5 vulnerabilities across 2 products scored HIGH or above on July 31, 2026.

  • 🔴 CRITICAL: 1
  • 🟠 HIGH: 4

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-65921 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.
  • [UPGRADED] CVE-2026-66014 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.
  • [UPGRADED] CVE-2026-65617 (jfrog/artifactory) — F1: exploitable → functional, AAS: 9.2 → 11.2 (HIGH → HIGH). Originally in 2026-07-27 bulletin.

🔴 [CRITICAL] codeigniter4/codeigniter4

1 CVE | CVSS 3.1: 9.8 | AAS 12.3

  • cpe:2.3:a:codeigniter4:codeigniter4:*:*:*:*:*:*:*:* (< 4.7.4)

CodeIgniter4 versions prior to 4.7.4 are affected by a critical file upload validation bypass (CVE-2026-63223, CVSS 9.8). The is_image and mime_in upload validation rules fail to enforce safe filename extensions, allowing a remote attacker to upload and execute arbitrary code when the application preserves client-supplied filenames and stores uploads in a web-accessible directory with script execution enabled.

Teams running CodeIgniter4-based applications that handle file uploads should treat this as a high-priority remediation item. Update to CodeIgniter4 version 4.7.4 or later immediately, and as an interim mitigation, add explicit extension validation using ext_in rules on all upload handlers. Review existing uploaded files in web-accessible directories for any suspicious or executable content.

Vendor Advisory

🟠 [HIGH] comfy-org/comfyui

4 CVEs | CVSS 3.1: 8.2 | AAS 10.0

  • cpe:2.3:a:comfy-org:comfyui:*:*:*:*:*:*:*:* (< 0.28.0)

ComfyUI versions prior to 0.28.0 are affected by four vulnerabilities (including CVE-2026-56672 and CVE-2026-56670, max CVSS 8.2), which together enable stored cross-site scripting and unauthorized access to sensitive data. The most notable issue involves the userdata endpoint serving user-uploaded HTML and SVG files with browser-executable content types, allowing an attacker to steal API tokens, settings, workflows, and make authenticated API calls within the ComfyUI origin.

Teams running ComfyUI for AI image generation workflows should update to version 0.28.0 or later immediately. Until patched, restrict access to the ComfyUI web interface to trusted users and networks, and audit any user-uploaded files in the userdata directory for malicious HTML or SVG content.

Vendor Advisory