2026 CVE Vulnerabilities
48,366 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-19014 | MEDIUM | 4.3 | 0.3% | Aug 7, 2026 | Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumpti... |
| CVE-2026-19012 | MEDIUM | 5.3 | 0.2% | Aug 7, 2026 | Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service... |
| CVE-2026-15972 | HIGH | 7.5 | 0.4% | Aug 7, 2026 | Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of servi... |
| CVE-2026-15970 | MEDIUM | 4.2 | 0.2% | Aug 7, 2026 | Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypa... |
| CVE-2026-71852 | MEDIUM | 4.8 | 0.1% | Aug 7, 2026 | pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and larg... |
| CVE-2026-71851 | CRITICAL | 9 | — | Aug 7, 2026 | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in Crypt... |
| CVE-2026-71850 | MEDIUM | 4.8 | 0.2% | Aug 7, 2026 | Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from... |
| CVE-2026-71849 | LOW | 3.7 | 0.2% | Aug 7, 2026 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy H... |
| CVE-2026-71848 | MEDIUM | 5.3 | — | Aug 7, 2026 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the langua... |
| CVE-2026-71847 | HIGH | 8.7 | — | Aug 7, 2026 | Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consume... |
| CVE-2026-70561 | HIGH | 7.1 | 0.3% | Aug 7, 2026 | TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user,... |
| CVE-2026-69127 | MEDIUM | 6.9 | 0.3% | Aug 7, 2026 | Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handl... |
| CVE-2026-66000 | LOW | 2.3 | — | Aug 7, 2026 | Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation... |
| CVE-2026-48098 | HIGH | 7.3 | — | Aug 7, 2026 | NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Vers... |
| CVE-2026-48097 | HIGH | 7.8 | — | Aug 7, 2026 | NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Vers... |
| CVE-2026-19231 | HIGH | 7.3 | 0.3% | Aug 7, 2026 | A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects ... |
| CVE-2026-19230 | LOW | 3.5 | 0.2% | Aug 7, 2026 | A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /soci... |
| CVE-2026-17435 | LOW | 2.5 | 0.2% | Aug 7, 2026 | File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When th... |
| CVE-2026-11430 | HIGH | 7.3 | — | Aug 7, 2026 | Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook featu... |
| CVE-2026-66058 | MEDIUM | 5.3 | 0.2% | Aug 7, 2026 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follo... |
| CVE-2026-64638 | HIGH | 8.9 | — | Aug 7, 2026 | WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malici... |
| CVE-2026-64637 | CRITICAL | 9.9 | — | Aug 7, 2026 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an ... |
| CVE-2026-64636 | HIGH | 7.7 | — | Aug 7, 2026 | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to rea... |
| CVE-2026-56818 | MEDIUM | 6.5 | — | Aug 7, 2026 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the Redis... |
| CVE-2026-47364 | MEDIUM | 6.5 | — | Aug 7, 2026 | In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datado... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now