4 vulnerabilities across 4 products scored HIGH or above on July 28, 2026.

  • 🟠 HIGH: 4

🟠 [HIGH] wordpress/wordpress-coding-standards

1 CVE | CVSS 3.1: 8.6 | AAS 9.9

  • cpe:2.3:a:wordpress:wordpress-coding-standards:*:*:*:*:*:*:*:* (>= 0.14.1, < 3.4.1)

WordPress Coding Standards versions 0.14.1 through 3.4.1 are affected by one high-severity vulnerability (CVE-2026-45293, CVSS 8.6) in which the EnqueuedResourceParameters sniff uses eval() to process function arguments during static analysis scans, allowing arbitrary code execution if a maliciously crafted PHP file is scanned. Any development team, CI/CD pipeline, or code review workflow that runs PHP_CodeSniffer with the WordPress or WordPress-Extra rulesets should treat this as urgent, since simply scanning untrusted code is enough to trigger exploitation.

Teams should upgrade WordPress Coding Standards to version 3.4.1 or later immediately, review CI environments for signs of unexpected command execution, and consult the vendor advisory at the linked GitHub pull request for full remediation details.

Vendor Advisory

🟠 [HIGH] github/github-mcp-server

1 CVE | CVSS 3.1: 7.5 | AAS 9.8

  • cpe:2.3:a:github:github-mcp-server:*:*:*:*:*:*:*:* (< 1.1.0)

GitHub’s official MCP Server prior to version 1.1.0 is affected by one high-severity vulnerability (CVE-2026-47427, CVSS 7.5) in which a missing nil check on the ref parameter in the CompletionsHandler allows any unauthenticated client capable of sending JSON-RPC messages to trigger a nil pointer dereference, crashing the server and causing a complete denial of service. Organizations running the GitHub MCP Server in development toolchains, AI agent integrations, or any environment exposed to untrusted JSON-RPC input should prioritize remediation, as no authentication is required to exploit this flaw.

Teams should upgrade to GitHub MCP Server version 1.1.0 or later immediately and review network controls to ensure MCP Server endpoints are not unnecessarily exposed to untrusted clients. The vendor advisory and fix details are available at the linked GitHub pull request.

Vendor Advisory

🟠 [HIGH] ruby-oauth/oauth2

1 CVE | CVSS 3.1: 8.6 | AAS 9.4

  • cpe:2.3:a:ruby-oauth:oauth2:*:*:*:*:*:*:*:* (>= 0.4.0, < 2.0.22)

The Ruby OAuth2 gem (ruby-oauth/oauth2) versions 0.4.0 through 2.0.21 is affected by one high-severity vulnerability (CVE-2026-54603, CVSS 8.6) in which a protocol-relative redirect in the Location header can override the request authority, causing bearer Authorization headers to be sent to an attacker-controlled host and leaking OAuth credentials. Any Ruby application or service relying on this gem for OAuth 2.0, OAuth 2.1, or OpenID Connect authentication flows should treat this as a priority fix, as the vulnerability spans nearly the entire release history of the library.

Teams should upgrade to version 2.0.22 or later immediately and review application logs for any suspicious redirect behavior or unexpected token usage. Full details and the fix are available in the vendor security advisory linked above.

Vendor Advisory

🟠 [HIGH] appium/java-client

1 CVE | CVSS 3.1: 8.2 | AAS 9.0

  • cpe:2.3:a:appium:java-client:*:*:*:*:*:*:*:* (>= 8.2.1, < 10.1.1)

Appium Java Client versions 8.2.1 through 10.1.0 are affected by one high-severity vulnerability (CVE-2026-43910, CVSS 8.2) in which the directConnect feature blindly trusts host, port, and path values returned in a server’s NEW_SESSION response to rebuild the client’s connection URL, with no host allowlist or IP validation beyond requiring HTTPS. A rogue or compromised Appium server can redirect the client to an attacker-controlled endpoint, potentially exposing session credentials and test data. Any organization using the Appium Java Client with directConnect enabled in CI/CD pipelines, mobile test automation, or QA environments should prioritize remediation.

Teams should upgrade to Appium Java Client version 10.1.1 or later and review whether directConnect is enabled in their test configurations. The fix and additional details are available at the linked GitHub pull request.

Vendor Advisory