StackPrism

Monthly report

What your agent missed in July 2026

In July 2026, CISA added 4 actively exploited vulnerabilities in web-stack software to its Known Exploited Vulnerabilities catalog, GitHub published 6 critical advisories for widely used npm and PyPI packages and 2 release lines reached end of life.

  • 4Exploited in the wild
  • 6Critical advisories
  • 2Reached end of life
  • 0New release lines

The ones to know first

The most widely used software among this month’s items, one of each kind.

  • CVE-2026-60137 added to CISA’s exploited list (WordPress)

    WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter.

    , CISA KEV

  • next-auth: configuration errors can cause existence-based auth checks to fail open (critical)

    , GitHub Advisory Database

  • Nuxt 3 reached end of life

    No more security fixes. Latest: Nuxt 4.

    , endoflife.date

Everything in July 2026

Exploited in the wild4

  • CVE-2026-60137 added to CISA’s exploited list (WordPress)

    WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter.

    , CISA KEV

  • CVE-2026-63030 added to CISA’s exploited list (WordPress)

    WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

    , CISA KEV

  • CVE-2026-0770 added to CISA’s exploited list (Langflow)

    Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected…

    , CISA KEV

  • CVE-2026-55255 added to CISA’s exploited list (Langflow)

    Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user…

    , CISA KEV

Critical advisories6

  • sentence-transformers: sentence-transformers local model loading bypasses trust_remote_code… (critical)

    Fixed in 5.6.0.

    , GitHub Advisory Database

  • seroval: seroval.fromJSON() Promise resolver type confusion invokes… (critical)

    Fixed in 1.5.3.

    , GitHub Advisory Database

  • next-auth: configuration errors can cause existence-based auth checks to fail open (critical)

    , GitHub Advisory Database

  • @auth/core: email normalizer validates the address before Unicode normalization (critical)

    Fixed in 0.41.3.

    , GitHub Advisory Database

  • tar: Decompression/parse DoS via unlimited input (critical)

    Fixed in 7.5.19.

    , GitHub Advisory Database

  • better-auth: OAuth refresh-token replay (critical)

    Fixed in 1.6.11.

    , GitHub Advisory Database

Reached end of life2

  • Nuxt 3 reached end of life

    No more security fixes. Latest: Nuxt 4.

    , endoflife.date

  • MongoDB 8.2 reached end of life

    No more security fixes. Latest: MongoDB 9.0.

    , endoflife.date

Which models can’t know this

Every model in our cutoff table has a knowledge cutoff before July 2026, so none of them knows about any of this unless a tool gives it live data.

Anthropic

xAI

OpenAI

Google

Microsoft

Meta

Last checked against CISA KEV, GitHub Advisory Database and endoflife.date.

What counts: vulnerabilities CISA confirms are exploited, in software web apps commonly run; critical GitHub advisories on widely used npm and PyPI packages; and release lines of popular runtimes, frameworks and databases reaching end of life or shipping. Also as Markdown.