2026 CVE Vulnerabilities
53,146 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-42493 | HIGH | 7.5 | — | Jul 28, 2026 | Addressing certain issues, in particular related to operations which may take excessively long and therefore would need ... |
| CVE-2026-42492 | HIGH | 7.5 | — | Jul 28, 2026 | Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To m... |
| CVE-2026-41874 | MEDIUM | 6.8 | 0.1% | Jul 28, 2026 | Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with acces... |
| CVE-2026-18047 | MEDIUM | 6.5 | — | Jul 28, 2026 | A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching fo... |
| CVE-2026-18038 | MEDIUM | 4.3 | — | Jul 28, 2026 | A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.E... |
| CVE-2026-15393 | MEDIUM | 6.4 | — | Jul 28, 2026 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress... |
| CVE-2026-15016 | MEDIUM | 6.4 | — | Jul 28, 2026 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerab... |
| CVE-2026-4648 | MEDIUM | 6.8 | — | Jul 28, 2026 | Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tec... |
| CVE-2026-21047 | HIGH | 8.3 | 0.4% | Jul 28, 2026 | Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitra... |
| CVE-2026-16774 | MEDIUM | 5.3 | — | Jul 28, 2026 | The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the ... |
| CVE-2026-16773 | MEDIUM | 5.3 | — | Jul 28, 2026 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive In... |
| CVE-2026-15444 | MEDIUM | 4.9 | — | Jul 28, 2026 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the... |
| CVE-2026-15411 | MEDIUM | 5.3 | — | Jul 28, 2026 | The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for ... |
| CVE-2026-15025 | HIGH | 7.5 | — | Jul 28, 2026 | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to ... |
| CVE-2026-13440 | HIGH | 7.2 | — | Jul 28, 2026 | The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for ... |
| CVE-2026-13110 | MEDIUM | 5.3 | — | Jul 28, 2026 | The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and includin... |
| CVE-2026-65880 | CRITICAL | 10 | — | Jul 28, 2026 | Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form proce... |
| CVE-2026-63303 | MEDIUM | 5.1 | 0.4% | Jul 28, 2026 | A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fai... |
| CVE-2026-63302 | MEDIUM | 5.1 | 0.3% | Jul 28, 2026 | Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated at... |
| CVE-2026-63301 | HIGH | 7 | 0.4% | Jul 28, 2026 | In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding... |
| CVE-2026-18029 | MEDIUM | 6.3 | 0.2% | Jul 28, 2026 | Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a s... |
| CVE-2026-18028 | LOW | 2.3 | 0.2% | Jul 28, 2026 | The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of ... |
| CVE-2026-17072 | LOW | 3.3 | — | Jul 28, 2026 | A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC... |
| CVE-2026-65624 | MEDIUM | 6.9 | 0.4% | Jul 28, 2026 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote ... |
| CVE-2026-59248 | HIGH | 8.7 | 0.3% | Jul 28, 2026 | Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now