IT security 2026-07-23

Level Tense — 73/100 — 2026-07-23

Tense day: 10 stories ranked, 2 of the top 10 reported as actively exploited, 2 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability (81/100).

  1. Microsoft SharePoint Deserialization of Untrusted Data Vulnerability — 81/100 (CVE-2026-50522)
  2. Check Point SmartConsole Improper Authentication Vulnerability — 67/100 (CVE-2026-16232)
  3. CVE-2026-65906 — In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible — 39/100 (CVE-2026-65906)
  4. CVE-2026-10697 — Improper Authentication vulnerability in Progress MOVEit Transfer. — 38/100 (CVE-2026-10697)
  5. CVE-2026-15966 — Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. — 38/100 (CVE-2026-15966)
  6. CVE-2026-15967 — Insufficient session expiration vulnerability in Progress MOVEit Transfer. — 38/100 (CVE-2026-15967)
  7. CVE-2026-64815 — In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files — 38/100 (CVE-2026-64815)
  8. katacontainers kata containers: Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machin… — 22/100 (CVE-2026-44210)
  9. CVE-2026-65590 — n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows i… — 18/100 (CVE-2026-65590)
  10. nlnetlabs unbound: In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve… — 17/100 (CVE-2026-50252)