2026 CVE Vulnerabilities
43,261 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-65687 | CRITICAL | 9.8 | 0.6% | Jul 23, 2026 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG p... |
| CVE-2026-65907 | CRITICAL | 9.1 | — | Jul 23, 2026 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible |
| CVE-2026-65906 | CRITICAL | 10 | 0.4% | Jul 23, 2026 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible |
| CVE-2026-65606 | CRITICAL | 9.6 | — | Jul 23, 2026 | SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://pl... |
| CVE-2026-65605 | CRITICAL | 9.6 | — | Jul 23, 2026 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A... |
| CVE-2026-65471 | CRITICAL | 9.6 | — | Jul 23, 2026 | Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions. |
| CVE-2026-65461 | CRITICAL | 9.1 | — | Jul 23, 2026 | Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions. |
| CVE-2026-65455 | CRITICAL | 9.1 | — | Jul 23, 2026 | Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions. |
| CVE-2026-64815 | CRITICAL | 9.8 | 0.3% | Jul 23, 2026 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files |
| CVE-2026-64813 | CRITICAL | 10 | 0.4% | Jul 23, 2026 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session |
| CVE-2026-64812 | CRITICAL | 10 | 0.4% | Jul 23, 2026 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session |
| CVE-2026-61951 | CRITICAL | 9.8 | — | Jul 23, 2026 | Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions. |
| CVE-2026-61950 | CRITICAL | 9.3 | — | Jul 23, 2026 | Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. |
| CVE-2026-61949 | CRITICAL | 9.3 | — | Jul 23, 2026 | Unauthenticated SQL Injection in Bookly <= 27.7 versions. |
| CVE-2026-61948 | CRITICAL | 9.3 | — | Jul 23, 2026 | Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. |
| CVE-2026-59555 | CRITICAL | 10 | — | Jul 23, 2026 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions. |
| CVE-2026-59544 | CRITICAL | 9.8 | — | Jul 23, 2026 | Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. |
| CVE-2026-59543 | CRITICAL | 9.9 | — | Jul 23, 2026 | Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions. |
| CVE-2026-59540 | CRITICAL | 9.8 | — | Jul 23, 2026 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions. |
| CVE-2026-59526 | CRITICAL | 9.3 | — | Jul 23, 2026 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. |
| CVE-2026-59525 | CRITICAL | 9.3 | — | Jul 23, 2026 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. |
| CVE-2026-59514 | CRITICAL | 9.3 | — | Jul 23, 2026 | Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. |
| CVE-2026-57784 | CRITICAL | 9.6 | — | Jul 23, 2026 | Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions. |
| CVE-2026-27064 | CRITICAL | 9.1 | — | Jul 23, 2026 | Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. |
| CVE-2026-65431 | CRITICAL | 9.8 | 0.2% | Jul 23, 2026 | Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extr... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now