2026 CVE Vulnerabilities
45,269 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-56279 | HIGH | 8.7 | — | Jul 10, 2026 | Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that rema... |
| CVE-2026-56261 | HIGH | 7.5 | 0.4% | Jul 10, 2026 | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job ... |
| CVE-2026-56254 | HIGH | 8.3 | — | Jul 10, 2026 | In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key... |
| CVE-2026-38059 | HIGH | 8.7 | — | Jul 10, 2026 | The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated atta... |
| CVE-2026-38057 | HIGH | 8.1 | — | Jul 10, 2026 | The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot en... |
| CVE-2026-29519 | HIGH | 8.2 | 0.4% | Jul 10, 2026 | Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site script... |
| CVE-2026-22660 | HIGH | 8.6 | 0.3% | Jul 10, 2026 | FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administra... |
| CVE-2026-22659 | HIGH | 8.1 | 0.3% | Jul 10, 2026 | FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated... |
| CVE-2026-54469 | HIGH | 8.8 | 0.4% | Jul 10, 2026 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability... |
| CVE-2026-56690 | HIGH | 8.5 | 0.2% | Jul 10, 2026 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an S... |
| CVE-2026-56689 | HIGH | 7.7 | 0.2% | Jul 10, 2026 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an S... |
| CVE-2026-41879 | HIGH | 8.2 | 0.3% | Jul 10, 2026 | R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password... |
| CVE-2026-41878 | HIGH | 7.1 | 0.5% | Jul 10, 2026 | R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The appl... |
| CVE-2026-41876 | HIGH | 8.7 | 1.2% | Jul 10, 2026 | R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell co... |
| CVE-2026-40454 | HIGH | 7.5 | 0.1% | Jul 10, 2026 | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++... |
| CVE-2026-40452 | HIGH | 7.5 | 0.1% | Jul 10, 2026 | Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLas... |
| CVE-2026-40007 | HIGH | 7.5 | 0.1% | Jul 10, 2026 | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enab... |
| CVE-2026-40006 | HIGH | 7.5 | 0.2% | Jul 10, 2026 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authenticatio... |
| CVE-2026-13347 | HIGH | 7.5 | 0.5% | Jul 10, 2026 | The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via th... |
| CVE-2026-12685 | HIGH | 7.5 | 0.1% | Jul 10, 2026 | The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that let... |
| CVE-2026-21055 | HIGH | 8.5 | 0.1% | Jul 10, 2026 | Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute a... |
| CVE-2026-21049 | HIGH | 8.4 | 0.1% | Jul 10, 2026 | Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary co... |
| CVE-2026-21048 | HIGH | 8.3 | 0.4% | Jul 10, 2026 | Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote ... |
| CVE-2026-21046 | HIGH | 8.4 | 0.1% | Jul 10, 2026 | Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privil... |
| CVE-2026-21045 | HIGH | 8.3 | 0.4% | Jul 10, 2026 | Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now