IT security 2026-07-14

Level Critical — 100/100 — 2026-07-14

Critical day: 30 stories ranked, 5 of the top 10 reported as actively exploited, 5 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (100/100).

  1. SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability — 100/100 (CVE-2026-15409)
  2. SonicWall SMA1000 Appliances Code Injection Vulnerability — 91/100 (CVE-2026-15410)
  3. Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability — 86/100 (CVE-2026-56164)
  4. Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability — 79/100 (CVE-2026-56155)
  5. Cisco IOS Cross-Site Request Forgery Vulnerability — 77/100 (CVE-2008-4128)
  6. CVE-2026-54433 — In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a c… — 39/100 (CVE-2026-54433)
  7. CVE-2026-62643 — In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitiza… — 39/100 (CVE-2026-62643)
  8. CVE-2026-24227 — NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. — 38/100 (CVE-2026-24227)
  9. microsoft .net framework: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security… — 38/100 (CVE-2026-47304)
  10. microsoft windows 10 1607: Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute cod… — 38/100 (CVE-2026-49164)