2026 CVE Vulnerabilities
46,868 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-15190 | HIGH | 7.3 | — | Jul 9, 2026 | A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown part of... |
| CVE-2026-13462 | HIGH | 7.5 | — | Jul 9, 2026 | PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to ... |
| CVE-2026-59206 | HIGH | 7.1 | — | Jul 9, 2026 | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with t... |
| CVE-2026-11404 | HIGH | 8.7 | 0.4% | Jul 9, 2026 | Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello... |
| CVE-2026-60109 | HIGH | 8.7 | 0.5% | Jul 9, 2026 | Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauth... |
| CVE-2026-60108 | HIGH | 8.7 | 0.4% | Jul 9, 2026 | Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthentica... |
| CVE-2026-56292 | HIGH | 7.5 | 0.3% | Jul 9, 2026 | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing... |
| CVE-2026-54801 | HIGH | 8.6 | — | Jul 9, 2026 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base syst... |
| CVE-2026-54799 | HIGH | 8.4 | — | Jul 9, 2026 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base syst... |
| CVE-2026-54798 | HIGH | 7.1 | — | Jul 9, 2026 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base syst... |
| CVE-2026-4256 | HIGH | 8.2 | — | Jul 9, 2026 | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology ... |
| CVE-2026-12593 | HIGH | 8.7 | 0.3% | Jul 9, 2026 | The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to en... |
| CVE-2026-9253 | HIGH | 7.2 | — | Jul 9, 2026 | The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
| CVE-2026-59692 | HIGH | 7.5 | 0.4% | Jul 9, 2026 | A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificat... |
| CVE-2026-59691 | HIGH | 7.1 | 0.3% | Jul 9, 2026 | A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/V... |
| CVE-2026-50644 | HIGH | 8.6 | — | Jul 9, 2026 | SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all right... |
| CVE-2026-4275 | HIGH | 8.8 | — | Jul 9, 2026 | The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request F... |
| CVE-2026-14372 | HIGH | 7.1 | — | Jul 9, 2026 | The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is v... |
| CVE-2026-13441 | HIGH | 7.2 | — | Jul 9, 2026 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
| CVE-2026-56458 | HIGH | 7.5 | 0.2% | Jul 9, 2026 | HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged action... |
| CVE-2026-1989 | HIGH | 7.5 | 0.4% | Jul 9, 2026 | Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allo... |
| CVE-2026-8848 | HIGH | 7.2 | 0.7% | Jul 9, 2026 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress ... |
| CVE-2026-57111 | HIGH | 7.5 | 0.2% | Jul 9, 2026 | Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFi... |
| CVE-2026-33390 | HIGH | 8.1 | 0.2% | Jul 9, 2026 | An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors r... |
| CVE-2026-31985 | HIGH | 8.3 | 0.1% | Jul 9, 2026 | When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disab... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now