CVEs from 2026
Total
14,770
critical
critical 1,335
high
high 5,012
medium
medium 4,834
low
low 504
% Critical
9.0%
% with KEV
0.4%
% with exploit
0.7%
Top vendors
Top products
- chrome 723
- firepower_threat_defense_software 310
- gcp 299
- firepower_threat_defense 298
- openclaw 172
- commerce 104
- netweaver_application_server_abap 102
- commerce_b2b 89
Top packages
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-32689 | high | — | 8.0 | 1mo ago | Phoenix: Long-poll NDJSON body splitting causes large memory allocation | |||
| CVE-2026-26007 | high | — | 8.0 | 1mo ago | python-cryptography vulnerability | |||
| CVE-2026-25679 | high | — | 8.0 | 1mo ago | url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. | |||
| CVE-2026-35414 | high | — | 8.0 | 1mo ago | OpenSSH vulnerabilities | |||
| CVE-2026-20889 | high | — | 8.0 | 1mo ago | RHSA-2026:13284: LibRaw security update (Important) | |||
| CVE-2026-35386 | high | — | 8.0 | 1mo ago | OpenSSH vulnerabilities | |||
| CVE-2026-35387 | high | — | 8.0 | 1mo ago | OpenSSH vulnerabilities | |||
| CVE-2026-24660 | high | — | 8.0 | 1mo ago | RHSA-2026:13284: LibRaw security update (Important) | |||
| CVE-2026-35388 | high | — | 8.0 | 1mo ago | OpenSSH vulnerabilities | |||
| CVE-2026-23136 | high | — | 8.0 | 1mo ago | Linux kernel vulnerabilities | |||
| CVE-2026-35385 | high | — | 8.0 | 1mo ago | OpenSSH vulnerabilities | |||
| CVE-2026-7608 | high | 8.0 | 8.0 | 1mo ago | A vulnerability was detected in TRENDnet TEW-821DAP up to 1.12B01. The affected element is the function tools_diagnostic. The manipulation results in os command injection. The exploit is now public a… | |||
| CVE-2026-39804 | high | — | 8.0 | 1mo ago | Bandit's unbounded WebSocket inflate causes BEAM OOM with a single frame | |||
| CVE-2026-42786 | high | — | 8.0 | 1mo ago | Bandit Buffers Unbounded WebSocket Continuation Frames, Allowing Unauthenticated Memory Exhaustion | |||
| CVE-2026-43001 | high | 8.0 | 8.0 | 1mo ago | An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authentica… | |||
| CVE-2026-41587 | high | — | 8.0 | 1mo ago | CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution | |||
| CVE-2026-0204 | high | 8.0 | 8.0 | 1mo ago | A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions. | |||
| CVE-2026-42524 | high | 8.0 | 8.0 | 1mo ago | Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file | |||
| CVE-2026-34982 | high | — | 8.0 | 1mo ago | RHSA-2026:11509: vim security update (Important) | |||
| CVE-2026-21413 | high | — | 8.0 | 1mo ago | Important: LibRaw security update | |||
| CVE-2026-24450 | high | — | 8.0 | 1mo ago | Important: LibRaw security update | |||
| CVE-2026-5394 | high | — | 8.0 | 1mo ago | Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save | |||
| CVE-2026-7069 | high | 8.0 | 8.0 | 1mo ago | A security flaw has been discovered in D-Link DIR-825 up to 3.00b32. This impacts the function AddPortMapping of the file upnpsoap.c of the component miniupnpd. Performing a manipulation of the argum… | |||
| CVE-2026-6771 | high | — | 8.0 | 1mo ago | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6761 | high | — | 8.0 | 1mo ago | Privilege escalation in the Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6750 | high | — | 8.0 | 1mo ago | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6100 | high | — | 8.0 | 1mo ago | Important: python3.12 security update | |||
| CVE-2026-6776 | high | — | 8.0 | 1mo ago | Incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6765 | high | — | 8.0 | 1mo ago | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6770 | high | — | 8.0 | 1mo ago | Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6769 | high | — | 8.0 | 1mo ago | Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6762 | high | — | 8.0 | 1mo ago | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6759 | high | — | 8.0 | 1mo ago | Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-33186 | high | — | 8.0 | 1mo ago | gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go serv… | |||
| CVE-2026-6767 | high | — | 8.0 | 1mo ago | Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6763 | high | — | 8.0 | 1mo ago | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6757 | high | — | 8.0 | 1mo ago | Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6748 | high | — | 8.0 | 1mo ago | Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6746 | high | — | 8.0 | 1mo ago | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-4786 | high | — | 8.0 | 1mo ago | Important: python3.12 security update | |||
| CVE-2026-6747 | high | — | 8.0 | 1mo ago | Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6749 | high | — | 8.0 | 1mo ago | Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thund… | |||
| CVE-2026-6772 | high | — | 8.0 | 1mo ago | Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6752 | high | — | 8.0 | 1mo ago | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6754 | high | — | 8.0 | 1mo ago | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6764 | high | — | 8.0 | 1mo ago | Incorrect boundary conditions in the DOM: Device Interfaces component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6751 | high | — | 8.0 | 1mo ago | Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6766 | high | — | 8.0 | 1mo ago | Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-6753 | high | — | 8.0 | 1mo ago | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. | |||
