IT security 2026-07-07

Level Critical — 80/100 — 2026-07-07

Critical day: 8 stories ranked, 4 of the top 8 reported as actively exploited, 4 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Adobe ColdFusion Path Traversal Vulnerability (69/100).

1. Adobe ColdFusion Path Traversal Vulnerability — 69/100 (CVE-2026-48282)
2. JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability — 68/100 (CVE-2026-48908)
3. Joomlack Page Builder Improper Access Control Vulnerability — 67/100 (CVE-2026-56290)
4. Langflow Authorization Bypass Through User-Controlled Key Vulnerability — 63/100 (CVE-2026-55255)
5. CVE-2026-13020 — A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and… — 38/100 (CVE-2026-13020)
6. CVE-2026-40139 — A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Supp… — 29/100 (CVE-2026-40139)
7. CVE-2026-40141 — A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privile… — 26/100 (CVE-2026-40141)
8. CVE-2026-54763 — Traefik is an HTTP reverse proxy and load balancer. — 24/100 (CVE-2026-54763)