1 vulnerability across 1 product scored HIGH or above on July 19, 2026.

  • 🟠 HIGH: 1

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin.
  • [UPGRADED] CVE-2026-57087 (microsoft/windows) — F1: exploitable → itw, AAS: 10.6 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin.
  • [UPGRADED] CVE-2026-58319 (apache/doris) — F1: exploitable → itw, AAS: 10.5 → 13.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin.

🟠 [HIGH] fast-uri/fast-uri

1 CVE | CVSS 3.1: 7.5 | AAS 9.6

  • cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:* (>= 2.3.1, < 2.4.3)
  • cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:* (>= 3.0.0, < 3.1.4)
  • cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:* (>= 4.0.0, < 4.1.1)

fast-uri, a popular URI parsing library for Node.js, is affected by one HIGH-severity vulnerability (CVE-2026-16221, CVSS 7.5) involving inconsistent backslash handling between fast-uri and Node’s native WHATWG URL parser. Versions 2.3.1 through 4.1.0 fail to treat backslash as an authority delimiter, allowing attackers to craft URLs where the two parsers extract different hostnames, potentially enabling server-side request forgery or authorization bypasses in applications that rely on fast-uri for URL validation. Teams using fast-uri in any Node.js application, particularly those performing host-based access control or request routing, should upgrade to a patched version immediately and review the vendor advisory at cna.openjsf.org for remediation guidance.

Vendor Advisory