2026 CVE Vulnerabilities
43,311 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-56416 | MEDIUM | 4.8 | 0.1% | Jul 22, 2026 | In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSI... |
| CVE-2026-55991 | MEDIUM | 5.9 | 0.2% | Jul 22, 2026 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 asserti... |
| CVE-2026-55990 | MEDIUM | 5.9 | 0.2% | Jul 22, 2026 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:'... |
| CVE-2026-55717 | MEDIUM | 5.9 | 0.2% | Jul 22, 2026 | In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: ... |
| CVE-2026-52863 | MEDIUM | 5.9 | 0.2% | Jul 22, 2026 | In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together... |
| CVE-2026-50251 | MEDIUM | 5.3 | 0.3% | Jul 22, 2026 | In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value g... |
| CVE-2026-50248 | MEDIUM | 6.5 | 0.1% | Jul 22, 2026 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that res... |
| CVE-2026-50046 | MEDIUM | 5.9 | 0.2% | Jul 22, 2026 | In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queri... |
| CVE-2026-50045 | MEDIUM | 5.3 | 0.3% | Jul 22, 2026 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a single client query for a deeply nested name under a DNSSEC-s... |
| CVE-2026-44621 | MEDIUM | 5.9 | 0.3% | Jul 22, 2026 | With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-... |
| CVE-2026-16560 | MEDIUM | 5.3 | — | Jul 22, 2026 | A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the s... |
| CVE-2026-14932 | MEDIUM | 6.5 | 0.2% | Jul 22, 2026 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vuln... |
| CVE-2026-14865 | MEDIUM | 5.3 | 0.2% | Jul 22, 2026 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML wi... |
| CVE-2026-14586 | MEDIUM | 5.9 | — | Jul 22, 2026 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under ... |
| CVE-2026-13192 | MEDIUM | 6.5 | 0.2% | Jul 22, 2026 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PD... |
| CVE-2026-13188 | MEDIUM | 5.9 | 0.1% | Jul 22, 2026 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potential... |
| CVE-2026-16270 | MEDIUM | 6.9 | — | Jul 22, 2026 | Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex... |
| CVE-2026-65601 | MEDIUM | 5.3 | 0.4% | Jul 22, 2026 | Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider.... |
| CVE-2026-65600 | MEDIUM | 5.3 | 0.7% | Jul 22, 2026 | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path tr... |
| CVE-2026-65599 | MEDIUM | 6.5 | 0.2% | Jul 22, 2026 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Goo... |
| CVE-2026-65597 | MEDIUM | 5.4 | 0.4% | Jul 22, 2026 | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the... |
| CVE-2026-65594 | MEDIUM | 6.5 | 0.3% | Jul 22, 2026 | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was... |
| CVE-2026-65593 | MEDIUM | 5.4 | 0.2% | Jul 22, 2026 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node... |
| CVE-2026-65592 | MEDIUM | 5.4 | 0.3% | Jul 22, 2026 | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator... |
| CVE-2026-65589 | MEDIUM | 6.5 | 0.4% | Jul 22, 2026 | n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writin... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now