IT security 2026-07-22

Level Critical — 100/100 — 2026-07-22

Critical day: 17 stories ranked, 6 of the top 10 reported as actively exploited, 6 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability (90/100).

  1. Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability — 90/100 (CVE-2026-0770)
  2. WordPress Core Interpretation Conflict Vulnerability — 86/100 (CVE-2026-63030)
  3. Check Point SmartConsole Improper Authentication Vulnerability — 84/100 (CVE-2026-16232)
  4. Microsoft SharePoint Deserialization of Untrusted Data Vulnerability — 80/100 (CVE-2026-50522)
  5. DD-WRT Stack-Based Buffer Overflow Vulnerability — 72/100 (CVE-2021-27137)
  6. WordPress Core SQL Injection Vulnerability — 71/100 (CVE-2026-60137)
  7. CVE-2026-8985 — Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoi… — 36/100 (CVE-2026-8985)
  8. CVE-2026-8986 — Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCP… — 31/100 (CVE-2026-8986)
  9. CVE-2026-8984 — Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the serv… — 31/100 (CVE-2026-8984)
  10. CVE-2026-8983 — Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses… — 30/100 (CVE-2026-8983)