2026 CVE Vulnerabilities
56,994 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-62644 | CRITICAL | 9.8 | 0.2% | Jul 14, 2026 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to u... |
| CVE-2026-62643 | CRITICAL | 10 | 0.2% | Jul 14, 2026 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTM... |
| CVE-2026-62642 | MEDIUM | 6.5 | 0.3% | Jul 14, 2026 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which ma... |
| CVE-2026-62641 | MEDIUM | 6.5 | 0.2% | Jul 14, 2026 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a craft... |
| CVE-2026-60119 | MEDIUM | 5.4 | 0.2% | Jul 14, 2026 | Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event cre... |
| CVE-2026-60118 | MEDIUM | 6.9 | 0.2% | Jul 14, 2026 | Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated ... |
| CVE-2026-60082 | CRITICAL | 9.1 | 0.2% | Jul 14, 2026 | DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle ... |
| CVE-2026-60081 | HIGH | 7.5 | 0.2% | Jul 14, 2026 | DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump file... |
| CVE-2026-59841 | HIGH | 7.5 | — | Jul 14, 2026 | A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.... |
| CVE-2026-59840 | MEDIUM | 4.3 | 0.2% | Jul 14, 2026 | A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all v... |
| CVE-2026-59839 | MEDIUM | 5.5 | 0.2% | Jul 14, 2026 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0... |
| CVE-2026-59837 | MEDIUM | 6.6 | 0.6% | Jul 14, 2026 | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM ... |
| CVE-2026-59836 | CRITICAL | 9.8 | 0.1% | Jul 14, 2026 | A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 thr... |
| CVE-2026-59835 | HIGH | 8.6 | 0.4% | Jul 14, 2026 | A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 th... |
| CVE-2026-59205 | HIGH | 7.5 | — | Jul 14, 2026 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigge... |
| CVE-2026-59204 | HIGH | 7.5 | 0.4% | Jul 14, 2026 | Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component... |
| CVE-2026-59203 | HIGH | 7.5 | 0.4% | Jul 14, 2026 | Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a n... |
| CVE-2026-59199 | HIGH | 7.5 | 0.4% | Jul 14, 2026 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-o... |
| CVE-2026-59198 | HIGH | 7.5 | — | Jul 14, 2026 | Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer w... |
| CVE-2026-58461 | — | — | — | Jul 14, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-55954 | CRITICAL | 9.1 | 0.4% | Jul 14, 2026 | Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID ... |
| CVE-2026-55651 | HIGH | 7.1 | — | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in ... |
| CVE-2026-52841 | LOW | 3.1 | — | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/co... |
| CVE-2026-52840 | LOW | 2.7 | 0.2% | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `ap... |
| CVE-2026-52839 | LOW | 3.3 | 0.1% | Jul 14, 2026 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appoi... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now