2026 CVE Vulnerabilities
45,891 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-41727 | MEDIUM | 6.5 | 0.2% | Jun 10, 2026 | Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on t... |
| CVE-2026-41726 | MEDIUM | 6.5 | 0.3% | Jun 10, 2026 | When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending r... |
| CVE-2026-41721 | MEDIUM | 5.9 | 0.3% | Jun 10, 2026 | Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Sup... |
| CVE-2026-41719 | MEDIUM | 6.4 | 0.2% | Jun 10, 2026 | A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a rep... |
| CVE-2026-41714 | MEDIUM | 4 | 0.1% | Jun 10, 2026 | Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also c... |
| CVE-2026-41711 | MEDIUM | 5.9 | 0.3% | Jun 10, 2026 | Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowE... |
| CVE-2026-41706 | MEDIUM | 6.1 | 0.2% | Jun 10, 2026 | Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser ... |
| CVE-2026-41701 | MEDIUM | 4.4 | 0.2% | Jun 10, 2026 | Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to int... |
| CVE-2026-41697 | MEDIUM | 4.8 | 0.2% | Jun 10, 2026 | Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (... |
| CVE-2026-41696 | MEDIUM | 5.9 | 0.3% | Jun 10, 2026 | Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient... |
| CVE-2026-41694 | MEDIUM | 5.3 | 0.1% | Jun 10, 2026 | Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses withou... |
| CVE-2026-41008 | MEDIUM | 6.1 | 0.2% | Jun 10, 2026 | Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parame... |
| CVE-2026-41003 | MEDIUM | 5.4 | 0.2% | Jun 10, 2026 | An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generat... |
| CVE-2026-40991 | MEDIUM | 5.9 | 0.2% | Jun 10, 2026 | When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an ... |
| CVE-2026-9751 | MEDIUM | 6.8 | 0.1% | Jun 9, 2026 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mon... |
| CVE-2026-9742 | MEDIUM | 5.9 | 0.3% | Jun 9, 2026 | When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of th... |
| CVE-2026-9735 | MEDIUM | 6.8 | 0.1% | Jun 9, 2026 | MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. W... |
| CVE-2026-46433 | MEDIUM | 6.5 | 0.2% | Jun 9, 2026 | lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips ... |
| CVE-2026-47905 | MEDIUM | 6.2 | 0.2% | Jun 9, 2026 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu... |
| CVE-2026-47904 | MEDIUM | 6.2 | 0.2% | Jun 9, 2026 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu... |
| CVE-2026-47903 | MEDIUM | 6.2 | 0.2% | Jun 9, 2026 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Input Validation v... |
| CVE-2026-47902 | MEDIUM | 6.2 | 0.2% | Jun 9, 2026 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu... |
| CVE-2026-34657 | MEDIUM | 5.5 | 0.2% | Jun 9, 2026 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pa... |
| CVE-2026-34417 | MEDIUM | 6.1 | 0.2% | Jun 9, 2026 | OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbit... |
| CVE-2026-25860 | MEDIUM | 6.1 | 0.3% | Jun 9, 2026 | OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that al... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now