IT security 2026-07-21

Level Critical — 84/100 — 2026-07-21

Critical day: 17 stories ranked, 4 of the top 10 reported as actively exploited, 4 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability (76/100).

  1. Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability — 76/100 (CVE-2026-0770)
  2. WordPress Core Interpretation Conflict Vulnerability — 75/100 (CVE-2026-63030)
  3. DD-WRT Stack-Based Buffer Overflow Vulnerability — 68/100 (CVE-2021-27137)
  4. WordPress Core SQL Injection Vulnerability — 62/100 (CVE-2026-60137)
  5. CVE-2026-8983 — Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses… — 39/100 (CVE-2026-8983)
  6. CVE-2026-8984 — Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the serv… — 39/100 (CVE-2026-8984)
  7. CVE-2026-8985 — Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoi… — 39/100 (CVE-2026-8985)
  8. CVE-2026-8986 — Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCP… — 37/100 (CVE-2026-8986)
  9. CVE-2026-56820 — Netty is a network application framework for development of protocol servers and clients. — 35/100 (CVE-2026-56820)
  10. CVE-2026-61174 — Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installati… — 35/100 (CVE-2026-61174)