July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days

Just one month ago, June 2026 Patch Tuesday broke Microsoft’s previous record with 206 CVEs and three zero‑days. July now triples that count, reinforcing that the era of “small” Patch Tuesdays may be over as AI‑driven vulnerability discovery ramps up. The update includes 59 critical...

USN-8548-1: Linux kernel vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

Microsoft’s July 2026 Patch Tuesday fixes 622 flaws and 2 exploited zero-days

Microsoft’s July 2026 Patch Tuesday fixes 622 CVEs, including exploited AD FS and SharePoint flaws, plus the disclosed BitLocker bypass requiring urgent action...

Apache Kafka API CONSUMER_GROUP_DESCRIBE Unauthorized Access

The vulnerability of the API CONSUMERGROUPDESCRIBE mechanism used by the Apache Kafka messaging broker is related to deficiencies in the authorization process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

nfs-utils Privilege Escalation

The vulnerability of the nfs-utils package is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

Microsoft SharePoint Server Privilege Escalation

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the deficiencies of the authentication process. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

CVE-2026-5270

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS) , Manage Control Plan (MCP) , and Blue Planet products. The root cause is improper handling of HTTP request paths and headers , which enables an unauthenticated attacker to manipulate ...

Microsoft Patches a Record 570 Security Flaws

Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeonin...

CVE-2026-48561

creationtimestamp| type| source ---|---|--- 2026-07-14 18:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmu6jsugc22 2026-07-14 22:02:10+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-14 22:05:06+00:00| seen|...

vulnerabilities hidden in Microsoft Defender

Microsoft has addressed vulnerabilities in Defender. A malicious individual could exploit these vulnerabilities to gain enhanced privileges, execute arbitrary code with system rights, and/or access sensitive data. The malicious individual would need to deceive the victim into downloading and...

EUVD-2026-43749

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for...

CVE-2026-36214

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions...

AlmaLinux 10 : openexr (ALSA-2026:38499)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:38499 advisory. OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing CVE-2026-41142 OpenEXR: OpenEXR: Information disclosure and denial of...

Security Updates for Microsoft Exchange Server (July 2026)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the July, 2026 security bulletin. - Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft...

APSB26-79 : Security Updates Available for Adobe Illustrator

Adobe has released an update for Adobe Illustrator. This update resolves critical vulnerabilities that could lead to arbitrary code execution and privilege escalation. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates...

Open WebUI Authentication Bypass

The vulnerability of the Open WebUI web interface is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain access to and modify data...

ROS-20260714-73-0043

The vulnerability in MinIO is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers who operate remotely to increase their privileges...

systems-exploitation-ctf

Systems Exploitation CTF Five offensive-security challenges s...

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Scrapy versions up to 2.13.3 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of...

CLEANSTART-2026-XK25146 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 applied in versions: 0.36.1-r0, 0.36.6-r0, 0.36.6-r1, 0.37.0-r0

Multiple security vulnerabilities affect the sealed-secrets package. These issues are resolved in later releases. See references for individual vulnerability details...