July 28, 2026—KB5101684 (OS Builds 26200.8973 and 26100.8973) Preview

None None...

PT-2026-65451

Name of the Vulnerable Software and Affected Versions ImsService versions prior to SMR Jul-2026 Release 1 Description An out-of-bounds write exists in ImsService, which may allow remote attackers to execute arbitrary code. An out-of-bounds write occurs when a program writes data past the end of t...

Oracle APEX (CVE-2026-60156) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: General as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: General. Easily exploitable vulnerability allows unauthenticated attacker with network...

Oracle APEX (CVE-2026-54285) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: Third Party OpenTelemetry as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: Third Party OpenTelemetry. Easily exploitable vulnerability allows...

CVE-2026-53629

creationtimestamp| type| source ---|---|--- 2026-07-27 12:40:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrmw5a5zbw2x 2026-07-27 17:00:06+00:00| seen| https://t.me/GithubRedTeam/95376 2026-07-28 00:00:30+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/95376...

CVE-2026-17527

creationtimestamp| type| source ---|---|--- 2026-07-27 10:30:15+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrmoumj5gu2y 2026-07-27 12:00:19+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrmtvpbkks2o 2026-07-27 12:00:21+00:00| seen|...

CVE-2026-48357

creationtimestamp| type| source ---|---|--- 2026-07-27 09:11:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmkhglsrg2u 2026-07-27 09:11:40+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrmki4xeux23...

CVE-2026-48342

creationtimestamp| type| source ---|---|--- 2026-07-27 03:50:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrlyj2kfki2u 2026-07-27 03:50:06+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrlyj4krkw2l...

July Microsoft Patch Tuesday

July Microsoft Patch Tuesday. In the second week of July, I was on vacation in St. Petersburg. After that, I got caught up with a bunch of other tasks, so I'm only publishing this roundup now. Better late than never, especially considering how unusual this MSPT turned out to be. 😉 In total, 571...

sharepoint-2026-poc

SharePoint /trust WS-Federation Deserialization — PoC & Det...

Microsoft Edge (Chromium) < 150.0.4078.99 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 150.0.4078.99. It is, therefore, affected by multiple vulnerabilities as referenced in the July 25, 2026 advisory. - Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to...

CVE-2026-62835

creationtimestamp| type| source ---|---|--- 2026-07-24 20:20:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg6gmeec42a 2026-07-24 20:45:57+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/116976907530516421 2026-07-24 22:01:36+00:00| seen|...

CVE-2026-13061

creationtimestamp| type| source ---|---|--- 2026-07-24 04:46:28+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260724...

CVE-2026-49035

creationtimestamp| type| source ---|---|--- 2026-07-23 22:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdtlrt3us2w 2026-07-23 22:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrduveaath23...

CVE-2026-61310

creationtimestamp| type| source ---|---|--- 2026-07-23 18:18:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-08-01 09:44:48+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mrz6nxn4gg2c...

CVE-2026-60531

creationtimestamp| type| source ---|---|--- 2026-07-23 17:18:49+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-24 19:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg33be4wd2s 2026-07-29 06:07:06+00:00| seen|...

openjdk: Improve certification checking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...

CVE-2026-60368

creationtimestamp| type| source ---|---|--- 2026-07-23 01:00:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbn5xyb2r2q 2026-07-23 04:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbxafd5kr2a 2026-07-23 16:52:52+00:00| seen|...

CVE-2026-61246

creationtimestamp| type| source ---|---|--- 2026-07-23 00:56:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbmwaws4w2b 2026-07-23 01:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbn6kcks22w 2026-07-23 01:48:05+00:00| seen|...

Oracle Essbase (July 2026 CPU)

The version of Oracle Essbase installed on the remote host is missing a security patch from the July 2026 Critical Patch Update CPU. It is, therefore, affected by: - Apache Log4j's JsonTemplateLayout, in versions up to and including 2.25.3, produces invalid JSON output when log events contain...