July 2026 vulnerabilities: what to fix first

1 Why a 5.3-rated flaw belongs near the front

A queue sorted by severity could leave Cisco Secure Firewall Management Center's CVE-2026-20316 waiting. Its score is 5.3, yet attackers were already exploiting it: a low-privilege static account in the system exposes sensitive data to remote callers. Cisco also describes possible privilege escalation in combination with other FMC vulnerabilities and rates the advisory High. The score describes consequences under specified conditions. What that management system controls in your environment, and whether attackers are already using the entry point, need separate attention.

For this July cohort, I would first repair known-exploited management interfaces, build services and public websites that are actually reachable in the local environment, while checking for compromise. Restrict FMC management access and install the branch-specific hotfix. Update TeamCity and inspect build configuration, credentials and outputs. Update affected WordPress installations and review changes made while exposed. Keep browsers, kernels and application dependencies moving through their respective update schedules. The repair notes below retain branch versions, temporary measures and recovery constraints for checking a particular product.

The comparison uses one fixed cohort: 9,808 CVE records published in July, of which 9,763 were active in the original snapshot. Matches in CISA's Known Exploited Vulnerabilities catalog rose from 14 on August 4 to 21 in the September 11 catalog retrieved here. The score analysis stays on August 4 so we can see what the earlier ranking would have missed. Repair information was rechecked on September 13 at 01:27 (UTC+8) so that historical releases do not become today's update advice.

Priority is only the first decision. After Gitea's fix, an unauthorized reader should still get a successful package response, with private-repository fields absent. WordPress needs two input forms to pass through the same integer conversion. ANGLE must remember an object that is no longer current but still uses a buffer. We start with the scoring omissions, then follow those three patches to identify the checks that establish whether an update actually repaired the relevant behavior.

zgrep "package_info.*license" /var/log/messages*

2 What each score leaves out

Start with a reproducible comparison. For the same 9,763 records, select those whose highest retained CVSS is at least 9, then those whose EPSS is at least 0.10, and compare both with same-day KEV. These are comparison points chosen for this article, not a universal operational policy. Taking the maximum retained CVSS combines multiple sources and CVSS generations. It reproduces the old ledger's ranking, but the result cannot be attributed wholesale to NVD. EPSS uses the August 4, 2026 scores. FIRST defines EPSS as an estimate of exploitation in the wild over the next 30 days, updated daily. The earlier article incorrectly described the probability as applying to a single day; that wording is corrected here.

CVSS ≥ 9 omits DD-WRT CVE-2021-27137, SonicWall CVE-2026-15410, Cisco FMC CVE-2026-20316 and Microsoft CVE-2026-56155. Lowering the threshold to 7 expands the selection to 5,741 records and still excludes Cisco. EPSS ≥ 0.10 omits Arista CVE-2026-16812, Cisco FMC CVE-2026-20316, Microsoft CVE-2026-56155 and CVE-2026-58644, and Langflow CVE-2026-9198. Even at 0.01, Arista and Cisco remain outside the selection. Known-exploitation evidence therefore needs a direct route into response, without a second score threshold deciding whether it may enter the urgent queue.

The two higher-threshold sets intersect in 16 records and have a union of 1,453, covering twelve of the fourteen historical KEV entries. Cisco FMC CVE-2026-20316 and Microsoft CVE-2026-56155 remain omitted. Adding the second selection contributes only six records beyond CVSS alone. The attachment also compares the first 14, 22, 100, 500 and 1,447 entries in equal-count rankings. At 100 entries, CVSS includes three historical KEV records and EPSS includes twelve. The CVSS top-hundred cutoff is 9.9, with 102 records tied at that score. The program selects among them by lexicographic identifier. None of those tied records is in KEV; the 89 higher-scoring records contain all three matches. Tie order therefore changes some selected members without changing this three-entry coverage. With no asset or remediation-cost data, a hundred identifiers is an equal-count selection. It supplies no measurement of equal budgets or hours saved.

The conclusion is specific to this comparison: both scores used alone exclude cases with already-recorded exploitation, and EPSS covers more of those cases with a shorter selection on this date. No next-month predictive accuracy was measured. KEV confirms listed exploitation while leaving the exploitation status of unlisted vulnerabilities incompletely observed. Same-day EPSS may already incorporate related public signals. A predictive evaluation would freeze the scores first, observe the following 30 days, and account for detection-source coverage. The seven later KEV additions are changes in catalog registration; their attacks need not all have occurred after the score snapshot.

WordPress shows why the conditions behind a score deserve attention. For CVE-2026-60137, the CNA assigns CVSS 3.1 of 5.9 and CISA ADP assigns 9.1; the current NVD record preserves both source-attributed rows. The former vector uses high attack complexity and confidentiality impact, while the latter uses low complexity and adds integrity impact. Repair order for a site depends on whether an entry point passes external data to the query and whether the separate REST-route combination is present. Choosing the larger or smaller score does not resolve those implementation questions.

