2026 CVE Vulnerabilities
60,200 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-44961 | NONE | 0 | 0.3% | Jun 23, 2026 | The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users ... |
| CVE-2026-44960 | NONE | 0 | 0.3% | Jun 23, 2026 | A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user viewed the audit log d... |
| CVE-2026-44959 | HIGH | 8.8 | 0.4% | Jun 23, 2026 | A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑p... |
| CVE-2026-44958 | MEDIUM | 5.4 | 0.3% | Jun 23, 2026 | An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and... |
| CVE-2026-44957 | MEDIUM | 4.3 | 0.2% | Jun 23, 2026 | A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earl... |
| CVE-2026-44956 | NONE | 0 | 0.3% | Jun 23, 2026 | Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is included in system‑gener... |
| CVE-2026-44792 | CRITICAL | 9 | 0.3% | Jun 23, 2026 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access... |
| CVE-2026-44791 | CRITICAL | 9.9 | 0.6% | Jun 23, 2026 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with pe... |
| CVE-2026-44790 | HIGH | 8.8 | 0.6% | Jun 23, 2026 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with pe... |
| CVE-2026-44789 | CRITICAL | 9.9 | 0.6% | Jun 23, 2026 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with pe... |
| CVE-2026-42867 | MEDIUM | 6.5 | 0.3% | Jun 23, 2026 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to... |
| CVE-2026-34917 | MEDIUM | 4.3 | 0.3% | Jun 23, 2026 | Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication ... |
| CVE-2026-34916 | HIGH | 8.8 | 0.4% | Jun 23, 2026 | A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a l... |
| CVE-2026-34915 | MEDIUM | 6.1 | 0.2% | Jun 23, 2026 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a l... |
| CVE-2026-34914 | HIGH | 8.3 | 0.3% | Jun 23, 2026 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileg... |
| CVE-2026-34913 | MEDIUM | 4.3 | 0.2% | Jun 23, 2026 | A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Ads... |
| CVE-2026-34912 | MEDIUM | 4.3 | 0.2% | Jun 23, 2026 | A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive... |
| CVE-2026-33760 | HIGH | 8.8 | 0.2% | Jun 23, 2026 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monito... |
| CVE-2026-13007 | HIGH | 7.5 | 0.4% | Jun 23, 2026 | Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive applicati... |
| CVE-2026-12958 | HIGH | 8.5 | 0.1% | Jun 23, 2026 | Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust ... |
| CVE-2026-12957 | HIGH | 8.5 | 0.1% | Jun 23, 2026 | Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may all... |
| CVE-2026-11940 | HIGH | 7.8 | 0.8% | Jun 23, 2026 | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink reference... |
| CVE-2026-56696 | MEDIUM | 5.4 | 0.2% | Jun 23, 2026 | OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel sende... |
| CVE-2026-56695 | HIGH | 7.1 | 0.2% | Jun 23, 2026 | OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote ... |
| CVE-2026-56694 | MEDIUM | 5.4 | 0.2% | Jun 23, 2026 | NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where hand... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now