cvegen

july 2026

cves
9,759
against an average 2025 month
2.4×
busiest day
jul 21, 1,474
used in real attacks
21

july 2026 brought 9,759 cves, 2.4 times an average 2025 month.

29 of its 31 days ran above the 2025 average for that weekday.

1,474

on jul 21, the busiest day. oracle published 1,097 of them at once.

1,298

rated critical, cvss 9 or higher. 952 of them can be hit over the network with no login and nothing for a user to click.

620

in browsers, 14 times their 2025 monthly average. no other kind of software grew as fast.

2,096

came in three single drops: oracle 1,097 on jul 21, microsoft 570 on jul 14, the linux kernel team 429 on jul 19.

21 already used in real attacks

cisa kev, as of oct 24

  • 3
    microsoft sharepoint
    jul 14
  • 2
    sonicwall sma1000 appliances
    jul 14
  • 2
    wordpress core
    jul 17
  • 1
    linux kernel
    jul 4
  • 1
    berriai litellm
    jul 8
  • 1
    balbooa forms
    jul 9
  • 1
    microsoft active directory federation services
    jul 14
  • 1
    microsoft sharepoint server
    jul 14
  • 1
    dd-wrt
    jul 16
  • 1
    ibm langflow
    jul 17
and 7 more productsall 21 with cve ids

cisa keeps adding older cves when attacks come to light, so this list can still grow.

this poster

period
july 1 to 31, 2026
cves
9,759
data
cve list v5, cisa kev, drawn 2026-10-24
format
3:4, drawn for 45 × 60 cm
download jpg, 2000 × 2667