3 Gitea package metadata exposes a linked repository

Consider an ordinary dependency installation. A developer may read a package published by a team while lacking access to the private repository used to build it. Gitea's Composer endpoint returns package versions, distribution URLs and other metadata. A package linked to a repository can additionally include source.url, source.type and source.reference. The defect occurs when those fields are added: package-read access has been satisfied, but the program has not checked whether the linked repository should also be visible to this caller. The error transfers access assumptions between two resources. The verifiable consequence is disclosure of the repository address, type and version reference.

Follow the response through the code. PackageMetadata, lines 126–155, obtains the package name from the path, looks up versions, loads descriptors including any associated repository, calls createPackageMetadataResponse, then returns through ctx.JSON. In the pre-fix api.go, lines 118–130, the condition is simply pd.Repository != nil. The function then populates Source with the repository's HTMLURL(), the constant git type, and the package version. Repository existence tells the program it found an object; it says nothing about the caller's permission to see it.

Scroll sideways to read the illustration.

Fix 5d87a70 passes request context into response construction and calls GetDoerRepoPermission(ctx, pd.Repository, ctx.Doer). A permission lookup error is logged. Source is populated only when HasAnyUnitAccessOrPublicAccess() succeeds. Preserve the predicate's actual meaning: access to any repository unit, or the public-access condition. Rephrasing it as specifically permission to read source code would add a restriction that the predicate does not state. Other package fields continue through the existing construction path, allowing the client to consume metadata it is permitted to read.

This determines why an acceptance test cannot rely only on the HTTP status. The upstream regression test at lines 249–275 links a package to a private repository. An authorized user receives the URL, type and reference. A second user without repository access still receives HTTP 200, with all three fields empty. Returning 403 for that second request might prevent disclosure but could also break package access that was intentionally allowed. Correct repair preserves both the access restriction and legitimate dependency installation.

For an actual deployment, identify Composer packages with repository links, compare those three fields under authorized and unauthorized accounts, and test normal downloading. Temporary containment can restrict access to the relevant package endpoint or remove a sensitive repository association, subject to the package maintainer's approval because consumers may depend on the metadata. This article establishes the response change from source and upstream assertions. It did not run the complete Gitea integration environment or demonstrate an unauthorized clone of private code. Handle any disclosed internal addresses or naming information according to the content actually exposed; source theft is a separate finding.

The dates also change the meaning of a new July vulnerability. The fix was merged in May, the 1.26.2 security advisory appeared in June, and the CVE Program record was published on July 3. A July disclosure queue can therefore include a repair that has been available for some time. Determine exposure from the deployed revision and permission behavior, not from an assumption that the monthly report marks the beginning of a one-month exposure period.

4 WordPress input types bypass normalization

WP_Query constructs content queries in WordPress, and author__not_in excludes specified authors. A caller can express the same request—exclude authors 3 and 7—as the array [3, 7] or the string "3,7". Ordinary values may produce equivalent SQL and identical-looking pages. Their safety processing differs: array members are converted to non-negative integers, while the string skips that branch, is cast to a one-element array, and is joined into the query.

The distinction is visible in pre-fix lines 2399–2406. is_array controls whether array_map('absint', ...) runs, whereas the later implode accepts any value after the cast. A string carrying SQL syntax can consequently remain text inside NOT IN (...). The short excerpt below omits sorting and the surrounding query conditions. It explains the type-dependent branch and is not a standalone vulnerability test.

if ( is_array( $query_vars['author__not_in'] ) ) {
    // array_map( 'absint', ... )
}
$author__not_in = implode( ',', (array) $query_vars['author__not_in'] );

To explain the consequence, continue to the consumer. Within the same class, $where enters the WHERE clause of the complete SELECT, stored in $this->request. Query branches subsequently execute it through $wpdb->get_col or get_results. The dangerous condition is controllable input reaching this construction path. Establishing anonymous HTTP reachability requires the additional caller analysis: which plugin, theme or core path passes which value into the query?

Scroll sideways to read the illustration.

The 7.0-branch fix, 74d37a3, routes the value through wp_parse_id_list. Its helper wp_parse_list splits comma- or whitespace-separated strings and filters non-scalar members from arrays. Members then undergo absint and deduplication. The caller checks that the list is nonempty, sorts it, joins integers into the query and writes the normalized list back to query variables. That also preserves a stable representation for equivalent queries whose inputs differ only in order or duplication.

