2026 CVE Vulnerabilities
52,012 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-58154 | CRITICAL | 9.2 | 0.3% | Jul 29, 2026 | Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affe... |
| CVE-2026-58153 | HIGH | 8.3 | 0.2% | Jul 29, 2026 | Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting H... |
| CVE-2026-58152 | MEDIUM | 6.9 | 0.2% | Jul 29, 2026 | Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apa... |
| CVE-2026-58151 | HIGH | 8.7 | 0.3% | Jul 29, 2026 | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This ... |
| CVE-2026-13425 | HIGH | 7.2 | 0.2% | Jul 29, 2026 | The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in al... |
| CVE-2026-11973 | MEDIUM | 4.9 | 0.3% | Jul 29, 2026 | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in a... |
| CVE-2026-58150 | CRITICAL | 10 | 0.2% | Jul 29, 2026 | Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This ... |
| CVE-2026-57834 | CRITICAL | 10 | 0.3% | Jul 29, 2026 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Ser... |
| CVE-2026-41920 | CRITICAL | 9.3 | 0.2% | Jul 29, 2026 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 th... |
| CVE-2026-35226 | HIGH | 7.1 | 0.2% | Jul 29, 2026 | An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same n... |
| CVE-2026-33930 | HIGH | 8.2 | 0.2% | Jul 29, 2026 | Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handl... |
| CVE-2026-33267 | CRITICAL | 9.1 | 0.2% | Jul 29, 2026 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 ... |
| CVE-2026-24033 | MEDIUM | 5.3 | 0.2% | Jul 29, 2026 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server.... |
| CVE-2026-22068 | MEDIUM | 5.3 | 0.2% | Jul 29, 2026 | Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: fr... |
| CVE-2026-18197 | MEDIUM | 6.1 | 0.3% | Jul 29, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allow... |
| CVE-2026-18192 | HIGH | 7.1 | 0.4% | Jul 29, 2026 | VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to e... |
| CVE-2026-18191 | CRITICAL | 9.8 | 0.4% | Jul 29, 2026 | VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to... |
| CVE-2026-63242 | MEDIUM | 4.3 | 0.2% | Jul 29, 2026 | A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to ... |
| CVE-2026-63241 | LOW | 3.1 | 0.1% | Jul 29, 2026 | An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course compl... |
| CVE-2026-63240 | MEDIUM | 4.3 | 0.2% | Jul 29, 2026 | An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers f... |
| CVE-2026-63239 | MEDIUM | 5.4 | 0.1% | Jul 29, 2026 | A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 bucke... |
| CVE-2026-63238 | MEDIUM | 6.5 | 0.2% | Jul 29, 2026 | An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, incl... |
| CVE-2026-63237 | MEDIUM | 4.8 | 0.1% | Jul 29, 2026 | A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled s... |
| CVE-2026-63236 | LOW | 3.7 | 0.2% | Jul 29, 2026 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name,... |
| CVE-2026-63235 | LOW | 3.7 | 0.2% | Jul 29, 2026 | An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the se... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now