Attackers Exploit VMware, WordPress Zero Days in New CVE Wave

THE CVE weekly roundup for July 27 to August 2, 2026, reports 2,077 new vulnerabilities, including 273 rated as Critical and 624 as High. Notable vulnerabilities include CVE-2026-16812 (VMware VeloCloud Orchestrator) and CVE-2026-18072 (WordPress ARVE Plugin), both with CVSS scores of 10.0 and confirmed exploitation in the wild. CISA added three entries to its Known Exploited Vulnerabilities list, highlighting four active threats. Recommendations include patching CISA KEV entries, removing compromised WordPress plugins, and upgrading Apache Traffic Server.