2026 CVE Vulnerabilities
64,678 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-8140 | MEDIUM | 6.5 | 0.1% | May 21, 2026 | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/down... |
| CVE-2026-8135 | HIGH | 7.2 | 0.5% | May 21, 2026 | Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the Ex... |
| CVE-2026-8134 | HIGH | 7.2 | 0.7% | May 21, 2026 | Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTempl... |
| CVE-2026-6826 | MEDIUM | 5.3 | 0.3% | May 21, 2026 | Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the... |
| CVE-2026-47102 | HIGH | 8.8 | 0.7% | May 21, 2026 | LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint c... |
| CVE-2026-47101 | HIGH | 8.8 | 0.7% | May 21, 2026 | LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role ... |
| CVE-2026-4843 | MEDIUM | 4.3 | 0.2% | May 21, 2026 | The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability ... |
| CVE-2026-47114 | HIGH | 8.8 | 0.7% | May 21, 2026 | IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbit... |
| CVE-2026-46473 | HIGH | 7.5 | 0.4% | May 21, 2026 | Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in r... |
| CVE-2026-48249 | HIGH | 8.2 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT... |
| CVE-2026-48248 | HIGH | 8.2 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIF... |
| CVE-2026-48247 | HIGH | 8.2 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_V... |
| CVE-2026-48246 | HIGH | 8.2 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYP... |
| CVE-2026-48245 | MEDIUM | 6.9 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public sou... |
| CVE-2026-48244 | MEDIUM | 6.9 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the publ... |
| CVE-2026-48243 | MEDIUM | 6.9 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the ... |
| CVE-2026-48242 | CRITICAL | 9.2 | 0.3% | May 21, 2026 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, data... |
| CVE-2026-48241 | CRITICAL | 9.2 | 0.3% | May 21, 2026 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database ut... |
| CVE-2026-48240 | HIGH | 7.1 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_ti... |
| CVE-2026-48239 | HIGH | 7.1 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parame... |
| CVE-2026-48238 | HIGH | 7.1 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET paramete... |
| CVE-2026-48237 | HIGH | 7.1 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_re... |
| CVE-2026-48236 | HIGH | 7.1 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST paramete... |
| CVE-2026-48235 | HIGH | 8.8 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude... |
| CVE-2026-48234 | HIGH | 7.1 | 0.2% | May 21, 2026 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort a... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now