35 vulnerabilities across 14 products scored HIGH or above on July 27, 2026.

  • 🔴 CRITICAL: 3
  • 🟠 HIGH: 32

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-63770 (glanceapp/glance) — F1: theoretical → poc, AAS: 9.0 → 11.5 (HIGH → HIGH). Originally in 2026-07-20 bulletin.

🔴 [CRITICAL] pheditor/pheditor

2 CVEs | CVSS 3.1: 9.9 | AAS 12.9

  • cpe:2.3:a:pheditor:pheditor:*:*:*:*:*:*:*:*

Pheditor, a PHP-based single-file editor and file manager, is affected by 2 critical vulnerabilities (CVE-2026-55579, CVE-2026-48030) with a maximum CVSS score of 9.9. The issues include multiple flaws, notably a hardcoded default password that ships with the application and lacks any forced password change on first login, giving attackers full access to file editing, file upload, and built-in terminal functionality, enabling arbitrary file read/write and remote code execution. A functional exploit is available, making this an immediate risk.

Any organization running Pheditor versions 2.0.1 through 2.0.5 should upgrade to version 2.0.6 immediately and verify that no unauthorized access occurred during the exposure window. Refer to the vendor advisory at the Pheditor GitHub releases page for patch details.

Vendor Advisory

🔴 [CRITICAL] arista_networks/velocloud_orchestrator_on-prem

1 CVE | CVSS 4.0: 10.0 | AAS 12.8

  • cpe:2.3:a:arista:velocloud_orchestrator_on-prem:*:*:*:*:*:*:*:*

Arista Networks VeloCloud Orchestrator (VCO) on-premises deployments are affected by a critical vulnerability (CVE-2026-16812, CVSS 10.0) that exposes privileged internal functionality to remote attackers, potentially fully compromising the confidentiality, integrity, and availability of the orchestrator and all data it manages. This vulnerability is being exploited in the wild, and hosted and dedicated VCO instances have already been patched by Arista.

Organizations running on-premises VeloCloud Orchestrator should treat this as an emergency priority, apply the vendor-provided patch immediately, and review systems for signs of unauthorized access. Consult Arista’s Security Advisory 0144 for patching instructions and affected version details.

Vendor Advisory

🔴 [CRITICAL] jetbrains/teamcity

1 CVE | CVSS 3.1: 9.8 | AAS 12.3

  • cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*

JetBrains TeamCity versions prior to 2026.1.3 and 2025.11.7 are affected by a critical vulnerability (CVE-2026-63077, CVSS 9.8) that allows unauthenticated remote code execution via the agent polling protocol. This flaw requires no credentials or user interaction, making any internet-exposed or internally accessible TeamCity server an immediate target for full compromise.

Organizations running TeamCity should upgrade to version 2026.1.3 or 2025.11.7 immediately and audit systems for signs of unauthorized access. Refer to the JetBrains security issues page for full details and patching guidance.

Vendor Advisory

🟠 [HIGH] sqlite/sqlite

2 CVEs | CVSS 3.1: 9.8 | AAS 11.9

  • cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* (>= 3.41, < 3.42)
  • cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:* (>= 3.41.0, < 3.42.0)

SQLite 3.41 is affected by 2 high-severity vulnerabilities (CVE-2026-51303, CVE-2026-51297, max CVSS 9.8) including multiple use-after-free flaws in the core SQL parsing component. A remote attacker can supply specially crafted SQL queries to trigger these issues, potentially leading to denial of service, memory information leakage, or code execution. Given SQLite’s pervasive use as an embedded database across operating systems, browsers, mobile platforms, and countless applications, the blast radius of these flaws is exceptionally broad.

Teams should inventory all software and systems that bundle or depend on SQLite, update to a patched version as soon as one is available, and consult the vendor advisory for affected version details.