The repaired helper converts values; it is not a strict validator that rejects every non-digit input. Negative values become positive, and the handling of a numeric-prefix string follows PHP's integer conversion. An application that must reject an invalid author identifier still needs its own input rule. Regression checks should cover arrays, comma-separated strings, whitespace, duplicates, empty lists and mixed members, inspect the resulting integer-only query fragment, and confirm that legitimate queries return the expected content. An error page from one hostile string only establishes failure of that request; it may never have reached this branch.

Known exploitation puts this core update near the front of the queue, while the combination of vulnerabilities defines the investigation's scope. The separate official advisory describes a REST batch-route interpretation conflict combined with the query flaw to reach code execution. This section traces the SQL-construction patch; it does not reimplement the complete exploit chain. Site maintainers should inspect enabled REST routes and custom query entry points. Developers should inspect wrappers accepting author__not_in, placing type normalization, authorization and business validation at explicit points.

Recovery consequently has two independent requirements: supported core code that passes the relevant business-query regression, and review of the exposed instance's files, accounts and publishing history. An update can repair query construction while modified themes, implanted files and stolen credentials need separate handling. Version 7.0.2 records the historical first fix. Security releases 7.0.3 and 7.0.4 followed, and the official default is now 7.1. Recovery media should reflect that current deployment decision.

5 ANGLE buffers remain in use after an object switch

ANGLE translates graphics API calls to platform graphics backends. Transform feedback writes shader outputs into buffers. A program may begin recording, pause, select another current object, and later resume. A paused object remains within its active lifecycle, and its output buffer remains in use. The old checks relied too heavily on bindings of the currently selected object, overlooking an active object that was no longer current. This is an object-state defect; the public advisory describes its potential consequence as a sandbox escape.

The new regression test gives the sequence concrete names. TF1 becomes active with B as its output buffer, then pauses. The program selects TF2, then binds the same B as GL_ARRAY_BUFFER. Selecting TF2 has not ended TF1. If the next validation considers only TF2, it may allow B to be reallocated, written or mapped despite that surviving activity. The critical transition is a change in the current object while the old object's use of the buffer continues. Checking the buffer's length or binding target alone cannot reconstruct the missing relationship.

Fix ee21230 links issue 492218546 from the public vulnerability record and adds an active count to Buffer. In TransformFeedback.cpp, lines 139–207, begin increments the count on bound buffers and end decrements it; pause changes only the paused flag. Buffer.h, lines 193–214, combines the existing simultaneous-binding conflict with the active-count check. B can now report active transform-feedback use even while TF1 is no longer current.

Scroll sideways to read the illustration.

Stored state matters only when actual entry points consume it. In validationES2.cpp, lines 3685–3709, validation obtains the target buffer and, for WebGL or hardened contexts, calls hasTFBBindingConflict(). A conflict produces GL_INVALID_OPERATION. The patch updates BufferSubData, mapping, copying and several other consumers, so the new state is used beyond one modification operation. The parent revision's validation uses the earlier binding-conflict check. The repair changes where the activity relationship is recorded and how multiple consumers enforce it; describing this as an added input filter loses the mechanism.

The added TransformFeedbackBufferModificationWhileNotCurrent test begins TF1, pauses it, binds TF2, and expects errors from glBufferData, glBufferSubData and glMapBufferRange. A separate ChangeBufferWhilePaused test preserves successful begin and draw, rejects modification during pause, then confirms that drawing succeeds after resume. One checks the non-current-object path; the other protects legitimate lifecycle behavior. Both are needed to explain what the patch is intended to preserve.

This is an analysis of source and upstream regression assertions. The complete ANGLE graphics backends were not run here, and no sandbox escape was reproduced. Chrome's advisory identifies versions before 150.0.7871.46 and assigns Chromium severity High; the 9.6 score in current CVE/NVD data comes from CISA ADP. Enterprise clients should complete their supported-channel update and restart, then check for old processes that remain online. Temporarily disabling WebGL can reduce a graphics entry point only if the policy actually applies to the target application, at the cost of features such as 3D visualization. It does not cover every native graphics path in that application.

For developers, the transferable review question is whether restrictions stored only on a current handle or request overlook objects still alive in the background. For asynchronous jobs, caches, file mappings and graphics resources, determine who owns an active relationship, which transition removes it, and whether all consumers read the same state. These are useful ownership and state-test questions. The mere existence of pause or switch operations in another system is insufficient to identify the same vulnerability.

6 Grouping changes the apparent lesson of the month

The earlier article emphasized that three cause families account for 61.8% of active records: authority and object binding, 2,449; memory and lifetime, 1,817; interpreter boundaries, 1,770. Those record-level classifications still produce the same arithmetic. Using them to prioritize an organization's engineering investment needs additional evidence. Remove Oracle's 1,108 records alone, and the remaining 8,655 have a different top three: memory 1,817, interpreter boundaries 1,761, and authority 1,615. Authority moves from first to third. One publisher's sample composition can change the ranking; annual engineering allocation also needs local code, assets, defects and incidents.