| CVE-2026-23902 | high | — | 8.0 | 1mo ago | Apache DolphinScheduler has an Incorrect Authorization Vulnerability | |||
| CVE-2026-40466 | high | — | 8.0 | 1mo ago | Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection | |||
| CVE-2026-41044 | high | — | 8.0 | 1mo ago | Apache ActiveMQ Vulnerable to Code Injection | |||
| CVE-2026-21728 | high | — | 8.0 | 2mo ago | Grafana Tempo has an Uncontrolled Resource Consumption issue | |||
| CVE-2026-22020 | high | — | 8.0 | 2mo ago | RHSA-2026:9686: java-17-openjdk security update (Important) | |||
| CVE-2026-32282 | high | — | 8.0 | 2mo ago | On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. … | |||
| CVE-2026-27144 | high | — | 8.0 | 2mo ago | The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves… | |||
| CVE-2026-27143 | high | — | 8.0 | 2mo ago | Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading … | |||
| CVE-2026-27140 | high | — | 8.0 | 2mo ago | SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. | |||
| CVE-2026-32283 | high | — | 8.0 | 2mo ago | If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a … | |||
| CVE-2026-32280 | high | — | 8.0 | 2mo ago | During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial … | |||
| CVE-2026-22021 | high | — | 8.0 | 2mo ago | OpenJDK 17 vulnerabilities | |||
| CVE-2026-34282 | high | — | 8.0 | 2mo ago | OpenJDK 17 vulnerabilities | |||
| CVE-2026-22013 | high | — | 8.0 | 2mo ago | OpenJDK 17 vulnerabilities | |||
| CVE-2026-22007 | high | — | 8.0 | 2mo ago | OpenJDK 17 vulnerabilities | |||
| CVE-2026-34268 | high | — | 8.0 | 2mo ago | OpenJDK 17 vulnerabilities | |||
| CVE-2026-22016 | high | — | 8.0 | 2mo ago | OpenJDK 17 vulnerabilities | |||
| CVE-2026-22018 | high | — | 8.0 | 2mo ago | OpenJDK 17 vulnerabilities | |||
| CVE-2026-32172 | high | 8.0 | 8.0 | 2mo ago | Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network. | |||
| CVE-2026-34587 | high | — | 8.0 | 2mo ago | Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering | |||
| CVE-2026-35368 | high | — | 8.0 | 2mo ago | A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before drop… | |||
| CVE-2026-35338 | high | — | 8.0 | 2mo ago | A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not … | |||
| CVE-2026-35341 | high | — | 8.0 | 2mo ago | A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target pa… | |||
| CVE-2026-22753 | high | — | 8.0 | 2mo ago | Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers | |||
| CVE-2026-22754 | high | — | 8.0 | 2mo ago | Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules | |||
| CVE-2026-26740 | high | — | 8.0 | 2mo ago | Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without valida… | |||
| CVE-2026-22008 | high | — | 8.0 | 2mo ago | CRaC JDK 25 vulnerabilities | |||
| CVE-2026-31019 | high | — | 8.0 | 2mo ago | Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions | |||
| CVE-2026-34839 | high | — | 8.0 | 2mo ago | Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS | |||
| CVE-2026-34403 | high | — | 8.0 | 2mo ago | Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints | |||
| CVE-2026-27622 | high | — | 8.0 | 2mo ago | OpenEXR vulnerabilities | |||
| CVE-2026-25917 | high | — | 8.0 | 2mo ago | Apache Airflow allows code execution through crafted XCom payloads | |||
| CVE-2026-40897 | high | — | 8.0 | 2mo ago | Unsafe object property setter in mathjs | |||
| CVE-2026-33412 | high | — | 8.0 | 2mo ago | Important: vim security update | |||
| CVE-2026-40926 | high | — | 8.0 | 2mo ago | WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script) | |||
| CVE-2026-27912 | high | 8.0 | 8.0 | 2mo ago | Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network. | |||
| CVE-2026-33826 | high | 8.0 | 8.0 | 2mo ago | Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network. | |||
| CVE-2026-34984 | high | — | 8.0 | 2mo ago | External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine | |||
| CVE-2026-5732 | high | — | 8.0 | 2mo ago | Important: thunderbird security update | |||
| CVE-2026-5731 | high | — | 8.0 | 2mo ago | Important: thunderbird security update | |||
| CVE-2026-5734 | high | — | 8.0 | 2mo ago | Important: thunderbird security update | |||
| CVE-2026-5295 | high | 8.0 | 8.0 | 2mo ago | A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wc_PKCS7_DecryptOri() function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipie… | |||
| CVE-2026-29129 | high | — | 8.0 | 2mo ago | Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.… | |||
| CVE-2026-24880 | high | — | 8.0 | 2mo ago | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through … | |||
| CVE-2026-40070 | high | — | 8.0 | 2mo ago | bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths) | |||
| CVE-2026-27904 | high | — | 8.0 | 2mo ago | RHSA-2026:8339: nodejs:20 security update (Important) | |||
| CVE-2026-21711 | high | — | 8.0 | 2mo ago | RHSA-2026:7670: nodejs:24 security update (Important) | |||
| CVE-2026-21714 | high | — | 8.0 | 2mo ago | RHSA-2026:7670: nodejs:24 security update (Important) | |||
| CVE-2026-1528 | high | — | 8.0 | 2mo ago | RHSA-2026:7670: nodejs:24 security update (Important) | |||
| CVE-2026-1525 | high | — | 8.0 | 2mo ago | RHSA-2026:7670: nodejs:24 security update (Important) | |||
| CVE-2026-21715 | high | — | 8.0 | 2mo ago | RHSA-2026:7670: nodejs:24 security update (Important) |