Vendor Advisory

🟠 [HIGH] theopaid/facil.io

3 CVEs | CVSS 4.0: 8.7 | AAS 11.6

  • cpe:2.3:a:boazsegev:facil.io:*:*:*:*:*:*:*:* (>= 0.6.0)
  • cpe:2.3:a:boazsegev:facil.io:*:*:*:*:*:*:*:* (>= 0.7.5)
  • cpe:2.3:a:theopaid:facil.io:*:*:*:*:*:*:*:*

facil.io versions 0.6.0 through 0.7.6 are affected by 3 high-severity vulnerabilities (CVE-2026-66730, CVE-2026-66729, CVE-2026-66731, max CVSS 8.7) including multiple flaws in the multipart body parser that allow an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a crafted multipart/form-data request. Proof-of-concept exploit code is publicly available, and successful exploitation can render any application built on this web framework completely unresponsive.

Teams using facil.io as an embedded HTTP framework in their applications should check their bundled version, apply patches or update beyond 0.7.6 when available, and consider implementing request-level timeouts or reverse proxy safeguards as an interim mitigation. Refer to the vendor advisory on GitHub for technical details.

Vendor Advisory

🟠 [HIGH] apache/thrift

9 CVEs | CVSS 4.0: 9.3 | AAS 11.3

  • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* (< 0.24.0)

Apache Thrift versions prior to 0.24.0 are affected by 9 high-severity vulnerabilities (max CVSS 9.3) including multiple integer overflow and wraparound flaws spanning the C++, c_glib, Go, netstd, Delphi, and Haxe language bindings. The breadth of affected bindings means that any service using Thrift for cross-language RPC serialization is potentially at risk, and the vulnerabilities are considered exploitable.

Organizations using Apache Thrift in any of the affected language bindings should upgrade to version 0.24.0 immediately. Refer to the Apache mailing list advisory for full details on all nine issues and affected configurations.

Vendor Advisory

🟠 [HIGH] erlang/otp

5 CVEs | CVSS 4.0: 9.1 | AAS 10.7

  • cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:* (>= OTP-27.0, < OTP-27.3.4)
  • cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:* (>= OTP-28.0, < OTP-28.0.1)
  • cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:* (>= OTP-26.0, < OTP-26.2.5.12)
  • cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:* (>= 27.0, < 27.3.4)
  • cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:* (>= 28.0, < 28.0.1)

Erlang/OTP is affected by 5 high-severity vulnerabilities (max CVSS 9.1) including multiple flaws in the SSL/TLS implementation, most notably a failure in the TLS 1.2 and DTLS client to verify that the server-selected cipher suite was actually offered by the client. This missing validation could allow a man-in-the-middle attacker to force a downgrade to a weaker cipher suite, undermining the confidentiality and integrity of encrypted communications for any application relying on Erlang’s built-in SSL library.

Organizations running Erlang/OTP-based systems, including platforms like RabbitMQ, CouchDB, and custom BEAM applications, should update to patched OTP releases as soon as available. Consult the Erlang Ecosystem Foundation CNA advisory for affected versions and remediation details.

Vendor Advisory

🟠 [HIGH] strategy11_team/awp_classifieds

1 CVE | CVSS 3.1: 9.3 | AAS 10.3

  • cpe:2.3:a:strategy11:awp_classifieds:*:*:*:*:*:*:*:* (< 4.4.8)

AWP Classifieds, a WordPress classifieds plugin, versions 4.4.7 and earlier are affected by a high-severity unauthenticated SQL injection vulnerability (CVE-2026-59550, CVSS 9.3). This flaw requires no authentication to exploit, allowing a remote attacker to directly interact with the site’s database to extract sensitive data, modify content, or potentially escalate to full site compromise.

WordPress administrators using the AWP Classifieds plugin should update beyond version 4.4.7 immediately or deactivate the plugin until a patch is applied. Refer to the Patchstack advisory for further details and remediation guidance.

Vendor Advisory

🟠 [HIGH] ruben_garcia/gamipress

1 CVE | CVSS 3.1: 9.3 | AAS 10.3

  • cpe:2.3:a:ruben_garcia:gamipress:*:*:*:*:*:*:*:* (< 7.9.8)

GamiPress, a popular WordPress gamification plugin, versions 7.9.7 and earlier are affected by a high-severity unauthenticated SQL injection vulnerability (CVE-2026-59538, CVSS 9.3). No authentication is required to exploit this flaw, meaning any site running the affected plugin is exposed to database extraction, data manipulation, and potential full site compromise by remote attackers.

