CVE Statistics: July 2026

🌐 Discover the key figures for vulnerabilities published in July 2026 on CVE Find.

🔎 Overview

• Total number of CVEs published : 9,917 (+23.9% vs the previous month)
• Vulnerabilities added to the CISA KEV catalog : 26

📂 Breakdown by main categories

• Authorization problems : 1483
• Cross-site Scripting : 749
• Overflow : 633
• Memory Corruption : 556
• SQL Injection : 389
• Directory Traversal : 315

📈 Breakdown by CVSS score

• Low : 300
• Medium : 3455
• High : 4017
• Critical : 1322

🏢 Most affected vendors

1. oracle : 1108
2. microsoft : 774
3. linux : 673
4. google : 518
5. apple : 303

📦 Most affected products

1. linux linux_kernel : 673
2. google chrome : 485
3. microsoft windows_11_26h1 : 395
4. microsoft windows_11_25h2 : 392
5. microsoft windows_11_24h2 : 392

⚠️ Notable CVEs of the month

• CVE-2026-18452 (10 CRITICAL) : DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over a...
• CVE-2026-66803 (10 CRITICAL) : Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
• CVE-2026-48449 (10 CRITICAL) : Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitati...
• CVE-2026-16326 (10 CRITICAL) : In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used fo...
• CVE-2026-67429 (10 CRITICAL) : Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir inste...

Explore all the data in detail on CVE Find.