2026 CVE Vulnerabilities
53,398 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-15614 | HIGH | 7.5 | 0.1% | Jul 23, 2026 | Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s valid... |
| CVE-2026-15612 | CRITICAL | 9.1 | 0.1% | Jul 23, 2026 | Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication... |
| CVE-2026-15611 | CRITICAL | 9.1 | 0.2% | Jul 23, 2026 | Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive Id... |
| CVE-2026-11804 | MEDIUM | 5.2 | — | Jul 23, 2026 | Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux... |
| CVE-2026-43823 | HIGH | 7.5 | 0.3% | Jul 23, 2026 | When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the c... |
| CVE-2026-43820 | HIGH | 7.7 | 0.1% | Jul 23, 2026 | NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to... |
| CVE-2026-8287 | MEDIUM | 4.3 | — | Jul 23, 2026 | Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade ... |
| CVE-2026-65914 | MEDIUM | 6.1 | 0.3% | Jul 23, 2026 | DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing cont... |
| CVE-2026-65913 | MEDIUM | 6.1 | 0.2% | Jul 23, 2026 | DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass... |
| CVE-2026-65912 | MEDIUM | 6.1 | 0.2% | Jul 23, 2026 | DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function ... |
| CVE-2026-65911 | MEDIUM | 6.1 | 0.2% | Jul 23, 2026 | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in int... |
| CVE-2026-65904 | MEDIUM | 4.7 | 0.2% | Jul 23, 2026 | DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a diffe... |
| CVE-2026-65903 | MEDIUM | 6.1 | 0.2% | Jul 23, 2026 | DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden t... |
| CVE-2026-65902 | MEDIUM | 6.1 | 0.2% | Jul 23, 2026 | DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS an... |
| CVE-2026-65901 | MEDIUM | 6.1 | 0.2% | Jul 23, 2026 | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled n... |
| CVE-2026-65900 | MEDIUM | 6.1 | 0.2% | Jul 23, 2026 | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RE... |
| CVE-2026-65899 | MEDIUM | 6.1 | 0.2% | Jul 23, 2026 | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPuri... |
| CVE-2026-65898 | HIGH | 7.2 | 0.2% | Jul 23, 2026 | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute... |
| CVE-2026-65690 | HIGH | 8.8 | 0.6% | Jul 23, 2026 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file ... |
| CVE-2026-65689 | CRITICAL | 9.8 | 0.6% | Jul 23, 2026 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its datab... |
| CVE-2026-65688 | CRITICAL | 9.8 | 0.6% | Jul 23, 2026 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font ... |
| CVE-2026-65687 | CRITICAL | 9.8 | 0.6% | Jul 23, 2026 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG p... |
| CVE-2026-16735 | MEDIUM | 5.3 | 0.6% | Jul 23, 2026 | A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function ... |
| CVE-2026-16733 | MEDIUM | 5.3 | — | Jul 23, 2026 | A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.... |
| CVE-2026-14257 | HIGH | 7.5 | 0.5% | Jul 23, 2026 | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now