2026 CVE Vulnerabilities
43,277 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-15006 | HIGH | 7.5 | 0.8% | Aug 1, 2026 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vuln... |
| CVE-2026-9044 | HIGH | 8 | 1.0% | Jul 31, 2026 | An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an... |
| CVE-2026-34641 | HIGH | 7.8 | 0.1% | Jul 31, 2026 | Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co... |
| CVE-2026-51953 | HIGH | 7.4 | 0.2% | Jul 31, 2026 | An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication... |
| CVE-2026-65981 | HIGH | 7.1 | 0.3% | Jul 31, 2026 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenti... |
| CVE-2026-50986 | HIGH | 8.8 | 0.1% | Jul 31, 2026 | PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment valid... |
| CVE-2026-38710 | HIGH | 7.2 | 1.2% | Jul 31, 2026 | TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock in... |
| CVE-2026-62999 | HIGH | 7.5 | — | Jul 31, 2026 | Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-direc... |
| CVE-2026-62959 | HIGH | 8.2 | — | Jul 31, 2026 | Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started w... |
| CVE-2026-53599 | HIGH | 7.5 | — | Jul 31, 2026 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/s... |
| CVE-2026-53510 | HIGH | 8.1 | — | Jul 31, 2026 | Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL... |
| CVE-2026-18394 | HIGH | 7.4 | 0.3% | Jul 31, 2026 | Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to ob... |
| CVE-2026-53505 | HIGH | 7.5 | 0.3% | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) fi... |
| CVE-2026-53504 | HIGH | 7.5 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expressio... |
| CVE-2026-53503 | HIGH | 7.5 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, ... |
| CVE-2026-53502 | HIGH | 8.7 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path... |
| CVE-2026-53501 | HIGH | 8.2 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypasse... |
| CVE-2026-53500 | HIGH | 8.2 | — | Jul 31, 2026 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes... |
| CVE-2026-18481 | HIGH | 7.3 | 0.3% | Jul 31, 2026 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticate... |
| CVE-2026-55100 | HIGH | 8.7 | — | Jul 31, 2026 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenat... |
| CVE-2026-54737 | HIGH | 7.3 | — | Jul 31, 2026 | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to ... |
| CVE-2026-54729 | HIGH | 8.7 | — | Jul 31, 2026 | DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, is_... |
| CVE-2026-52856 | HIGH | 7.5 | — | Jul 31, 2026 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a ... |
| CVE-2026-67607 | HIGH | 8.2 | 0.3% | Jul 31, 2026 | LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thr... |
| CVE-2026-18141 | HIGH | 8.2 | 0.3% | Jul 31, 2026 | A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthentic... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now