23 vulnerabilities across 12 products scored HIGH or above on July 20, 2026.

  • 🟠 HIGH: 23

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-45695 (kopia/kopia) — F1: exploitable → functional, AAS: 11.1 → 13.1 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin.
  • [UPGRADED] CVE-2026-55579 (pheditor/pheditor) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin.
  • [UPGRADED] CVE-2026-54526 (argoproj/argo-workflows) — F1: exploitable → itw, AAS: 9.8 → 12.8 (HIGH → CRITICAL). Originally in 2026-07-16 bulletin.
  • [UPGRADED] CVE-2026-47984 (adobe/commerce) — F1: exploitable → functional, AAS: 10.7 → 14.5 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin.
  • [UPGRADED] CVE-2026-57087 (microsoft/windows) — F1: exploitable → itw, AAS: 10.6 → 13.6 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin.
  • [UPGRADED] CVE-2026-50313 (microsoft/windows_10_version_1607) — F1: exploitable → functional, AAS: 9.6 → 11.6 (HIGH → HIGH). Originally in 2026-07-14 bulletin.
  • [UPGRADED] CVE-2026-40400 (microsoft/windows_10_version_1607) — F1: exploitable → functional, AAS: 9.3 → 11.3 (HIGH → HIGH). Originally in 2026-07-14 bulletin.
  • [UPGRADED] CVE-2026-50306 (microsoft/windows_10_version_1607) — F1: exploitable → functional, AAS: 9.1 → 11.1 (HIGH → HIGH). Originally in 2026-07-14 bulletin.
  • [UPGRADED] CVE-2026-58319 (apache/doris) — F1: exploitable → itw, AAS: 10.5 → 12.0 (HIGH → CRITICAL). Originally in 2026-07-14 bulletin.

🟠 [HIGH] rvc-boss/gpt-sovits

1 CVE | CVSS 4.0: 9.3 | AAS 10.7

  • cpe:2.3:a:rvc-boss:gpt-sovits:*:*:*:*:*:*:*:*

Failed to authenticate. API Error: 401 Invalid authentication credentials

Vendor Advisory

🟠 [HIGH] neutrinolabs/xrdp

3 CVEs | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:* (< 0.10.7)

Failed to authenticate. API Error: 401 Invalid authentication credentials

Vendor Advisory

🟠 [HIGH] surrealdb/surrealdb

6 CVEs | CVSS 4.0: 9.2 | AAS 10.5

  • cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* (< 3.2.0)

Failed to authenticate. API Error: 401 Invalid authentication credentials

Vendor Advisory

🟠 [HIGH] kvcache-ai/ktransformers

1 CVE | CVSS 4.0: 9.3 | AAS 10.2

  • cpe:2.3:a:kvcache-ai:ktransformers:*:*:*:*:*:*:*:*

Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue.

Vendor Advisory

🟠 [HIGH] freescout-help-desk/freescout

3 CVEs | CVSS 3.1: 9.4 | AAS 10.2

  • cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:*

Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue.

Vendor Advisory

🟠 [HIGH] dotcms/dotcms

1 CVE | CVSS 4.0: 9.4 | AAS 10.0

  • cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*

Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue.

Vendor Advisory

🟠 [HIGH] freerdp/freerdp

2 CVEs | CVSS 4.0: 9.3 | AAS 9.9

  • cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* (>= 3.0.0, < 3.28.0)

Failed to authenticate. API Error: 401 Invalid authentication credentials

Vendor Advisory

🟠 [HIGH] heyform/heyform

2 CVEs | CVSS 3.1: 9.0 | AAS 9.4

  • cpe:2.3:a:heyform:heyform:*:*:*:*:*:*:*:* (< 3.0.0-rc.9)

Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue.

Vendor Advisory

🟠 [HIGH] wazuh/wazuh

1 CVE | CVSS 3.1: 8.4 | AAS 9.1

  • cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* (< 4.14.5)

Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue.

Vendor Advisory

🟠 [HIGH] bestpractical/rt

1 CVE | CVSS 3.1: 9.1 | AAS 9.0

  • cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*

Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue.

Vendor Advisory

🟠 [HIGH] roocodeinc/roo-code

1 CVE | CVSS 4.0: 7.7 | AAS 9.0

  • cpe:2.3:a:roocodeinc:roo-code:*:*:*:*:*:*:*:*

Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue.

Vendor Advisory

🟠 [HIGH] glanceapp/glance

1 CVE | CVSS 4.0: 8.2 | AAS 9.0

  • cpe:2.3:a:glanceapp:glance:*:*:*:*:*:*:*:* (< 0.8.6)

Failed to authenticate. API Error: 401 Invalid authentication credentials

Vendor Advisory