2026 CVE Vulnerabilities
43,286 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-65325 | MEDIUM | 6.3 | 0.1% | Jul 29, 2026 | Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the n... |
| CVE-2026-58156 | MEDIUM | 6.3 | 0.1% | Jul 29, 2026 | Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affe... |
| CVE-2026-58152 | MEDIUM | 6.9 | 0.2% | Jul 29, 2026 | Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apa... |
| CVE-2026-11973 | MEDIUM | 4.9 | 0.3% | Jul 29, 2026 | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in a... |
| CVE-2026-24033 | MEDIUM | 5.3 | 0.2% | Jul 29, 2026 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server.... |
| CVE-2026-22068 | MEDIUM | 5.3 | 0.2% | Jul 29, 2026 | Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: fr... |
| CVE-2026-18197 | MEDIUM | 6.4 | 0.3% | Jul 29, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allow... |
| CVE-2026-63242 | MEDIUM | 4.3 | 0.2% | Jul 29, 2026 | A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to ... |
| CVE-2026-63240 | MEDIUM | 4.3 | 0.2% | Jul 29, 2026 | An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers f... |
| CVE-2026-63239 | MEDIUM | 5.4 | 0.1% | Jul 29, 2026 | A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 bucke... |
| CVE-2026-63238 | MEDIUM | 6.5 | 0.2% | Jul 29, 2026 | An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, incl... |
| CVE-2026-63237 | MEDIUM | 4.8 | 0.1% | Jul 29, 2026 | A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled s... |
| CVE-2026-14224 | MEDIUM | 5.4 | 0.1% | Jul 29, 2026 | The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data... |
| CVE-2026-13692 | MEDIUM | 5.3 | 0.2% | Jul 29, 2026 | The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying ... |
| CVE-2026-13605 | MEDIUM | 6.8 | 0.2% | Jul 29, 2026 | The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox ca... |
| CVE-2026-11351 | MEDIUM | 5.3 | 0.1% | Jul 29, 2026 | The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API e... |
| CVE-2026-5626 | MEDIUM | 4.3 | 0.2% | Jul 29, 2026 | The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability chec... |
| CVE-2026-15344 | MEDIUM | 4.9 | 0.4% | Jul 29, 2026 | The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all ver... |
| CVE-2026-17166 | MEDIUM | 4.3 | 0.2% | Jul 29, 2026 | The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress... |
| CVE-2026-17162 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
| CVE-2026-17161 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
| CVE-2026-15735 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field'... |
| CVE-2026-12939 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the p... |
| CVE-2026-12938 | MEDIUM | 6.4 | 0.2% | Jul 29, 2026 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the... |
| CVE-2026-66064 | MEDIUM | 5.3 | 0.3% | Jul 28, 2026 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now