2026 CVE Vulnerabilities
52,233 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-66750 | MEDIUM | 5.3 | 0.3% | Jul 28, 2026 | Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to dow... |
| CVE-2026-66749 | HIGH | 7.1 | 0.3% | Jul 28, 2026 | Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash th... |
| CVE-2026-66748 | HIGH | 8.8 | 0.8% | Jul 28, 2026 | Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows user... |
| CVE-2026-66746 | MEDIUM | 5.4 | 0.2% | Jul 28, 2026 | Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arb... |
| CVE-2026-62828 | MEDIUM | 5.4 | 0.2% | Jul 28, 2026 | Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a netw... |
| CVE-2026-61609 | HIGH | 7.5 | 0.4% | Jul 28, 2026 | Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limite... |
| CVE-2026-54593 | HIGH | 8.1 | 0.4% | Jul 28, 2026 | Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2,... |
| CVE-2026-54545 | HIGH | 7.1 | 0.1% | Jul 28, 2026 | wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlle... |
| CVE-2026-51271 | — | — | 0.3% | Jul 28, 2026 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further inv... |
| CVE-2026-51270 | — | — | 0.4% | Jul 28, 2026 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further inv... |
| CVE-2026-51269 | — | — | 0.4% | Jul 28, 2026 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further inv... |
| CVE-2026-51268 | — | — | 0.4% | Jul 28, 2026 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further inv... |
| CVE-2026-51267 | — | — | 0.5% | Jul 28, 2026 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further inv... |
| CVE-2026-51266 | — | — | 0.6% | Jul 28, 2026 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further inv... |
| CVE-2026-51263 | — | — | 0.4% | Jul 28, 2026 | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further inv... |
| CVE-2026-47483 | HIGH | 8.2 | — | Jul 28, 2026 | NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could c... |
| CVE-2026-47427 | HIGH | 7.5 | 0.4% | Jul 28, 2026 | GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.... |
| CVE-2026-45293 | HIGH | 8.6 | — | Jul 28, 2026 | WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.... |
| CVE-2026-43910 | HIGH | 8.2 | 0.2% | Jul 28, 2026 | Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. Fro... |
| CVE-2026-8164 | HIGH | 7.3 | — | Jul 28, 2026 | Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desk... |
| CVE-2026-7521 | MEDIUM | 5.5 | 0.3% | Jul 28, 2026 | Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deleti... |
| CVE-2026-6879 | LOW | 2 | 0.4% | Jul 28, 2026 | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index pred... |
| CVE-2026-67178 | HIGH | 7.8 | 0.5% | Jul 28, 2026 | MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-t... |
| CVE-2026-67174 | CRITICAL | 9.2 | 0.4% | Jul 28, 2026 | Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering... |
| CVE-2026-66713 | CRITICAL | 9.8 | 1.2% | Jul 28, 2026 | Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Ap... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now