2026 CVE Vulnerabilities
51,951 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-59901 | HIGH | 7.5 | 0.2% | Jul 29, 2026 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ... |
| CVE-2026-59900 | MEDIUM | 5.3 | 0.3% | Jul 29, 2026 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ... |
| CVE-2026-59899 | HIGH | 7.5 | 0.3% | Jul 29, 2026 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ... |
| CVE-2026-54705 | MEDIUM | 6.3 | 0.2% | Jul 29, 2026 | MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode conten... |
| CVE-2026-41939 | CRITICAL | 9.8 | 0.8% | Jul 29, 2026 | Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final manag... |
| CVE-2026-40272 | HIGH | 7 | 0.1% | Jul 29, 2026 | Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted k... |
| CVE-2026-18236 | CRITICAL | 9.3 | — | Jul 29, 2026 | A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker wh... |
| CVE-2026-14266 | HIGH | 7.8 | 0.9% | Jul 29, 2026 | 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote ... |
| CVE-2026-13723 | MEDIUM | 6.5 | 0.3% | Jul 29, 2026 | A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrar... |
| CVE-2026-8339 | HIGH | 8.7 | 0.2% | Jul 29, 2026 | A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclus... |
| CVE-2026-8338 | CRITICAL | 9.2 | 0.3% | Jul 29, 2026 | A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.... |
| CVE-2026-67194 | HIGH | 7.1 | 0.3% | Jul 29, 2026 | Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process... |
| CVE-2026-64560 | HIGH | 7.8 | 0.1% | Jul 29, 2026 | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader ... |
| CVE-2026-64559 | HIGH | 7.8 | 0.1% | Jul 29, 2026 | In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl ... |
| CVE-2026-64558 | HIGH | 7.8 | 0.1% | Jul 29, 2026 | In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler imple... |
| CVE-2026-54727 | HIGH | 8.2 | 0.1% | Jul 29, 2026 | proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink ... |
| CVE-2026-54693 | HIGH | 8.2 | 0.3% | Jul 29, 2026 | ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, and from 4... |
| CVE-2026-54680 | CRITICAL | 9.9 | — | Jul 29, 2026 | Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd... |
| CVE-2026-54574 | HIGH | 8.2 | 0.1% | Jul 29, 2026 | proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain ta... |
| CVE-2026-52791 | LOW | 2 | — | Jul 29, 2026 | fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branc... |
| CVE-2026-51992 | — | — | 0.5% | Jul 29, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL inte... |
| CVE-2026-20316 | MEDIUM | 5.3 | 0.8% | Jul 29, 2026 | A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenti... |
| CVE-2026-18257 | MEDIUM | 5.6 | — | Jul 29, 2026 | Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a cert... |
| CVE-2026-18255 | HIGH | 7.2 | — | Jul 29, 2026 | A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repo... |
| CVE-2026-16729 | MEDIUM | 6.5 | 0.2% | Jul 29, 2026 | undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now