2026 CVE Vulnerabilities
56,936 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-63734 | MEDIUM | 6.9 | 0.3% | Jul 20, 2026 | SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows aut... |
| CVE-2026-63733 | MEDIUM | 6.5 | 0.2% | Jul 20, 2026 | SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMIS... |
| CVE-2026-16254 | MEDIUM | 4.3 | — | Jul 20, 2026 | A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an o... |
| CVE-2026-16247 | HIGH | 7.3 | 0.1% | Jul 20, 2026 | In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this proces... |
| CVE-2026-16246 | HIGH | 7.3 | 0.1% | Jul 20, 2026 | In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows g... |
| CVE-2026-15813 | MEDIUM | 6.5 | 0.3% | Jul 20, 2026 | A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The int... |
| CVE-2026-15588 | MEDIUM | 5.3 | 0.2% | Jul 20, 2026 | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` a... |
| CVE-2026-14448 | HIGH | 8.6 | 0.8% | Jul 20, 2026 | An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certifi... |
| CVE-2026-2445 | MEDIUM | 6.1 | 0.1% | Jul 20, 2026 | The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encod... |
| CVE-2026-16242 | CRITICAL | 9.4 | 0.8% | Jul 20, 2026 | A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was... |
| CVE-2026-13577 | HIGH | 8.2 | 0.3% | Jul 20, 2026 | Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dan... |
| CVE-2026-9833 | HIGH | 7.1 | 0.2% | Jul 20, 2026 | The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape... |
| CVE-2026-8825 | MEDIUM | 4.9 | 0.1% | Jul 20, 2026 | The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning p... |
| CVE-2026-6656 | HIGH | 7.5 | 0.1% | Jul 20, 2026 | Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the bu... |
| CVE-2026-16235 | CRITICAL | 9.8 | 0.1% | Jul 20, 2026 | Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-... |
| CVE-2026-13432 | MEDIUM | 5.4 | 0.1% | Jul 20, 2026 | The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing a... |
| CVE-2026-13156 | MEDIUM | 5.4 | 0.1% | Jul 20, 2026 | The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it veri... |
| CVE-2026-13147 | CRITICAL | 9.1 | 0.1% | Jul 20, 2026 | The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowi... |
| CVE-2026-13142 | HIGH | 8.1 | 0.1% | Jul 20, 2026 | The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a wo... |
| CVE-2026-12973 | MEDIUM | 6.5 | 0.2% | Jul 20, 2026 | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation i... |
| CVE-2026-12972 | MEDIUM | 5.3 | 0.2% | Jul 20, 2026 | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation i... |
| CVE-2026-12970 | HIGH | 7.1 | 0.2% | Jul 20, 2026 | The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attri... |
| CVE-2026-12898 | MEDIUM | 6.5 | 0.2% | Jul 20, 2026 | The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value be... |
| CVE-2026-12724 | MEDIUM | 4.3 | 0.1% | Jul 20, 2026 | The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a re... |
| CVE-2026-12723 | MEDIUM | 5.3 | 0.1% | Jul 20, 2026 | The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing u... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now