IT security 2026-07-08

Level Critical — 81/100 — 2026-07-08

Critical day: 15 stories ranked, 4 of the top 10 reported as actively exploited, 4 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Adobe ColdFusion Path Traversal Vulnerability (71/100).

  1. Adobe ColdFusion Path Traversal Vulnerability — 71/100 (CVE-2026-48282)
  2. JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability — 69/100 (CVE-2026-48908)
  3. Joomlack Page Builder Improper Access Control Vulnerability — 68/100 (CVE-2026-56290)
  4. Langflow Authorization Bypass Through User-Controlled Key Vulnerability — 63/100 (CVE-2026-55255)
  5. CVE-2026-58192 — Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver prot… — 39/100 (CVE-2026-58192)
  6. CVE-2026-3144 — IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unau… — 38/100 (CVE-2026-3144)
  7. CVE-2026-8649 — Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Cu… — 38/100 (CVE-2026-8649)
  8. CVE-2026-8801 — Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). — 38/100 (CVE-2026-8801)
  9. CVE-2026-9074 — IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injec… — 38/100 (CVE-2026-9074)
  10. CVE-2026-54527 — JupyterLab Git is a Git extension for JupyterLab. — 36/100 (CVE-2026-54527)