The LinkLoot Blog

Next.js patches July security flaws across App Router and Server Actions

Next.js released v16.2.11 and v15.5.21 to fix July 2026 security issues across App Router, Server Actions, middleware/proxy behavior, SSRF paths, image optimization, and cache handling.

7/22/2026 3 min

Node.js schedules HIGH-severity security releases for July 27

The Node.js project says security releases for the 26.x, 24.x, and 22.x lines are due on or shortly after July 27, 2026, with the highest severity rated HIGH.

CISA lists DD-WRT UPnP RCE as exploited with July 24 deadline

CISA added CVE-2021-27137 to KEV on July 21 after DD-WRT exploitation was tied to the C0XMO botnet, giving covered agencies until July 24 to mitigate affected firmware.

CISA puts WordPress wp2shell RCE in KEV with July 24 deadline

CISA now lists two WordPress Core wp2shell vulnerabilities as actively exploited, with a July 24 deadline for CVE-2026-63030 and an August 4 deadline for CVE-2026-60137.

CISA adds Langflow RCE to KEV with July 24 remediation deadline

CISA now lists CVE-2026-0770 as actively exploited, giving covered agencies until July 24 to mitigate a Langflow remote-code-execution flaw tied to the validate endpoint.

7/21/2026 5 min