IT security 2026-07-09

Level Calm — 36/100 — 2026-07-09

Calm day: 17 stories ranked, 0 of the top 10 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability (39/100).

  1. Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability — 39/100 (CVE-2026-56291)
  2. CVE-2026-53963 — Discourse is an open-source discussion platform. — 35/100 (CVE-2026-53963)
  3. openwebui open webui: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. — 35/100 (CVE-2026-59214)
  4. openwebui open webui: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. — 35/100 (CVE-2026-59216)
  5. gpsd project gpsd: gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof t… — 32/100 (CVE-2026-58459)
  6. CVE-2026-58192 — Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver prot… — 30/100 (CVE-2026-58192)
  7. CVE-2026-9074 — IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injec… — 30/100 (CVE-2026-9074)
  8. CVE-2026-3144 — IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unau… — 30/100 (CVE-2026-3144)
  9. CVE-2026-8801 — Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). — 29/100 (CVE-2026-8801)
  10. CVE-2026-8649 — Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Cu… — 29/100 (CVE-2026-8649)