13 vulnerabilities across 7 products scored HIGH or above on July 31, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 12

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.
  • [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.
  • [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.

🔴 [CRITICAL] codeigniter4/codeigniter4

2 CVEs | CVSS 3.1: 9.8 | AAS 12.3

  • cpe:2.3:a:codeigniter4:codeigniter4:*:*:*:*:*:*:*:* (< 4.7.4)

CodeIgniter4 versions prior to 4.7.4 are affected by 2 vulnerabilities, including at least one rated CRITICAL with a CVSS score of 9.8. The most severe issue involves insufficient upload validation in the is_image and mime_in rules, which fail to enforce safe filename extensions independently. A remote attacker can exploit this to upload and execute malicious content on applications that preserve client-supplied filenames and store uploads in web-accessible, script-enabled directories.

Teams running CodeIgniter4 in any web-facing capacity should treat this as urgent, particularly if their application handles file uploads without explicit extension validation. Upgrade to CodeIgniter4 version 4.7.4 or later immediately, and review the vendor advisory at the linked GitHub commit for additional remediation guidance. As an interim measure, ensure all upload handling includes an independent safe extension check such as ext_in, and audit existing upload directories for any previously uploaded suspicious files.

Vendor Advisory

🟠 [HIGH] comfy-org/comfyui

5 CVEs | CVSS 4.0: 9.3 | AAS 10.7

  • cpe:2.3:a:comfy-org:comfyui:*:*:*:*:*:*:*:* (< 0.28.0)

ComfyUI version 0.23.0 and potentially earlier versions are affected by 5 vulnerabilities, including multiple rated HIGH with a CVSS score up to 9.3. The most critical issue is an unsafe deserialization flaw in the LoadTrainingDataset node, where an unauthenticated remote attacker can upload a malicious pickle file via the open upload endpoint and trigger arbitrary Python code execution by queuing a crafted workflow, requiring no authentication at any stage of the attack chain.

Organizations and individuals running ComfyUI, particularly those with instances exposed to the network or internet, should act immediately. Check the vendor advisory at the ComfyUI GitHub repository for patched versions and upgrade as soon as a fix is available. In the interim, restrict network access to ComfyUI instances to trusted users only, disable or block unauthenticated access to the upload and prompt endpoints, and audit any existing uploaded files for suspicious pickle payloads.

Vendor Advisory

🟠 [HIGH] pterodactyl/wings

1 CVE | CVSS 3.1: 9.9 | AAS 10.2

  • cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:*

Pterodactyl Wings, the server control plane for the Pterodactyl game server management panel, is affected by 1 vulnerability rated HIGH with a CVSS score of 9.9. Versions prior to 1.12.3 allow a low-privileged user to abuse egg configuration-file template placeholders to read sensitive daemon configuration values, including authentication tokens and Docker registry credentials, potentially enabling full compromise of the Wings daemon and connected infrastructure.

Administrators running Pterodactyl Wings should upgrade to version 1.12.3 immediately and rotate any exposed daemon tokens and Docker registry credentials. Review the vendor advisory at the linked GitHub security advisory for full details and consider auditing egg configurations for any unauthorized access to sensitive template variables.

Vendor Advisory

🟠 [HIGH] nltk/nltk

1 CVE | CVSS 3.1: 8.6 | AAS 9.9

  • cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*

NLTK, the popular Python natural language processing toolkit, is affected by 1 vulnerability rated HIGH with a CVSS score of 8.6. The SSRF protection filter in nltk.pathsec can be bypassed via DNS rebinding, where the hostname resolves to a safe IP during validation but resolves to an internal or restricted address during the actual HTTP connection, undermining the security control even when strict ENFORCE mode is enabled.

Teams using NLTK in environments where it processes or fetches external URLs, particularly server-side applications relying on the pathsec filter as a security boundary, should review the vendor advisory at the linked GitHub advisory for remediation guidance. Until a patch is applied, consider implementing additional network-layer SSRF protections such as egress filtering or DNS pinning to prevent rebinding attacks from reaching internal services.

Vendor Advisory

🟠 [HIGH] bank-vaults/vault-secrets-webhook

1 CVE | CVSS 3.1: 9.6 | AAS 9.7

  • cpe:2.3:a:bank-vaults:vault-secrets-webhook:*:*:*:*:*:*:*:* (< 1.23.1)

The bank-vaults vault-secrets-webhook, a Kubernetes mutating webhook for direct secret injection into Pods, is affected by 1 vulnerability rated HIGH with a CVSS score of 9.6. In versions prior to 1.23.1, an attacker can manipulate Pod annotations to redirect the webhook to an attacker-controlled Vault address, causing Kubernetes ServiceAccount JWTs to be exfiltrated, potentially enabling unauthorized access to secrets and broader cluster compromise.

Teams running vault-secrets-webhook in Kubernetes environments should upgrade to version 1.23.1 immediately. Review the vendor advisory at the linked GitHub commit for details, audit existing Pod and workload annotations for any unauthorized vault-addr overrides, and rotate any ServiceAccount tokens that may have been exposed.

Vendor Advisory

🟠 [HIGH] fast-uri/fast-uri

1 CVE | CVSS 3.1: 7.5 | AAS 9.6

  • cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:*

The fast-uri npm package, a high-performance URI parser commonly used in Node.js applications, is affected by 1 vulnerability rated HIGH with a CVSS score of 7.5. Versions prior to 4.1.2, 3.1.5, and 2.4.4 parse URIs with backslash-based authority introducers differently than Node’s native WHATWG URL parser, allowing an attacker to craft URIs where the two parsers extract different hostnames from the same input. This parsing inconsistency can be exploited to bypass SSRF protections, allow-list checks, or other security controls that rely on fast-uri for URL validation.

Teams using fast-uri directly or as a transitive dependency in security-sensitive URL handling should upgrade to version 4.1.2, 3.1.5, or 2.4.4 depending on their major version line. Review the vendor advisory at the OpenJS Foundation security advisories page for full details, and audit any URL validation logic that combines fast-uri with other parsers to ensure consistent host extraction.

Vendor Advisory

🟠 [HIGH] thumbor/thumbor

2 CVEs | CVSS 4.0: 8.7 | AAS 9.6

  • cpe:2.3:a:thumbor:thumbor:*:*:*:*:*:*:*:* (< 7.8.0)

Thumbor, the open-source photo thumbnail service by globo.com, is affected by 2 vulnerabilities including at least one rated HIGH with a CVSS score up to 8.7. The most notable issue involves a path traversal flaw in the file_loader component, where percent-encoded path segments are decoded after root-boundary validation, allowing an attacker to escape the configured FILE_LOADER_ROOT_PATH through watermark or frame filter input and read arbitrary files from the server.

Organizations running Thumbor for image processing should upgrade to version 7.8.0 or later immediately. Review the vendor advisory at the linked GitHub commit for full details, and audit server logs for any suspicious path traversal patterns in watermark or frame filter requests that may indicate prior exploitation attempts.

Vendor Advisory