2026 CVE Vulnerabilities
46,825 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-8609 | HIGH | 7.5 | 0.4% | Jul 10, 2026 | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory... |
| CVE-2026-56676 | HIGH | 7.4 | 0.2% | Jul 10, 2026 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetchin... |
| CVE-2026-55501 | HIGH | 7.3 | — | Jul 10, 2026 | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js... |
| CVE-2026-54149 | HIGH | 8.8 | — | Jul 10, 2026 | MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/... |
| CVE-2026-54001 | HIGH | 7 | 0.1% | Jul 10, 2026 | osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Wind... |
| CVE-2026-54000 | HIGH | 7 | 0.1% | Jul 10, 2026 | osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Wind... |
| CVE-2026-33382 | HIGH | 7.5 | 0.4% | Jul 10, 2026 | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing... |
| CVE-2026-61455 | HIGH | 7.1 | — | Jul 10, 2026 | Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompresse... |
| CVE-2026-61450 | HIGH | 7.1 | — | Jul 10, 2026 | Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to writ... |
| CVE-2026-61441 | HIGH | 7.1 | — | Jul 10, 2026 | PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE de... |
| CVE-2026-61437 | HIGH | 8.5 | 0.1% | Jul 10, 2026 | PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFl... |
| CVE-2026-61434 | HIGH | 8.8 | — | Jul 10, 2026 | PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attack... |
| CVE-2026-60091 | HIGH | 7.2 | — | Jul 10, 2026 | PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/ru... |
| CVE-2026-59796 | HIGH | 8.1 | 0.2% | Jul 10, 2026 | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks |
| CVE-2026-59793 | HIGH | 8.8 | 0.3% | Jul 10, 2026 | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration |
| CVE-2026-56335 | HIGH | 7.1 | — | Jul 10, 2026 | Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate pro... |
| CVE-2026-56305 | HIGH | 8.7 | 0.4% | Jul 10, 2026 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attack... |
| CVE-2026-56279 | HIGH | 8.7 | — | Jul 10, 2026 | Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that rema... |
| CVE-2026-56261 | HIGH | 7.5 | 0.4% | Jul 10, 2026 | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job ... |
| CVE-2026-56254 | HIGH | 8.3 | — | Jul 10, 2026 | In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key... |
| CVE-2026-38059 | HIGH | 8.7 | — | Jul 10, 2026 | The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated atta... |
| CVE-2026-38057 | HIGH | 8.1 | — | Jul 10, 2026 | The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot en... |
| CVE-2026-29519 | HIGH | 8.2 | 0.4% | Jul 10, 2026 | Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site script... |
| CVE-2026-22660 | HIGH | 8.6 | 0.3% | Jul 10, 2026 | FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administra... |
| CVE-2026-22659 | HIGH | 8.1 | 0.3% | Jul 10, 2026 | FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now