2026 CVE Vulnerabilities
42,999 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-66878 | HIGH | 7.7 | — | Aug 12, 2026 | A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable... |
| CVE-2026-6484 | HIGH | 8.2 | — | Aug 12, 2026 | In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution. |
| CVE-2026-73249 | HIGH | 7.5 | — | Aug 11, 2026 | calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{librar... |
| CVE-2026-73248 | HIGH | 8.5 | — | Aug 11, 2026 | calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a ... |
| CVE-2026-73247 | HIGH | 8.6 | — | Aug 11, 2026 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/cor... |
| CVE-2026-73246 | HIGH | 7.5 | — | Aug 11, 2026 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kest... |
| CVE-2026-67558 | HIGH | 8.2 | — | Aug 11, 2026 | The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match aga... |
| CVE-2026-66875 | HIGH | 8.8 | — | Aug 11, 2026 | In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range... |
| CVE-2026-66098 | HIGH | 7.1 | — | Aug 11, 2026 | The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the d... |
| CVE-2026-29036 | HIGH | 7.5 | — | Aug 11, 2026 | cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointe... |
| CVE-2026-19560 | HIGH | 8.8 | — | Aug 11, 2026 | Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code ins... |
| CVE-2026-19558 | HIGH | 7.5 | — | Aug 11, 2026 | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to instal... |
| CVE-2026-19557 | HIGH | 8.3 | — | Aug 11, 2026 | Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised... |
| CVE-2026-19556 | HIGH | 8.8 | — | Aug 11, 2026 | Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside... |
| CVE-2026-18710 | HIGH | 8.2 | — | Aug 11, 2026 | A MongoDB driver component could write sensitive configuration information, including a credential used for outbound net... |
| CVE-2026-66154 | HIGH | 8.3 | 0.1% | Aug 11, 2026 | An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1... |
| CVE-2026-66150 | HIGH | 7.8 | — | Aug 11, 2026 | Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows... |
| CVE-2026-66149 | HIGH | 7.8 | — | Aug 11, 2026 | Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows... |
| CVE-2026-63177 | HIGH | 7.1 | — | Aug 11, 2026 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Ng... |
| CVE-2026-55676 | HIGH | 8.8 | — | Aug 11, 2026 | Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `P... |
| CVE-2026-48763 | HIGH | 8.2 | — | Aug 11, 2026 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/t... |
| CVE-2026-15606 | HIGH | 8.8 | — | Aug 11, 2026 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i... |
| CVE-2026-14863 | HIGH | 8.8 | — | Aug 11, 2026 | FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated at... |
| CVE-2026-73242 | HIGH | 8.3 | — | Aug 11, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos... |
| CVE-2026-73241 | HIGH | 8.3 | — | Aug 11, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreer... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now