2026 CVE Vulnerabilities
53,128 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-59921 | MEDIUM | 6.5 | 0.5% | Jul 28, 2026 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ... |
| CVE-2026-54719 | HIGH | 7.5 | 0.3% | Jul 28, 2026 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.... |
| CVE-2026-54659 | MEDIUM | 6.9 | 0.4% | Jul 28, 2026 | Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18... |
| CVE-2026-54658 | CRITICAL | 9.8 | 0.4% | Jul 28, 2026 | Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/u... |
| CVE-2026-54650 | HIGH | 8.6 | 0.4% | Jul 28, 2026 | openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publ... |
| CVE-2026-54638 | HIGH | 7.5 | 0.3% | Jul 28, 2026 | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted... |
| CVE-2026-47219 | HIGH | 7.5 | 0.5% | Jul 28, 2026 | find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and w... |
| CVE-2026-55415 | HIGH | 7.5 | 0.3% | Jul 28, 2026 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch... |
| CVE-2026-55403 | LOW | 3.7 | 0.2% | Jul 28, 2026 | datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_gener... |
| CVE-2026-55391 | HIGH | 7.5 | 0.2% | Jul 28, 2026 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch... |
| CVE-2026-55390 | HIGH | 7.5 | 0.4% | Jul 28, 2026 | datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema pars... |
| CVE-2026-55389 | HIGH | 7.5 | 0.4% | Jul 28, 2026 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch... |
| CVE-2026-54691 | HIGH | 8.2 | 0.2% | Jul 28, 2026 | datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_co... |
| CVE-2026-54690 | HIGH | 8.2 | 0.2% | Jul 28, 2026 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch... |
| CVE-2026-54656 | HIGH | 7.8 | 0.1% | Jul 28, 2026 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch... |
| CVE-2026-54655 | HIGH | 7.8 | 0.1% | Jul 28, 2026 | datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type v... |
| CVE-2026-54654 | HIGH | 7.8 | 0.1% | Jul 28, 2026 | datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-tem... |
| CVE-2026-54653 | HIGH | 8.8 | 0.3% | Jul 28, 2026 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch... |
| CVE-2026-54621 | HIGH | 7.8 | 0.1% | Jul 28, 2026 | datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union descriptio... |
| CVE-2026-6881 | CRITICAL | 9.4 | — | Jul 28, 2026 | A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated a... |
| CVE-2026-59943 | MEDIUM | 5.3 | 0.3% | Jul 28, 2026 | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted con... |
| CVE-2026-59942 | HIGH | 7.5 | 0.4% | Jul 28, 2026 | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack v... |
| CVE-2026-59941 | HIGH | 7.5 | 0.5% | Jul 28, 2026 | Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PN... |
| CVE-2026-56722 | MEDIUM | 5.3 | 0.6% | Jul 28, 2026 | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can byp... |
| CVE-2026-49447 | MEDIUM | 5.3 | 0.2% | Jul 28, 2026 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now