2026 CVE Vulnerabilities
60,206 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-12969 | MEDIUM | 5.3 | 0.4% | Jun 23, 2026 | An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section re... |
| CVE-2026-11772 | MEDIUM | 5.1 | 0.4% | Jun 23, 2026 | DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can prepare an URL that... |
| CVE-2026-10609 | MEDIUM | 6.8 | 0.2% | Jun 23, 2026 | A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards Serv... |
| CVE-2026-56784 | HIGH | 8.6 | 0.3% | Jun 23, 2026 | OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion en... |
| CVE-2026-56762 | MEDIUM | 6.9 | 0.2% | Jun 23, 2026 | Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigne... |
| CVE-2026-56701 | HIGH | 7.1 | 0.2% | Jun 23, 2026 | Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allo... |
| CVE-2026-56379 | CRITICAL | 9.2 | 0.9% | Jun 23, 2026 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows atta... |
| CVE-2026-56376 | LOW | 3.3 | 0.2% | Jun 23, 2026 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails... |
| CVE-2026-56371 | MEDIUM | 5.3 | 0.2% | Jun 23, 2026 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture ... |
| CVE-2026-56322 | HIGH | 8.7 | 0.3% | Jun 23, 2026 | Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that res... |
| CVE-2026-56315 | CRITICAL | 9.8 | 0.8% | Jun 23, 2026 | picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _ai... |
| CVE-2026-56301 | MEDIUM | 6.8 | 0.1% | Jun 23, 2026 | Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vit... |
| CVE-2026-56275 | HIGH | 7.1 | 0.2% | Jun 23, 2026 | Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers... |
| CVE-2026-56274 | CRITICAL | 9.9 | 2.7% | Jun 23, 2026 | Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to inco... |
| CVE-2026-56263 | MEDIUM | 6.1 | 0.2% | Jun 23, 2026 | Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl U... |
| CVE-2026-56258 | CRITICAL | 9.2 | 0.7% | Jun 23, 2026 | Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows una... |
| CVE-2026-56248 | HIGH | 8.7 | 0.4% | Jun 23, 2026 | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from t... |
| CVE-2026-56243 | HIGH | 8.6 | 0.3% | Jun 23, 2026 | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext A... |
| CVE-2026-56234 | MEDIUM | 6.9 | 0.2% | Jun 23, 2026 | Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password... |
| CVE-2026-56225 | HIGH | 8.7 | 0.3% | Jun 23, 2026 | Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/... |
| CVE-2026-56222 | HIGH | 8.6 | 0.4% | Jun 23, 2026 | Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify... |
| CVE-2026-54892 | HIGH | 8.7 | 0.7% | Jun 23, 2026 | Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause... |
| CVE-2026-4610 | MEDIUM | 6.4 | 0.2% | Jun 23, 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... |
| CVE-2026-44089 | CRITICAL | 9.4 | 0.2% | Jun 23, 2026 | Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. Thi... |
| CVE-2026-10857 | MEDIUM | 6.1 | 0.1% | Jun 23, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in AKIN Software Comp... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now