2 vulnerabilities across 2 products scored HIGH or above on July 18, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 1

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin.
  • [UPGRADED] CVE-2026-57087 (microsoft/windows) — F1: exploitable → itw, AAS: 10.6 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin.
  • [UPGRADED] CVE-2026-58319 (apache/doris) — F1: exploitable → itw, AAS: 10.5 → 13.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin.

🔴 [CRITICAL] surrealdb/surrealdb

1 CVE | CVSS 4.0: 9.4 | AAS 12.3

  • cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* (< 2.0.5)
  • cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* (>= 2.1.0, < 2.1.5)
  • cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* (>= 2.2.0, < 2.2.2)

SurrealDB versions before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 are affected by a critical SurrealQL injection vulnerability (CVE-2025-71392, CVSS 9.4) with a functional exploit available. An authenticated user with OWNER or EDITOR roles can craft malicious table or field names that execute injected queries when a higher-privileged user imports an exported backup, leading to privilege escalation and full root-level takeover of the SurrealDB instance.

Organizations running SurrealDB should treat this as an urgent priority given the critical severity rating and existence of a working exploit. Upgrade immediately to SurrealDB 2.0.5, 2.1.5, or 2.2.2 depending on your release branch, and review any recent database exports for signs of tampering before importing. See the vendor advisory at the link above for full details.

Vendor Advisory

🟠 [HIGH] falkordb/queryweaver

1 CVE | CVSS 4.0: 8.8 | AAS 9.2

  • cpe:2.3:a:falkordb:queryweaver:*:*:*:*:*:*:*:*

FalkorDB QueryWeaver is affected by a high-severity authentication bypass vulnerability (CVE-2026-10130, CVSS 8.8) that allows unauthenticated attackers to obtain valid session tokens for any existing user account. By submitting a signup request with a known victim’s email address, an attacker can exploit a flaw in the signup route’s Cypher MERGE operation, which issues an authenticated session token before verifying whether the account already exists, effectively granting full account takeover without credentials.

Organizations deploying QueryWeaver should treat this as urgent given the low attack complexity and the fact that no authentication is required to exploit it. Check the FalkorDB QueryWeaver repository for patched releases or mitigations, restrict public access to the signup endpoint where possible, and audit logs for suspicious account registration attempts targeting existing email addresses.

Vendor Advisory