Recalculation by explicit vendor–product pairs shows further differences. Of 837 Linux records, 443 concern memory and 207 state or ordering. Of 487 Chrome records, 187 concern memory and 132 request or channel trust. A single CVE may mention several Windows versions, so product groups overlap. Summing them would double-count vulnerabilities. The attachment retains the exact product labels and within-group cause counts, without silently turning aliases into supposedly verified assets. It helps readers select the part relevant to their technology stack before inspecting the specific mechanisms.

Patch grouping requires stronger relationship evidence. Both WordPress identifiers were addressed in the 7.0.2 core release. On that branch, they can share an update action while retaining distinct affected conditions. Merging only this vendor-confirmed relation changes historical KEV from fourteen identifiers to thirteen groups. CVSS ≥ 9 covers nine groups and EPSS ≥ 0.10 covers eight; their four and five omitted identifiers remain unchanged. The other 9,761 records remain unpaired. This sensitivity check concerns one verified release relationship and supplies no estimate of the month's actual number of change tickets.

Oracle's quarterly CPU provides an update-program entry point. The July 21 cohort contains 1,097 Oracle records referencing it, across many products, components, branches and packages. A shared quarterly advisory cannot establish a single installation. The current July CPU page lists 1,448 new security patches; the previous article recorded 1,449. This revision uses the current page while leaving v1 bytes untouched. Follow the risk matrix and patch-availability documents for the installed product. Even two Coherence identifiers with identical descriptions establish only similarity in public text, not one shared root cause.

The distinction resembles problems examined in empirical research. The Attack of the Clones separates shared code, affected versions and actual installation state. Allodi's vulnerability-trade study distinguishes identifiers, exploit entries and shared packages. This article adopts the method of establishing the observation unit without borrowing effect sizes from those historical populations. SOSEC can measure public records and their relationships. An enterprise's repair burden also depends on instance counts, downtime, compatibility and rollback constraints.

The inclusion clock affects the total as well. We use CVE Program datePublished from July 1, 2026 at 00:00 UTC up to, but excluding, August 1 at 00:00 UTC, pinned at a373dbeddf97334f61e32d748cc24096303612ab. The identifier year can reflect assignment or publication and cannot simply be treated as the record's reservation date. The active July cohort contains 236 identifiers from before 2026; a CVE-2026-* filter would lose them. The historical NVD receipt window returned 9,919 records, 111 more; the original analysis placed their CVE Program publication dates outside July. Publication, database receipt, patch release and observed exploitation are separate events. Calendar proximity by itself establishes no causal relationship.

Review coverage also needs a precise scope. The v1 ledger preserves field-level review of every record and 9,763 cause classifications. It marks 377 records for additional primary-advisory, patch or source inspection; only fifteen are SOURCE_TRACED, while 5,084 are SPECIFIC_RECORD, 2,573 DESCRIPTION_SPECIFIC, 1,808 BROAD_RECORD and 283 undetermined. These labels reflect the available material and the earlier review judgments; they do not establish source-verified root causes for every entry. This revision adds three detailed source cases, regrouping and current-state checks without upgrading all historical labels. The 354 records lacking CVSS remain present, and missing scores are never treated as zero.

7 What to check after the update

Suppose you maintain a public TeamCity server, WordPress with a custom author filter, and Gitea for internal developers. All three need updates, but restoration requires different work. TeamCity calls for a review of build authority and altered outputs. WordPress calls for tracing external input into queries and checking site files and accounts. Gitea calls for comparing source fields across accounts while confirming dependency installation still works. Internal placement changes reachability; it does not remove the underlying permission error.

For the three source cases, the minimum acceptance conditions are distinct: authorized and unauthorized readers of the same package receive appropriately different source fields; equivalent author-ID inputs pass through one integer-normalization path while preserving correct business results; and, in WebGL or hardened contexts, buffer modification is rejected through active, paused and non-current states while legitimate resume still works. Application maintainers can perform the first two checks in an authorized test environment. ANGLE's source regression belongs with browser or embedded-graphics maintainers. Ordinary endpoint administrators verify the supported channel, package identity, actual restarted version and business pages, without sending vulnerability requests to public systems.

Cisco's 5.3 is the useful number to remember from this cohort: a high-score filter can omit an already-exploited management entry point. Known exploitation and local reachability belong in the repair order; the mechanism determines what to test after updating. Compatibility, compromise scope and recovery still require evidence from the actual installation. Those findings determine when service can resume and which investigations must remain open.