# Newly exploited vulnerabilities: week of 20 to 26 July 2026 (week 30)

Source: https://junglewise.ai/threats/exploited/2026-07-20  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 19:24 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-07-20.json  
License: CC BY 4.0 with a link back

In the week of 20 to 26 July 2026, 6 vulnerabilities were newly recorded as exploited in the wild, 6 of them critical. The technology hit most was Wordpress (2), followed by Check Point Multi-Domain Security Management (1) and Check Point Quantum Security Management (1).

## Newly exploited this week

- [CVE-2026-16232: Check Point SmartConsole authentication bypass in login process](https://junglewise.ai/threats/cve-2026-16232-check-point-smartconsole-authentication-bypass-in-login-process) (critical, exploited in the wild, CVSS 9.8, exploited since 22 Jul 2026, published 22 Jul 2026)
- [CVE-2026-50522: Microsoft SharePoint remote code execution via unsafe deserialization](https://junglewise.ai/threats/cve-2026-50522-microsoft-sharepoint-remote-code-execution-via-unsafe) (critical, exploited in the wild, CVSS 9.8, exploited since 22 Jul 2026, published 14 Jul 2026)
- [CVE-2026-63030: WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to) (critical, exploited in the wild, CVSS 7.5, exploited since 21 Jul 2026, published 17 Jul 2026)
- [CVE-2026-60137: WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter) (critical, exploited in the wild, CVSS 9.1, exploited since 21 Jul 2026, published 17 Jul 2026)
- [CVE-2021-27137: DD-WRT stack buffer overflow in UPnP SSDP parser](https://junglewise.ai/threats/cve-2021-27137-dd-wrt-stack-buffer-overflow-in-upnp-ssdp-parser) (critical, exploited in the wild, CVSS 8.1, exploited since 21 Jul 2026, published 16 Jul 2026)
- [CVE-2026-0770: Langflow remote code execution in validate endpoint](https://junglewise.ai/threats/cve-2026-0770-langflow-remote-code-execution-in-validate-endpoint) (critical, exploited in the wild, CVSS 9.8, exploited since 21 Jul 2026, published 23 Jan 2026)

## Technologies hit most

1. [Wordpress](https://junglewise.ai/threats/technologies/wordpress): 2 vulnerabilities
2. Check Point Multi-Domain Security Management: 1 vulnerability
3. [Check Point Quantum Security Management](https://junglewise.ai/threats/technologies/quantum-security-management): 1 vulnerability
4. Check Point SmartConsole: 1 vulnerability
5. DD-WRT: 1 vulnerability
6. [Langflow](https://junglewise.ai/threats/technologies/langflow): 1 vulnerability
7. [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow): 1 vulnerability
8. [Microsoft SharePoint](https://junglewise.ai/threats/technologies/sharepoint): 1 vulnerability
9. [Microsoft SharePoint Enterprise Server 2016](https://junglewise.ai/threats/technologies/sharepoint-enterprise-server-2016): 1 vulnerability
10. [Microsoft SharePoint Server 2019](https://junglewise.ai/threats/technologies/sharepoint-server-2019): 1 vulnerability
11. [Microsoft SharePoint Server Subscription Edition](https://junglewise.ai/threats/technologies/sharepoint-server-subscription-edition): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 20 to 26 July 2026 (week 30)", https://junglewise.ai/threats/exploited/2026-07-20, 2 October 2026.