Month report
July 2026
Rolled up 2026-09-13 17:40 from 370,778 CVE records
9,761 CVEs published, +158.6% on the same month last year. 1,296 rated critical, 26 listed by CISA as exploited. oracle led with 1,108; the most common weakness class was CWE-284 (902). jetbrains climbed 60 places, the largest move. 7 vendors ranked for the first time.
Published
9,761
Critical / high
1,296 / 4,168
Medium / low
3,470 / 423
Added to CISA KEV
26
Public exploit
294
Scanner template
51
Publication to KEV
How long before CISA listed them
Median days to listing
4
Listed within 7 days
57.1%
Listed within 30 days
76.2%
Detection gap
Listed as exploited, no public template
Listed this month
26
With a template
11
No template
15
- 1microsoft4of 5 listed
- 2fortinet2of 3 listed
- 3sonicwall1of 2 listed
- 4wordpress1of 2 listed
- 5arista networks1of 1 listed
- 6cisco1of 1 listed
- 7dd wrt1of 1 listed
- 8knx association1of 1 listed
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | oracle | 1,108 | 210 | 1 | oracle coherence (98) · mysql cluster (43) · oracle webcenter content (42) | ↑3 | ||
| 2 | linux | 838 | 88 | 1 | 10 | linux (838) · simatic s7 1500 cpu 1518 4 pn dp mfp (18) · simatic s7 1500 cpu 1518f 4 pn dp mfp (18) | — | |
| 3 | microsoft | 664 | 41 | 5 | 18 | 2 | windows server 2025 (388) · windows server 2025 server core installation (388) · windows 11 version 26h1 (382) | ↑2 |
| 4 | 496 | 82 | 2 | chrome (487) · mcp toolbox (5) · mcp toolbox for databases googleapis mcp toolbox (2) | ↓3 | |||
| 5 | apache | 181 | 42 | 41 | 1 | apache traffic server (39) · apache camel (22) · apache thrift (15) | ↑2 | |
| 6 | apple | 167 | 55 | 4 | macos (159) · ios and ipados (96) · tvos (67) | ↑7 | ||
| 7 | redhat | 163 | 6 | 2 | red hat enterprise linux 9 (86) · red hat enterprise linux 10 (85) · red hat enterprise linux 8 (83) | ↓4 | ||
| 8 | adobe | 107 | 15 | coldfusion 2023 (16) · coldfusion 2025 (16) · adobe bridge (14) | ↓2 | |||
| 9 | ibm | 105 | 25 | 1 | 2 | 1 | langflow oss (26) · websphere application server (14) · websphere application server liberty (14) | ↓1 |
| 10 | mozilla | 71 | 39 | 1 | firefox (66) · thunderbird (66) · firefox for ios (2) | ↑4 | ||
| 11 | surrealdb | 57 | 1 | surrealdb (57) | new | |||
| 12 | mervinpraison | 54 | 12 | 1 | praisonai (38) · praisonai platform (16) · praisonaiagents (2) | · | ||
| 13 | sourcecodester | 49 | class and exam timetabling system (23) · multi vendor online grocery management system (6) · onlne examination learning management system (5) | ↑2 | ||||
| 14 | siemens | 48 | 2 | 1 | ruggedcom ape1808 (22) · linux (18) · simatic s7 1500 cpu 1518 4 pn dp mfp (18) | ↑3 | ||
| 15 | drupal | 46 | 5 | 1 | 1 | drupal core (5) · advanced content feedback aka admin feedback (2) · ai agents (2) | · | |
| 16 | openclaw | 44 | 1 | openclaw (39) · msteams (3) · feishu (2) | ↓5 | |||
| 17 | dell | 43 | 5 | powerprotect data domain (25) · powerprotect data manager (6) · powerflex manager (3) | ↑2 | |||
| 18 | nvidia | 43 | 3 | tensorrt llm (12) · megatron bridge (11) · triton inference server (9) | · | |||
| 19 | hclsoftware | 41 | aftermarket epc (14) · mycloud (7) · devops loop (4) | new | ||||
