CVE Weekly Roundup: July 27 – August 2, 2026

Weekly CVE roundup (July 27–Aug 2, 2026) reporting 2,077 new vulnerabilities — 273 Critical, 624 High, and 14 CVSS 10.0 entries — with notable issues including Apache Traffic Server CVSS 10.0 bugs, an Azure Cosmos DB code‑execution flaw, and an Adobe Campaign Classic bypass. The report lists four confirmed actively exploited threats (including VMware VeloCloud Orchestrator and a WordPress ARVE plugin supply‑chain backdoor), and recommends immediate patching of CISA KEV items, removal or downgrade of the compromised ARVE release, and upgrades for affected Apache Traffic Server and other products.