# What your agent missed in July 2026

In July 2026, CISA added 4 actively exploited vulnerabilities in web-stack software to its Known Exploited Vulnerabilities catalog, GitHub published 6 critical advisories for widely used npm and PyPI packages and 2 release lines reached end of life.

The ones to know first:

- **Jul 21, 2026**: CVE-2026-60137 added to CISA’s exploited list (WordPress). WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137)
- **Jul 23, 2026**: next-auth: configuration errors can cause existence-based auth checks to fail open (critical). [GitHub Advisory Database](https://github.com/advisories/GHSA-8fpg-xm3f-6cx3)
- **Jul 31, 2026**: Nuxt 3 reached end of life. No more security fixes. Latest: Nuxt 4. [endoflife.date](https://endoflife.date/nuxt)

## Exploited in the wild (4)

- **Jul 21, 2026**: CVE-2026-60137 added to CISA’s exploited list (WordPress). WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137)
- **Jul 21, 2026**: CVE-2026-63030 added to CISA’s exploited list (WordPress). WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030)
- **Jul 21, 2026**: CVE-2026-0770 added to CISA’s exploited list (Langflow). Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected… [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770)
- **Jul 7, 2026**: CVE-2026-55255 added to CISA’s exploited list (Langflow). Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user… [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255)

## Critical advisories (6)

- **Jul 31, 2026**: sentence-transformers: sentence-transformers local model loading bypasses trust\_remote\_code… (critical). Fixed in 5.6.0. [GitHub Advisory Database](https://github.com/advisories/GHSA-jhr6-gm9c-rqjv)
- **Jul 24, 2026**: seroval: seroval.fromJSON() Promise resolver type confusion invokes… (critical). Fixed in 1.5.3. [GitHub Advisory Database](https://github.com/advisories/GHSA-mv8w-475r-vwqw)
- **Jul 23, 2026**: next-auth: configuration errors can cause existence-based auth checks to fail open (critical). [GitHub Advisory Database](https://github.com/advisories/GHSA-8fpg-xm3f-6cx3)
- **Jul 23, 2026**: @auth/core: email normalizer validates the address before Unicode normalization (critical). Fixed in 0.41.3. [GitHub Advisory Database](https://github.com/advisories/GHSA-7rqj-j65f-68wh)
- **Jul 20, 2026**: tar: Decompression/parse DoS via unlimited input (critical). Fixed in 7.5.19. [GitHub Advisory Database](https://github.com/advisories/GHSA-23hp-3jrh-7fpw)
- **Jul 7, 2026**: better-auth: OAuth refresh-token replay (critical). Fixed in 1.6.11. [GitHub Advisory Database](https://github.com/advisories/GHSA-pw9m-5jxm-xr6h)

## Reached end of life (2)

- **Jul 31, 2026**: Nuxt 3 reached end of life. No more security fixes. Latest: Nuxt 4. [endoflife.date](https://endoflife.date/nuxt)
- **Jul 31, 2026**: MongoDB 8.2 reached end of life. No more security fixes. Latest: MongoDB 9.0. [endoflife.date](https://endoflife.date/mongodb)

## Which models can’t know this

Every model below has a knowledge cutoff before July 2026, so it can’t know about any of this unless a tool gives it live data.

- Claude Fable 5.1 (Anthropic): June 2026
- Claude Haiku 5.5 (Anthropic): June 2026
- Claude Opus 5.5 (Anthropic): June 2026
- Claude Sonnet 5.5 (Anthropic): June 2026
- Claude Opus 5 (Anthropic): May 2026
- Grok 4.7 (xAI): May 2026
- GPT-6 Luna (OpenAI): May 18, 2026
- GPT-6 Astra (OpenAI): April 30, 2026
- GPT-6.1 Sol (OpenAI): April 30, 2026
- GPT-6 Sol (OpenAI): April 20, 2026
- Gemini 3.8 Flash (Google): March 2026
- Gemini 4 Argon (Google): March 2026
- GPT-5.6 Sol (OpenAI): February 16, 2026
- Claude Fable 5 (Anthropic): January 2026
- Claude Opus 4.7 (Anthropic): January 2026
- Claude Opus 4.8 (Anthropic): January 2026
- Claude Sonnet 5 (Anthropic): January 2026
- Grok 4.6 (xAI): January 2026
- MAI-Code-1.1-Flash (Microsoft): December 2025
- GPT-5.5 (OpenAI): December 1, 2025
- Claude Sonnet 4.6 (Anthropic): August 2025
- GPT-5.3-Codex (OpenAI): August 31, 2025
- GPT-5.4 (OpenAI): August 31, 2025
- GPT-5.4 Mini (OpenAI): August 31, 2025
- Claude Opus 4.5 (Anthropic): May 2025
- Claude Opus 4.6 (Anthropic): May 2025
- Claude Haiku 4.5 (Anthropic): February 2025
- Claude Sonnet 4.5 (Anthropic): January 2025
- Gemini 2.5 Flash (Google): January 2025
- Gemini 2.5 Pro (Google): January 2025
- Gemini 3 Flash (Google): January 2025
- Gemini 3.1 Pro (Google): January 2025
- GPT-5 (OpenAI): September 30, 2024
- GPT-5-Codex (OpenAI): September 30, 2024
- GPT-5.1 (OpenAI): September 30, 2024
- Llama 4 Maverick (Meta): August 2024
- GPT-4.1 (OpenAI): June 1, 2024
- o3 (OpenAI): June 1, 2024
- GPT-5 Mini (OpenAI): May 31, 2024
- GPT-4o (OpenAI): October 1, 2023

---

Checked Oct 17, 2026 against [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [GitHub Advisory Database](https://github.com/advisories) and [endoflife.date](https://endoflife.date). Full report: https://stackprism.ai/reports/2026-07