2026 CVE Vulnerabilities
52,116 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-17166 | MEDIUM | 4.3 | 0.2% | Jul 29, 2026 | The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress... |
| CVE-2026-17162 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
| CVE-2026-17161 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
| CVE-2026-15735 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field'... |
| CVE-2026-12939 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the p... |
| CVE-2026-12938 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the... |
| CVE-2026-12144 | HIGH | 8.8 | 0.4% | Jul 29, 2026 | The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl... |
| CVE-2026-56822 | HIGH | 7.4 | 0.1% | Jul 29, 2026 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ... |
| CVE-2026-56821 | HIGH | 7.4 | 0.1% | Jul 29, 2026 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ... |
| CVE-2026-66064 | MEDIUM | 5.3 | 0.3% | Jul 28, 2026 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler... |
| CVE-2026-66063 | MEDIUM | 6.5 | 0.2% | Jul 28, 2026 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.... |
| CVE-2026-64863 | CRITICAL | 9.1 | 0.3% | Jul 28, 2026 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.... |
| CVE-2026-62325 | CRITICAL | 9.1 | 0.3% | Jul 28, 2026 | goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver... |
| CVE-2026-59921 | MEDIUM | 6.5 | 0.5% | Jul 28, 2026 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ... |
| CVE-2026-54719 | HIGH | 7.5 | 0.3% | Jul 28, 2026 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.... |
| CVE-2026-54659 | MEDIUM | 6.9 | 0.4% | Jul 28, 2026 | Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18... |
| CVE-2026-54658 | CRITICAL | 9.8 | 0.4% | Jul 28, 2026 | Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/u... |
| CVE-2026-54650 | HIGH | 8.6 | 0.4% | Jul 28, 2026 | openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publ... |
| CVE-2026-54638 | HIGH | 7.5 | 0.3% | Jul 28, 2026 | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted... |
| CVE-2026-47219 | HIGH | 7.5 | 0.5% | Jul 28, 2026 | find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and w... |
| CVE-2026-55415 | HIGH | 7.5 | 0.3% | Jul 28, 2026 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch... |
| CVE-2026-55403 | LOW | 3.7 | 0.2% | Jul 28, 2026 | datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_gener... |
| CVE-2026-55391 | HIGH | 7.5 | 0.2% | Jul 28, 2026 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch... |
| CVE-2026-55390 | HIGH | 7.5 | 0.4% | Jul 28, 2026 | datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema pars... |
| CVE-2026-55389 | HIGH | 7.5 | 0.4% | Jul 28, 2026 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now