IT security 2026-07-18

Level Calm — 36/100 — 2026-07-18

Calm day: 9 stories ranked, 0 of the top 9 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: CVE-2026-15631 — Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebS… (39/100).

  1. CVE-2026-15631 — Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebS… — 39/100 (CVE-2026-15631)
  2. CVE-2026-16158 — Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache k… — 39/100 (CVE-2026-16158)
  3. shivammathur setup php: setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tool… — 31/100 (CVE-2026-46420)
  4. CVE-2026-13448 — IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerabi… — 30/100 (CVE-2026-13448)
  5. CVE-2026-13473 — IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protec… — 30/100 (CVE-2026-13473)
  6. CVE-2026-12692 — Unverified password change vulnerability in Vimesoft Inc. — 30/100 (CVE-2026-12692)
  7. CVE-2026-14501 — IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code o… — 30/100 (CVE-2026-14501)
  8. CVE-2026-8297 — Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Inf… — 29/100 (CVE-2026-8297)
  9. Sangoma Switchvox SQL Injection Vulnerability — 28/100 (CVE-2026-9586)