14 vulnerabilities across 7 products scored HIGH or above on July 28, 2026.

  • 🔴 CRITICAL: 3
  • 🟠 HIGH: 11

🔴 [CRITICAL] ibm/websphere_application_server

6 CVEs | CVSS 3.1: 9.8 | AAS 13.9

  • cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 8.5.0)
  • cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 9.0.0)
  • cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 8.5)
  • cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 9.0)
  • cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* (>= 17.0.0.3, < 26.0.0.8)

IBM WebSphere Application Server versions 8.5 and 9.0 (traditional) are affected by six vulnerabilities, including multiple critical issues. The most severe, rated CVSS 9.8, involves a pre-authentication unsafe deserialization flaw that could allow a remote attacker to bypass authentication or execute arbitrary code without any prior access. Active exploitation is considered feasible, making this an urgent priority.

Security teams running WebSphere Application Server traditional deployments should treat this as a critical patching priority. Review the vendor advisory at https://www.ibm.com/support/pages/node/7281649 and apply available fixes immediately, particularly given the pre-auth nature of the lead vulnerability which requires no user interaction or credentials to exploit.

Vendor Advisory

🔴 [CRITICAL] apache_software_foundation/apache_axis2/java

1 CVE | CVSS 3.1: 9.8 | AAS 12.3

  • cpe:2.3:a:apache:apache_axis2_java:*:*:*:*:*:*:*:*

Apache Axis2/Java through version 2.0.0 running on Apache Tomcat is affected by a critical deserialization vulnerability (CVE-2026-66713, CVSS 9.8) in the Tribes-based clustering component. When Tribes clustering is enabled, an unauthenticated remote attacker with network access to the clustering port can execute arbitrary code by sending a crafted serialized Java object, requiring no credentials or user interaction. While clustering is disabled by default, any deployment that has enabled it is immediately at risk.

Teams running Apache Axis2/Java with Tribes clustering should apply the fix from the vendor commit at https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15 as soon as possible. As an interim mitigation, consider disabling Tribes clustering or restricting network access to the clustering port to trusted nodes only.

Vendor Advisory

🟠 [HIGH] wordpress/wordpress-coding-standards

1 CVE | CVSS 3.1: 8.6 | AAS 9.9

  • cpe:2.3:a:wordpress:wordpress-coding-standards:*:*:*:*:*:*:*:* (>= 0.14.1, < 3.4.1)

WordPress Coding Standards versions 0.14.1 through 3.4.1 contain a code execution vulnerability (CVE-2026-45293, CVSS 8.6) in the WordPress.WP.EnqueuedResourceParameters sniff. The affected sniff uses eval() to evaluate version arguments passed to functions like wp_enqueue_script(), meaning that scanning a maliciously crafted WordPress plugin or theme with PHP_CodeSniffer using the WordPress or WordPress-Extra rulesets can trigger arbitrary code execution on the developer’s machine or CI/CD pipeline.

Development teams, plugin authors, and any organization running automated code quality scans against WordPress codebases should update WordPress Coding Standards to version 3.4.1 or later immediately. Review the fix at https://github.com/WordPress/WordPress-Coding-Standards/pull/2771 and audit CI environments that may have processed untrusted code submissions using affected versions.

Vendor Advisory

🟠 [HIGH] github/github-mcp-server

1 CVE | CVSS 3.1: 7.5 | AAS 9.8

  • cpe:2.3:a:github:github-mcp-server:*:*:*:*:*:*:*:*

GitHub’s official MCP Server prior to version 1.1.0 is affected by a denial-of-service vulnerability (CVE-2026-47427, CVSS 7.5) caused by a nil pointer dereference in the CompletionsHandler function. An unauthenticated attacker capable of sending JSON-RPC messages can crash the server by submitting a completion request with a missing or empty ref field, as the crash occurs before any authentication or token validation takes place.

Teams running GitHub MCP Server should upgrade to version 1.1.0 or later immediately. The fix and release details are available at https://github.com/github/github-mcp-server/releases/tag/v1.1.0.

Vendor Advisory

🟠 [HIGH] koxudaxi/datamodel-code-generator

3 CVEs | CVSS 3.1: 8.8 | AAS 9.6

  • cpe:2.3:a:koxudaxi:datamodel-code-generator:*:*:*:*:*:*:*:* (>= 0.17.0, < 0.60.2)
  • cpe:2.3:a:koxudaxi:datamodel-code-generator:*:*:*:*:*:*:*:* (>= 0.9.1, < 0.61.0)

The datamodel-code-generator project versions 0.17.0 through 0.60.2 is affected by three vulnerabilities, including multiple high-severity code execution flaws (max CVSS 8.8). The lead issue involves attacker-controlled default_factory values from untrusted schema inputs being preserved and emitted directly into generated Python code, enabling arbitrary Python expression execution when the generated models are loaded or used downstream.

Teams using datamodel-code-generator to process OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, or other schema formats from untrusted or external sources should upgrade to version 0.60.2 or later immediately. This is particularly urgent for CI/CD pipelines and development workflows that automatically generate code from third-party schemas. Review the advisory at https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-386q-5hp3-95m9 for full details.

Vendor Advisory

🟠 [HIGH] ruby-oauth/oauth2

1 CVE | CVSS 3.1: 8.6 | AAS 9.4

  • cpe:2.3:a:ruby-oauth:oauth2:*:*:*:*:*:*:*:* (>= 0.4.0, < 2.0.22)

The Ruby OAuth2 gem versions 0.4.0 through 2.0.21 is affected by a credential leakage vulnerability (CVE-2026-54603, CVSS 8.6) in which a protocol-relative redirect Location returned during an OAuth2::Client request can override the request authority. This causes the bearer Authorization header to be sent to an attacker-controlled host, allowing theft of OAuth access tokens without user interaction.

Teams using the Ruby OAuth2 gem for OAuth 2.0, OAuth 2.1, or OpenID Connect integrations should upgrade to version 2.0.22 immediately. Review the advisory at https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9 for additional details and assess whether any token rotation is warranted for applications that may have been exposed.

Vendor Advisory

🟠 [HIGH] hypequery/hypequery

1 CVE | CVSS 3.1: 9.8 | AAS 9.1

  • cpe:2.3:a:hypequery:hypequery:*:*:*:*:*:*:*:* (< 2.0.2)

Hypequery, a TypeScript semantic layer for ClickHouse, prior to version 2.0.2 is affected by a critical SQL injection vulnerability (CVE-2026-54658, CVSS 9.8). The escapeValue() function failed to escape backslashes before single quotes during parameter substitution, allowing an attacker to use a trailing backslash in query parameters to break out of the quoted context and inject arbitrary SQL against the underlying ClickHouse database.

Teams using Hypequery with ClickHouse should upgrade to version 2.0.2 immediately. Given the pre-authentication nature and critical severity of this flaw, any internet-exposed application built on affected versions should be treated as potentially compromised. The fix is available at https://github.com/hypequery/hypequery/releases/tag/@hypequery/clickhouse@2.0.2.

Vendor Advisory