| 20 | gitea | 40 | 11 | 5 | 2 | gitea open source git server (40) | · | |
| 21 | symfony | 39 | 1 | 2 | symfony (29) · ux (9) · html sanitizer (5) | · | ||
| 22 | getgrav | 38 | 4 | 1 | grav (38) | · | ||
| 23 | imagemagick | 37 | imagemagick (37) | ↓5 | ||||
| 24 | coollabsio | 34 | 4 | 3 | coolify (34) | ↑54 | ||
| 25 | code projects | 33 | 1 | real state services (7) · hotel and tourism reservation (6) · online job portal (5) | ↑16 | |||
| 26 | regularlabs com | 29 | 6 | articles anywhere extension for joomla (5) · conditional content extension for joomla (5) · geoip extension for joomla (5) | new | |||
| 27 | xen | 29 | 11 | xen (18) · xapi (6) · windows pv drivers (3) | · | |||
| 28 | elastic | 28 | kibana (18) · elasticsearch (9) · fleet server (1) | · | ||||
| 29 | foxit software | 28 | 1 | foxit pdf editor (28) · foxit pdf reader (28) | · | |||
| 30 | zephyrproject | 28 | 1 | zephyr (28) | — | |||
| 31 | jetbrains | 27 | 6 | 1 | 1 | 1 | intellij idea (7) · teamcity (7) · webstorm (4) | ↑60 |
| 32 | mongodb | 26 | mongodb server (25) · mongodb compass (1) | ↑28 | ||||
| 33 | ubiquiti | 25 | 7 | 1 | cloud gateways (7) · dream machines (7) · dream routers (7) | · | ||
| 34 | nlnet labs | 24 | unbound (24) | · | ||||
| 35 | egor | 23 | 7 | data disjointset shared (2) · data hashmap shared (2) · data intern shared (2) | new | |||
| 36 | capgo | 22 | capgo (22) | ↓26 | ||||
| 37 | guardian | 22 | 13 | language system (22) | new | |||
| 38 | juniper networks | 22 | junos os (18) · junos os evolved (8) | · | ||||
| 39 | eclipse foundation | 21 | 2 | eclipse jetty (4) · eclipse csi pia (2) · eclipse theia (2) | · | |||
| 40 | coder | 20 | 1 | coder (20) | new | |||
| 41 | dataease | 20 | 2 | dataease (20) | · | |||
| 42 | gitlab | 20 | gitlab (20) | ↓11 | ||||
| 43 | grokability | 20 | snipe it (20) | new | ||||
| 44 | phoenix contact | 20 | 8 | charx sec 3000 (20) · charx sec 3050 (20) · charx sec 3100 (20) | · | |||
| 45 | progress software | 20 | 1 | telerik ui for asp net ajax (13) · ecs connection manager (5) · loadmaster (5) | · | |||
| 46 | aws | 19 | 1 | amplify codegen ui (1) · aws advanced jdbc wrapper (1) · aws api mcp server (1) | ↑31 | |||
| 47 | geovision | 19 | geowebplayer (18) · gv ip device utility (1) | ↓9 | ||||
| 48 | hcl software | 19 | 1 | dfxanalytics (9) · hcl icontrol (5) · dfxserver (3) | · | |||
| 49 | netty | 19 | 1 | netty (19) | ↓20 | |||
| 50 | open webui | 19 | open webui (19) | ↓5 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2026-07 that are on the CISA KEV catalog today. The 26 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-284902131 critical↑4
- 2CWE-7975025 critical↓1
- 3CWE-86245224 critical↑1
- 4CWE-306389170 critical↑9
- 5CWE-8938992 critical↓2
- 6CWE-20034014 critical↑4
- 7CWE-2231345 critical—
- 8CWE-41631044 critical↓6
- 9CWE-2026557 critical↓3
- 10CWE-26924634 critical↑13
- 1CWE-86324415 critical↑7
- 2CWE-91824322 critical↑3
- 3CWE-63924019 critical↑1
- 4CWE-12522527 critical↓6
- 5CWE-4002084 critical↑4
- 6CWE-12219517 critical↑5
- 7CWE-28719048 critical↑7
- 8CWE-7818049 critical↓6
- 9CWE-9417851 critical↓2
- 10CWE-78715725 critical↓4
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.