2026 CVE Vulnerabilities
43,284 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-22620 | HIGH | 8.6 | — | Jul 30, 2026 | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unau... |
| CVE-2026-18361 | HIGH | 7.6 | 0.3% | Jul 30, 2026 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the... |
| CVE-2026-18360 | HIGH | 7.6 | 0.3% | Jul 30, 2026 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the... |
| CVE-2026-16969 | HIGH | 7.6 | 0.3% | Jul 30, 2026 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the... |
| CVE-2026-18353 | HIGH | 8.8 | 0.2% | Jul 30, 2026 | PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer a... |
| CVE-2026-44107 | HIGH | 8.7 | 0.3% | Jul 30, 2026 | A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus f... |
| CVE-2026-44106 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to exec... |
| CVE-2026-44099 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary... |
| CVE-2026-44098 | HIGH | 8.8 | 1.4% | Jul 30, 2026 | This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to p... |
| CVE-2026-44097 | HIGH | 7.1 | 0.2% | Jul 30, 2026 | A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for fi... |
| CVE-2026-44096 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, re... |
| CVE-2026-44095 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to ex... |
| CVE-2026-44094 | HIGH | 8.6 | 0.3% | Jul 30, 2026 | An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configur... |
| CVE-2026-44093 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user t... |
| CVE-2026-13584 | HIGH | 7.1 | 0.1% | Jul 30, 2026 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Ele... |
| CVE-2026-58043 | HIGH | 7.5 | 0.1% | Jul 30, 2026 | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. ... |
| CVE-2026-47882 | HIGH | 8.3 | 0.2% | Jul 30, 2026 | When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foun... |
| CVE-2026-47873 | HIGH | 8 | 0.2% | Jul 30, 2026 | The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network int... |
| CVE-2026-47858 | HIGH | 8 | 0.2% | Jul 30, 2026 | Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running applicati... |
| CVE-2026-16529 | HIGH | 7.5 | 0.3% | Jul 30, 2026 | A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU proce... |
| CVE-2026-16527 | HIGH | 7.3 | 0.4% | Jul 30, 2026 | An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endp... |
| CVE-2026-16526 | HIGH | 8.8 | 0.8% | Jul 30, 2026 | A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution... |
| CVE-2026-16524 | HIGH | 7.8 | 1.1% | Jul 30, 2026 | A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.fil... |
| CVE-2026-15240 | HIGH | 7.5 | 0.1% | Jul 30, 2026 | The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the oper... |
| CVE-2026-14239 | HIGH | 7.1 | 0.1% | Jul 30, 2026 | The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken fro... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now