026-07-17T20:17:27.79+00:00","technologies":[{"hub":true,"name":"Wordpress","slug":"wordpress","vendor":{"name":"Wordpress","slug":"wordpress"}},{"hub":true,"name":"Wordpress","slug":"wordpress","vendor":{"name":"Wordpress","slug":"wordpress"}}],"exploited_since":"2026-07-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter"},{"cve":"CVE-2021-27137","cvss":8.1,"epss":0.0545,"slug":"cve-2021-27137-dd-wrt-stack-buffer-overflow-in-upnp-ssdp-parser","title":"DD-WRT stack buffer overflow in UPnP SSDP parser","severity":"critical","exploited":true,"published_at":"2026-07-16T18:16:39.113+00:00","technologies":[{"hub":false,"name":"DD-WRT","slug":"dd-wrt","vendor":{"name":"DD-WRT","slug":"dd-wrt"}}],"exploited_since":"2026-07-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2021-27137-dd-wrt-stack-buffer-overflow-in-upnp-ssdp-parser"},{"cve":"CVE-2026-0770","cvss":9.8,"epss":0.6384,"slug":"cve-2026-0770-langflow-remote-code-execution-in-validate-endpoint","title":"Langflow remote code execution in validate endpoint","severity":"critical","exploited":true,"published_at":"2026-01-23T04:16:04.063+00:00","technologies":[{"hub":true,"name":"Langflow","slug":"langflow","vendor":{"name":"Langflow","slug":"langflow"}},{"hub":true,"name":"langflow (PyPI)","slug":"pypi-langflow","vendor":{"name":"PyPI","slug":"pypi"}}],"exploited_since":"2026-07-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-0770-langflow-remote-code-execution-in-validate-endpoint"}],"previous":{"key":"2026-07-13","top":"Fortinet FortiSandbox","total":10,"period":{"end":"2026-07-19","start":"2026-07-13"},"critical":10,"url":"https://junglewise.ai/threats/exploited/2026-07-13"},"next":{"key":"2026-07-27","top":"Arista Networks VeloCloud Orchestrator","total":3,"period":{"end":"2026-08-02","start":"2026-07-27"},"critical":3,"url":"https://junglewise.ai/threats/exploited/2026-07-27"}}