# CVEs published 2026-07-26

15 CVEs were published on July 26, 2026: 1 critical, 7 high. Days are UTC.

- [CVE-2026-57990](https://cve.now/CVE-2026-57990.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 7.4, Microsoft Edge)
- [CVE-2026-57989](https://cve.now/CVE-2026-57989.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 7.4, Microsoft Edge)
- [CVE-2026-57978](https://cve.now/CVE-2026-57978.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-17497](https://cve.now/CVE-2026-17497.md): NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python (CVSS 8.3, codexu NoteGen)
- [CVE-2026-17496](https://cve.now/CVE-2026-17496.md): NoteGen chat preview XSS via unsanitized AI/skill HTML rendering (CVSS 8.1, codexu NoteGen)
- [CVE-2026-17459](https://cve.now/CVE-2026-17459.md): perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink (CVSS 5.3, perwendel spark)
- [CVE-2026-17458](https://cve.now/CVE-2026-17458.md): mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery (CVSS 5.3, mf-yang openclaw-cn)
- [CVE-2026-17457](https://cve.now/CVE-2026-17457.md): mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure (CVSS 5.3, mf-yang openclaw-cn)
- [CVE-2024-14040](https://cve.now/CVE-2024-14040.md): net: nexthop: Increase weight to u16 (CVSS 7.8, Linux)
- [CVE-2026-64530](https://cve.now/CVE-2026-64530.md): net/sched: cls\_api: Handle TC\_ACT\_CONSUMED in tcf\_qevent\_handle (CVSS 9.8, Linux)
- [CVE-2026-63720](https://cve.now/CVE-2026-63720.md): datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field (CVSS 7.5, koxudaxi datamodel-code-generator)
- [CVE-2026-17434](https://cve.now/CVE-2026-17434.md): nanocoai NanoClaw add\_mcp\_server request.ts handleAddMcpServer improper authorization (CVSS 5.3, nanocoai NanoClaw)
- [CVE-2026-17433](https://cve.now/CVE-2026-17433.md): nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization (CVSS 4.8, nanocoai NanoClaw)
- [CVE-2026-15962](https://cve.now/CVE-2026-15962.md): Fluent Forms Pro Add On Pack \<= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field (CVSS 8.8, techjewel Fluent Forms Pro Add On Pack)
- [CVE-2026-17432](https://cve.now/CVE-2026-17432.md): NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control (CVSS 2.3, NousResearch hermes-agent)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.