2026 CVE Vulnerabilities
45,001 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-45793 | HIGH | 7.5 | — | Jul 15, 2026 | Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConf... |
| CVE-2026-20187 | HIGH | 7.5 | 0.3% | Jul 15, 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has c... |
| CVE-2026-20158 | HIGH | 7.5 | 0.3% | Jul 15, 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has c... |
| CVE-2026-20153 | HIGH | 7.5 | 0.3% | Jul 15, 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has c... |
| CVE-2026-20150 | HIGH | 8.8 | 0.2% | Jul 15, 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has c... |
| CVE-2026-62685 | HIGH | 8.1 | 0.3% | Jul 15, 2026 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec... |
| CVE-2026-61828 | HIGH | 8.5 | — | Jul 15, 2026 | Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and ... |
| CVE-2026-61371 | HIGH | 7.5 | — | Jul 15, 2026 | Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/... |
| CVE-2026-60005 | HIGH | 8.2 | 0.7% | Jul 15, 2026 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and ... |
| CVE-2026-55242 | HIGH | 8.8 | — | Jul 15, 2026 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated use... |
| CVE-2026-50147 | HIGH | 7.6 | 0.2% | Jul 15, 2026 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.... |
| CVE-2026-47164 | HIGH | 7.7 | — | Jul 15, 2026 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the ... |
| CVE-2026-47158 | HIGH | 8.3 | — | Jul 15, 2026 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did ... |
| CVE-2026-46709 | HIGH | 7.8 | 0.2% | Jul 15, 2026 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths... |
| CVE-2026-45806 | HIGH | 7.7 | 0.4% | Jul 15, 2026 | Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import pa... |
| CVE-2026-45805 | HIGH | 8.8 | — | Jul 15, 2026 | Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/serve... |
| CVE-2026-61836 | HIGH | 8.6 | 0.3% | Jul 15, 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching ... |
| CVE-2026-61835 | HIGH | 7.7 | 0.3% | Jul 15, 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on... |
| CVE-2026-61684 | HIGH | 8.8 | — | Jul 15, 2026 | FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT plugin invoke reverse-call endpoints unde... |
| CVE-2026-61644 | HIGH | 7.7 | — | Jul 15, 2026 | FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/ge... |
| CVE-2026-61613 | HIGH | 7.7 | 0.4% | Jul 15, 2026 | Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Curso... |
| CVE-2026-59762 | HIGH | 8.7 | 0.5% | Jul 15, 2026 | When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource ... |
| CVE-2026-56434 | HIGH | 8.3 | 0.4% | Jul 15, 2026 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist wh... |
| CVE-2026-55723 | HIGH | 8.7 | 0.3% | Jul 15, 2026 | When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection... |
| CVE-2026-54563 | HIGH | 7.1 | — | Jul 15, 2026 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a c... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now