2026 CVE Vulnerabilities
51,113 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-54364 | MEDIUM | 6.9 | — | Jul 30, 2026 | CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inj... |
| CVE-2026-54363 | CRITICAL | 9.3 | — | Jul 30, 2026 | CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to fo... |
| CVE-2026-47876 | CRITICAL | 9.3 | — | Jul 30, 2026 | VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with ... |
| CVE-2026-41703 | HIGH | 7.6 | — | Jul 30, 2026 | VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment pr... |
| CVE-2026-7260 | MEDIUM | 5.5 | 0.2% | Jul 30, 2026 | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP ... |
| CVE-2026-5582 | MEDIUM | 4.3 | 0.1% | Jul 30, 2026 | The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24... |
| CVE-2026-18382 | MEDIUM | 6.8 | 0.3% | Jul 30, 2026 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able... |
| CVE-2026-18381 | HIGH | 7.6 | 0.2% | Jul 30, 2026 | A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom r... |
| CVE-2026-18378 | MEDIUM | 6.8 | 0.2% | Jul 30, 2026 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able t... |
| CVE-2026-17544 | CRITICAL | 9.8 | 0.4% | Jul 30, 2026 | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions... |
| CVE-2026-17543 | CRITICAL | 9.8 | 0.4% | Jul 30, 2026 | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions f... |
| CVE-2026-15397 | HIGH | 7.2 | — | Jul 30, 2026 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and... |
| CVE-2026-22622 | HIGH | 8.8 | — | Jul 30, 2026 | Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could al... |
| CVE-2026-22621 | HIGH | 8.3 | — | Jul 30, 2026 | Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could al... |
| CVE-2026-22620 | HIGH | 8.6 | — | Jul 30, 2026 | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unau... |
| CVE-2026-18369 | MEDIUM | 5.8 | — | Jul 30, 2026 | A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns... |
| CVE-2026-18363 | CRITICAL | 9.1 | — | Jul 30, 2026 | A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.... |
| CVE-2026-18362 | MEDIUM | 5.9 | 0.4% | Jul 30, 2026 | The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-fo... |
| CVE-2026-18361 | HIGH | 7.6 | 0.3% | Jul 30, 2026 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the... |
| CVE-2026-18360 | HIGH | 7.6 | 0.3% | Jul 30, 2026 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the... |
| CVE-2026-16971 | MEDIUM | 5.9 | 0.3% | Jul 30, 2026 | The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force a... |
| CVE-2026-16970 | MEDIUM | 4.2 | 0.2% | Jul 30, 2026 | The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Sto... |
| CVE-2026-16969 | HIGH | 7.6 | 0.3% | Jul 30, 2026 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the... |
| CVE-2026-18353 | HIGH | 8.8 | 0.2% | Jul 30, 2026 | PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer a... |
| CVE-2026-7849 | CRITICAL | 9.8 | 0.4% | Jul 30, 2026 | Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now