2026 CVE Vulnerabilities
55,551 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-48013 | MEDIUM | 4.1 | 0.2% | Jul 23, 2026 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint ... |
| CVE-2026-48012 | MEDIUM | 4.3 | 0.2% | Jul 23, 2026 | Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO ... |
| CVE-2026-47722 | HIGH | 8.7 | 0.3% | Jul 23, 2026 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `inter... |
| CVE-2026-47670 | CRITICAL | 9.4 | 1.7% | Jul 23, 2026 | DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Executio... |
| CVE-2026-47669 | CRITICAL | 9.3 | 0.3% | Jul 23, 2026 | DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api... |
| CVE-2026-25800 | HIGH | 7.5 | 0.3% | Jul 23, 2026 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and... |
| CVE-2026-15212 | HIGH | 8.8 | 0.2% | Jul 23, 2026 | The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43... |
| CVE-2026-12353 | MEDIUM | 5.3 | 0.3% | Jul 23, 2026 | An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly se... |
| CVE-2026-65010 | MEDIUM | 6.6 | — | Jul 23, 2026 | Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that a... |
| CVE-2026-63765 | HIGH | 8.8 | 0.4% | Jul 23, 2026 | Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unau... |
| CVE-2026-16756 | HIGH | 8.7 | 0.4% | Jul 23, 2026 | Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path o... |
| CVE-2026-15687 | LOW | 2.4 | — | Jul 23, 2026 | A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new ... |
| CVE-2026-6516 | CRITICAL | 10 | — | Jul 23, 2026 | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the... |
| CVE-2026-65920 | MEDIUM | 5.3 | — | Jul 23, 2026 | Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_... |
| CVE-2026-65919 | HIGH | 8.7 | 0.6% | Jul 23, 2026 | Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api... |
| CVE-2026-65918 | HIGH | 7.1 | 0.3% | Jul 23, 2026 | PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GI... |
| CVE-2026-65763 | MEDIUM | 5.1 | — | Jul 23, 2026 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs... |
| CVE-2026-65762 | MEDIUM | 5.1 | — | Jul 23, 2026 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user i... |
| CVE-2026-65702 | HIGH | 8.6 | — | Jul 23, 2026 | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration t... |
| CVE-2026-65701 | CRITICAL | 9.3 | — | Jul 23, 2026 | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inf... |
| CVE-2026-65700 | CRITICAL | 9.8 | 1.3% | Jul 23, 2026 | h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthentica... |
| CVE-2026-65699 | MEDIUM | 4.2 | — | Jul 23, 2026 | AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authentica... |
| CVE-2026-47769 | MEDIUM | 5.3 | — | Jul 23, 2026 | APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Pr... |
| CVE-2026-47755 | MEDIUM | 6.5 | 0.3% | Jul 23, 2026 | ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to versi... |
| CVE-2026-47752 | CRITICAL | 9.9 | — | Jul 23, 2026 | Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to S... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now