CVE Weekly Report — Week of Jul 13 – July 19, 2026
2026-W29
16
Total CVEs
3
Critical
7
High
0
Actively exploited
1 CVE is actively exploited (CISA KEV) this week. Patch these immediately: CVE-2026-63030
🔴 Critical CVEs (40)
| CVE | Product | CVSS | KEV | Description | Published |
|---|---|---|---|---|---|
| CVE-2026-63030 | Wordpress | 9.8 | KEV | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which… | Jul 17 |
| CVE-2026-48358 | Magento | 9.1 | — | Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary co… | Jul 14 |
| CVE-2026-48356 | Magento | 9.6 | — | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbi… | Jul 14 |
| CVE-2026-64142 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against m_fp_l… | Jul 19 |
| CVE-2026-64016 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifeti… | Jul 19 |
| CVE-2026-64069 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read su… | Jul 19 |
| CVE-2026-64066 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_to_pagecache() to pause on su… | Jul 19 |
| CVE-2026-64150 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: release local_lock before re-… | Jul 19 |
| CVE-2026-64122 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_… | Jul 19 |
| CVE-2026-64160 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size… | Jul 19 |
| CVE-2026-64089 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len ba… | Jul 19 |
| CVE-2026-64125 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting R… | Jul 19 |
| CVE-2026-53399 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4… | Jul 19 |
| CVE-2026-53398 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfs… | Jul 19 |
| CVE-2026-63800 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() W… | Jul 19 |
| CVE-2026-64113 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast sourc… | Jul 19 |
| CVE-2026-53384 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifi… | Jul 19 |
| CVE-2026-63993 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb… | Jul 19 |
| CVE-2026-64007 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensur… | Jul 19 |
| CVE-2026-63994 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in ip… | Jul 19 |
| CVE-2026-63992 | Linux | 9.1 | — | In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel… | Jul 19 |
| CVE-2026-63795 | Linux | 10.0 | — | In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error … | Jul 19 |
| CVE-2026-64068 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new … | Jul 19 |
| CVE-2026-64067 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream->… | Jul 19 |
| CVE-2026-64102 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before s… | Jul 19 |
| CVE-2026-64136 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_fin… | Jul 19 |
| CVE-2026-64000 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision f… | Jul 19 |
| CVE-2026-64132 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event(… | Jul 19 |
| CVE-2026-64033 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation… | Jul 19 |
| CVE-2026-64035 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko poi… | Jul 19 |
| CVE-2026-13221 | Perl | 9.1 | — | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13 |
| CVE-2026-64037 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO segmentation explosion … | Jul 19 |
| CVE-2026-64091 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans … | Jul 19 |
| CVE-2026-64024 | Linux | 9.4 | — | In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN… | Jul 19 |
| CVE-2026-64162 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_p… | Jul 19 |
| CVE-2026-64025 | Linux | 9.8 | — | In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with k… | Jul 19 |
| CVE-2026-64080 | Linux | 9.3 | — | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Snapshot notifier callbacks unde… | Jul 19 |
| CVE-2026-64106 | Linux | 9.0 | — | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-… | Jul 19 |
| CVE-2026-64018 | Linux | 9.3 | — | In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bo… | Jul 19 |
| CVE-2026-64034 | Linux | 9.3 | — | In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id fr… | Jul 19 |
🟠 High CVEs (12)
| CVE | Product | CVSS | KEV | Description | Published |
|---|---|---|---|---|---|
| CVE-2026-63796 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors o… | Jul 19 |
| CVE-2026-64138 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor d… | Jul 19 |
| CVE-2026-63975 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred… | Jul 19 |
| CVE-2026-64093 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: directly shut down timer on c… | Jul 19 |
| CVE-2026-64088 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_or… | Jul 19 |
| CVE-2026-64096 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node … | Jul 19 |
| CVE-2026-64010 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfc_llcp_recv… | Jul 19 |
| CVE-2026-53375 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In… | Jul 19 |
| CVE-2026-64124 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-alig… | Jul 19 |
| CVE-2026-64153 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommu_map_sgtable() return value check… | Jul 19 |
| CVE-2026-64115 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection dur… | Jul 19 |
| CVE-2026-53374 | Linux | 8.8 | — | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocatio… | Jul 19 |