WordPress administrators using GamiPress should update to a patched version beyond 7.9.7 immediately or disable the plugin until a fix is applied. See the Patchstack advisory for complete details and remediation steps.

Vendor Advisory

🟠 [HIGH] libraw/libraw

1 CVE | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:libraw:libraw:*:*:*:*:*:*:*:* (>= 0.21, < 0.22)

LibRaw 0.21 is affected by a high-severity buffer overflow vulnerability (CVE-2026-51235, CVSS 8.8) in the stretch() and fuji_rotate() functions used during raw image processing. An attacker could craft a malicious raw image file to trigger the overflow, potentially leading to code execution in any application that processes untrusted camera raw files using this library.

Organizations and developers using LibRaw, including those building photo editing software, image pipelines, or digital asset management systems, should update to a patched version as soon as one is available. Check the LibRaw website for updated releases and apply input validation controls on raw image ingestion as an interim mitigation.

Vendor Advisory

🟠 [HIGH] jfrog/artifactory

3 CVEs | CVSS 3.1: 8.8 | AAS 9.2

  • cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:*:*:*

JFrog Artifactory is affected by 3 high-severity vulnerabilities (CVE-2026-66014, CVE-2026-65921, CVE-2026-65617, max CVSS 8.8) including multiple authentication handling weaknesses in internal request processing that may allow an attacker to escalate privileges beyond their intended access level. Given Artifactory’s central role in software supply chains as a binary repository manager, compromise could grant attackers access to build artifacts, packages, and deployment pipelines across the organization.

Teams running self-managed Artifactory instances should review the JFrog self-managed release notes immediately, upgrade to the latest patched version, and audit access logs for any signs of unauthorized privilege escalation. Cloud-hosted customers should verify their instance status with JFrog support.

Vendor Advisory

🟠 [HIGH] apple/macos

4 CVEs | CVSS 3.1: 7.8 | AAS 9.1

  • cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*

Apple macOS is affected by 4 high-severity vulnerabilities (CVE-2026-43749, CVE-2026-39875, CVE-2026-39874, CVE-2026-43698, max CVSS 7.8) including multiple flaws that could allow a malicious application to gain root privileges through issues such as improper directory path validation. These local privilege escalation vulnerabilities affect macOS Sequoia, Sonoma, and Tahoe, posing a significant risk to any environment where users may run untrusted applications.

Organizations managing macOS endpoints should deploy the latest updates immediately — macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6 — and consult Apple’s support advisory for full details on all addressed issues.

Vendor Advisory

🟠 [HIGH] nitroshare/nitroshare-desktop

1 CVE | CVSS 4.0: 8.7 | AAS 9.1

  • cpe:2.3:a:nitroshare:nitroshare-desktop:*:*:*:*:*:*:*:*

NitroShare Desktop versions through 0.3.4 are affected by a high-severity path traversal vulnerability (CVE-2026-66050, CVSS 8.7) in its LAN file transfer server that allows an unauthenticated attacker on the same network to write arbitrary files to any location the current user can access, including the Windows Startup folder for persistent code execution. The flaw requires no authentication, making any machine running NitroShare on a shared network an easy target.

Organizations and users running NitroShare Desktop should disable or uninstall the application immediately until a patched version is available, and audit systems for unexpected files in sensitive directories such as Startup folders. Refer to the vendor advisory on GitHub for technical details.

Vendor Advisory

🟠 [HIGH] thorsten/phpmyfaq

1 CVE | CVSS 4.0: 9.4 | AAS 9.0

  • cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:* (< 4.1.6)

phpMyFAQ versions prior to 4.1.6 are affected by a high-severity remote code execution vulnerability (CVE-2026-66398, CVSS 9.4) that allows authenticated administrators with configuration and attachment privileges to write arbitrary PHP files to the application root by abusing the updater configuration and attachment upload mechanisms. Successful exploitation grants full code execution as the web server user, enabling complete server compromise.

Organizations running phpMyFAQ should upgrade to version 4.1.6 immediately, restrict administrative access to trusted personnel, and review web server logs for suspicious attachment uploads or configuration changes. Refer to the GitHub security advisory for full technical details and remediation guidance.

Vendor Advisory