2026 CVE Vulnerabilities
43,286 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-58180 | HIGH | 8.2 | 0.4% | Jul 29, 2026 | The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache ... |
| CVE-2026-58178 | HIGH | 8.2 | 0.4% | Jul 29, 2026 | The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects A... |
| CVE-2026-58175 | HIGH | 8.2 | 0.4% | Jul 29, 2026 | Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0... |
| CVE-2026-58164 | HIGH | 8.3 | 0.4% | Jul 29, 2026 | Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This iss... |
| CVE-2026-58159 | HIGH | 8.2 | 0.4% | Jul 29, 2026 | Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affect... |
| CVE-2026-58158 | HIGH | 8.2 | 0.4% | Jul 29, 2026 | Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects A... |
| CVE-2026-58157 | HIGH | 8.7 | 0.3% | Jul 29, 2026 | Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This i... |
| CVE-2026-50622 | HIGH | 8.8 | 0.3% | Jul 29, 2026 | Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoi... |
| CVE-2026-23904 | HIGH | 7.3 | 0.3% | Jul 29, 2026 | Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A re... |
| CVE-2026-65324 | HIGH | 8.2 | 0.3% | Jul 29, 2026 | Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client ... |
| CVE-2026-64557 | HIGH | 8.8 | 0.2% | Jul 29, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_... |
| CVE-2026-64556 | HIGH | 7.8 | 0.2% | Jul 29, 2026 | In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exe... |
| CVE-2026-58153 | HIGH | 8.3 | 0.2% | Jul 29, 2026 | Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting H... |
| CVE-2026-58151 | HIGH | 8.7 | 0.3% | Jul 29, 2026 | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This ... |
| CVE-2026-13425 | HIGH | 7.2 | 0.2% | Jul 29, 2026 | The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in al... |
| CVE-2026-35226 | HIGH | 7.1 | 0.2% | Jul 29, 2026 | An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same n... |
| CVE-2026-33930 | HIGH | 8.2 | 0.2% | Jul 29, 2026 | Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handl... |
| CVE-2026-18192 | HIGH | 7.1 | 0.4% | Jul 29, 2026 | VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to e... |
| CVE-2026-63231 | HIGH | 8.1 | 0.3% | Jul 29, 2026 | A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based... |
| CVE-2026-14300 | HIGH | 8.1 | 0.1% | Jul 29, 2026 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bin... |
| CVE-2026-14234 | HIGH | 7.1 | 0.1% | Jul 29, 2026 | The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowin... |
| CVE-2026-13690 | HIGH | 7.4 | 0.2% | Jul 29, 2026 | The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor log... |
| CVE-2026-11974 | HIGH | 8.6 | 0.5% | Jul 29, 2026 | The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a... |
| CVE-2026-12476 | HIGH | 7.2 | 0.6% | Jul 29, 2026 | The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3... |
| CVE-2026-12144 | HIGH | 8.8 | 0.4% | Jul 29, 2026 | The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and incl... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now