2026 CVE Vulnerabilities
43,308 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-28926 | HIGH | 7 | 0.1% | Jul 27, 2026 | A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 1... |
| CVE-2026-28912 | HIGH | 7.8 | 0.1% | Jul 27, 2026 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A... |
| CVE-2026-28896 | HIGH | 7.7 | 0.1% | Jul 27, 2026 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8.... |
| CVE-2026-66015 | HIGH | 7.2 | 0.3% | Jul 27, 2026 | An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account c... |
| CVE-2026-65921 | HIGH | 8.8 | 0.4% | Jul 27, 2026 | A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written ou... |
| CVE-2026-65617 | HIGH | 8.8 | 0.3% | Jul 27, 2026 | A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentia... |
| CVE-2026-65616 | HIGH | 8.8 | 0.2% | Jul 27, 2026 | Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administra... |
| CVE-2026-56748 | HIGH | 8.8 | 0.6% | Jul 27, 2026 | Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authe... |
| CVE-2026-56747 | HIGH | 8.8 | 0.4% | Jul 27, 2026 | Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a r... |
| CVE-2026-42017 | HIGH | 8.8 | 0.3% | Jul 27, 2026 | An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged use... |
| CVE-2026-42016 | HIGH | 8.8 | 0.2% | Jul 27, 2026 | JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a valida... |
| CVE-2026-66759 | HIGH | 7.1 | 0.1% | Jul 27, 2026 | A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the pl... |
| CVE-2026-66758 | HIGH | 7.8 | 0.1% | Jul 27, 2026 | A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory alloca... |
| CVE-2026-16481 | HIGH | 8.4 | 0.2% | Jul 27, 2026 | A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch... |
| CVE-2026-12383 | HIGH | 7.5 | 0.1% | Jul 27, 2026 | A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access control... |
| CVE-2026-10682 | HIGH | 7.8 | 0.1% | Jul 27, 2026 | The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a s... |
| CVE-2026-66028 | HIGH | 7.1 | 0.3% | Jul 27, 2026 | Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authe... |
| CVE-2026-64642 | HIGH | 8.2 | 1.3% | Jul 27, 2026 | Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted reque... |
| CVE-2026-64641 | HIGH | 7.5 | 0.5% | Jul 27, 2026 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 thr... |
| CVE-2026-59239 | HIGH | 8.6 | — | Jul 27, 2026 | Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authe... |
| CVE-2026-55578 | HIGH | 8.8 | 0.4% | Jul 27, 2026 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the termin... |
| CVE-2026-54540 | HIGH | 8.8 | — | Jul 27, 2026 | Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated term... |
| CVE-2026-17568 | HIGH | 8.8 | 0.2% | Jul 27, 2026 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-adm... |
| CVE-2026-66731 | HIGH | 8.7 | 0.5% | Jul 27, 2026 | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser... |
| CVE-2026-66730 | HIGH | 8.7 | 0.5% | Jul 27, 2026 | facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unau... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now