IT security 2026-07-31

Level Calm — 32/100 — 2026-07-31

Calm day: 12 stories ranked, 0 of the top 10 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: CVE-2026-17351 — The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's exe… (36/100).

  1. CVE-2026-17351 — The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's exe… — 36/100 (CVE-2026-17351)
  2. CVE-2026-48449 — Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arb… — 30/100 (CVE-2026-48449)
  3. CVE-2026-12118 — IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute a… — 30/100 (CVE-2026-12118)
  4. CVE-2026-14522 — IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote at… — 30/100 (CVE-2026-14522)
  5. CVE-2026-67208 — Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attack… — 30/100 (CVE-2026-67208)
  6. CVE-2026-4978 — Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in UMAI Vi… — 29/100 (CVE-2026-4978)
  7. php php: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in P… — 25/100 (CVE-2026-17544)
  8. CVE-2026-17543 — Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP… — 25/100 (CVE-2026-17543)
  9. CVE-2026-14537 — Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0… — 24/100 (CVE-2026-14537)
  10. CVE-2026-66756 — Improper Protection of Alternate Path vulnerability in Apache Tika. — 21/100 (CVE-2026-66756)