# july 2026

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for july 2026, painted from 9,759 published cves](https://media.cvegen.art/posters/2026-07/1280.jpg?v=8040130723)

what the poster shows: 31 days as bands of dry brush, the first day at the top. 29 ran above the 2025 average for their weekday and sweep fast and wide; the other 2 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2026-07.mp4?v=355dede1a6)

| fact | value |
| --- | --- |
| cves | 9,759 |
| against an average 2025 month | 2.4× |
| busiest day | jul 21, 1,474 |
| rated critical, cvss 9 or higher | 1,298 |
| critical with no login and no click | 952 |
| used in real attacks | 21 |

## july 2026 in numbers

july 2026 brought 9,759 cves, 2.4 times an average 2025 month. 29 of its 31 days ran above the 2025 average for that weekday.

- 1,474 on jul 21, the busiest day. oracle published 1,097 of them at once.
- 1,298 rated critical, cvss 9 or higher. 952 of them can be hit over the network with no login and nothing for a user to click.
- 620 in browsers, 14 times their 2025 monthly average. no other kind of software grew as fast.
- 2,096 came in three single drops: oracle 1,097 on jul 21, microsoft 570 on jul 14, the linux kernel team 429 on jul 19.

## 21 already used in real attacks

cisa kev, as of oct 24.

### by product

- 3 microsoft sharepoint, jul 14
- 2 sonicwall sma1000 appliances, jul 14
- 2 wordpress core, jul 17
- 1 linux kernel, jul 4
- 1 berriai litellm, jul 8
- 1 balbooa forms, jul 9
- 1 microsoft active directory federation services, jul 14
- 1 microsoft sharepoint server, jul 14
- 1 dd-wrt, jul 16
- 1 ibm langflow, jul 17
- 1 sangoma switchvox, jul 17
- 1 check point smartconsole, jul 22
- 1 arista velocloud orchestrator, jul 27
- 1 jetbrains teamcity, jul 27
- 1 jfrog artifactory, jul 27
- 1 cisco secure firewall management center, jul 29
- 1 broadcom vmware vcenter, jul 30

### every cve

- jul 4, linux kernel, [cve-2026-53362](https://www.cve.org/CVERecord?id=CVE-2026-53362)
- jul 8, berriai litellm, [cve-2026-59822](https://www.cve.org/CVERecord?id=CVE-2026-59822)
- jul 9, balbooa forms, [cve-2026-56291](https://www.cve.org/CVERecord?id=CVE-2026-56291)
- jul 14, sonicwall sma1000 appliances, [cve-2026-15409](https://www.cve.org/CVERecord?id=CVE-2026-15409)
- jul 14, sonicwall sma1000 appliances, [cve-2026-15410](https://www.cve.org/CVERecord?id=CVE-2026-15410)
- jul 14, microsoft sharepoint, [cve-2026-50522](https://www.cve.org/CVERecord?id=CVE-2026-50522)
- jul 14, microsoft sharepoint, [cve-2026-55040](https://www.cve.org/CVERecord?id=CVE-2026-55040)
- jul 14, microsoft active directory federation services, [cve-2026-56155](https://www.cve.org/CVERecord?id=CVE-2026-56155)
- jul 14, microsoft sharepoint server, [cve-2026-56164](https://www.cve.org/CVERecord?id=CVE-2026-56164)
- jul 14, microsoft sharepoint, [cve-2026-58644](https://www.cve.org/CVERecord?id=CVE-2026-58644)
- jul 16, dd-wrt dd-wrt, [cve-2021-27137](https://www.cve.org/CVERecord?id=CVE-2021-27137)
- jul 17, wordpress core, [cve-2026-60137](https://www.cve.org/CVERecord?id=CVE-2026-60137)
- jul 17, wordpress core, [cve-2026-63030](https://www.cve.org/CVERecord?id=CVE-2026-63030)
- jul 17, ibm langflow, [cve-2026-9198](https://www.cve.org/CVERecord?id=CVE-2026-9198)
- jul 17, sangoma switchvox, [cve-2026-9586](https://www.cve.org/CVERecord?id=CVE-2026-9586)
- jul 22, check point smartconsole, [cve-2026-16232](https://www.cve.org/CVERecord?id=CVE-2026-16232)
- jul 27, arista velocloud orchestrator, [cve-2026-16812](https://www.cve.org/CVERecord?id=CVE-2026-16812)
- jul 27, jfrog artifactory, [cve-2026-42016](https://www.cve.org/CVERecord?id=CVE-2026-42016)
- jul 27, jetbrains teamcity, [cve-2026-63077](https://www.cve.org/CVERecord?id=CVE-2026-63077)
- jul 29, cisco secure firewall management center (fmc), [cve-2026-20316](https://www.cve.org/CVERecord?id=CVE-2026-20316)
- jul 30, broadcom vmware vcenter, [cve-2026-59310](https://www.cve.org/CVERecord?id=CVE-2026-59310)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | july 1 to 31, 2026 |
| cves | 9,759 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2026-07/2000.jpg?v=8040130723)

## other months

- before: [june 2026](https://cvegen.art/2026/06.md), 7,949 cves
- after: [august 2026](https://cvegen.art/2026/08.md), 12,260 cves
- [all months](https://cvegen.art/index.md)