2026 CVE Database
Every Critical and High CVE published in 2026, with the signals you need to decide what to fix first.
100 CVEs found
| CVE | Severity | Product | Weakness | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-104764 the affected product | HIGH7.2 | the affected product | CWE-502 Deserialization of Untrusted Data | 0.6% | Oct 14, 2026 |
| CVE-2026-109361 the affected product | HIGH7.0 | the affected product | CWE-502 Deserialization of Untrusted Data | 0.2% | Oct 12, 2026 |
| CVE-2026-13046 Watchguard Fireware | HIGH7.5 | Watchguard Fireware | CWE-502 Deserialization of Untrusted Data | 0.4% | Sep 30, 2026 |
| CVE-2026-100846 Project-Monai Monai | HIGH8.8 | Project-Monai Monai | CWE-502 Deserialization of Untrusted Data | 0.3% | Sep 27, 2026 |
| CVE-2026-82093 Ibm Datastage On Cloud Pak For Data | HIGH8.8 | Ibm Datastage On Cloud Pak For Data | CWE-502 Deserialization of Untrusted Data | 0.4% | Sep 24, 2026 |
| CVE-2026-70416 Dell Objectscale | CRITICAL10.0 | Dell Objectscale | CWE-502 Deserialization of Untrusted Data | 0.8% | Sep 16, 2026 |
| CVE-2026-87874 the affected product | HIGH8.1 | the affected product | CWE-502 Deserialization of Untrusted Data | 0.7% | Sep 9, 2026 |
| CVE-2026-12650 Ivanti Neurons For Itsm | CRITICAL9.9 | Ivanti Neurons For Itsm | CWE-502 Deserialization of Untrusted Data | 1.6% | Sep 8, 2026 |
| CVE-2026-77092 Commvault | HIGH7.3 | Commvault | CWE-502 Deserialization of Untrusted Data | 0.3% | Sep 8, 2026 |
| CVE-2026-59285 Vmware Spring For Graphql | HIGH8.1 | Vmware Spring For Graphql | CWE-502 Deserialization of Untrusted Data | 0.4% | Aug 27, 2026 |
| CVE-2026-67579 Ash-Hq Ash Framework | HIGH7.5 | Ash-Hq Ash Framework | CWE-89 SQL Injection | 0.6% | Aug 12, 2026 |
| CVE-2026-58076 Apache Airflow | HIGH8.8 | Apache Airflow | CWE-502 Deserialization of Untrusted Data | 0.5% | Aug 12, 2026 |
| CVE-2026-12118 Ibm Webmethods Integration | CRITICAL9.8 | Ibm Webmethods Integration | CWE-502 Deserialization of Untrusted Data | 0.8% | Jul 30, 2026 |
| CVE-2026-65883 Aimy-Extensions Aimy Captcha-Less Form Guard | CRITICAL10.0 | Aimy-Extensions Aimy Captcha-Less Form Guard | CWE-502 Deserialization of Untrusted Data | 0.8% | Jul 29, 2026 |
| CVE-2026-58163 Apache Traffic Server | HIGH8.3 | Apache Traffic Server | CWE-502 Deserialization of Untrusted Data | 0.7% | Jul 29, 2026 |
| CVE-2026-14974 Ibm Websphere Application Server | HIGH8.1 | Ibm Websphere Application Server | CWE-502 Deserialization of Untrusted Data | 0.7% | Jul 28, 2026 |
| CVE-2026-28220 Wazuh | HIGH8.4 | Wazuh | CWE-502 Deserialization of Untrusted Data | 0.7% | Jul 20, 2026 |
| CVE-2026-45077 Sensiolabs Symfony | HIGH8.3 | Sensiolabs Symfony | CWE-502 Deserialization of Untrusted Data | 0.7% | Jul 14, 2026 |
| CVE-2026-54118 Microsoft Sql Server 2016 | CRITICAL9.8 | Microsoft Sql Server 2016 | CWE-502 Deserialization of Untrusted Data | 1.5% | Jul 14, 2026 |
| CVE-2026-54117 Microsoft Sql Server 2016 | CRITICAL9.8 | Microsoft Sql Server 2016 | CWE-502 Deserialization of Untrusted Data | 1.5% | Jul 14, 2026 |
| CVE-2026-59827 Metabase | CRITICAL9.9 | Metabase | CWE-502 Deserialization of Untrusted Data | 3.8% | Jul 9, 2026 |
| CVE-2026-12481 Keras | CRITICAL9.8 | Keras | CWE-502 Deserialization of Untrusted Data | 0.7% | Jul 3, 2026 |
| CVE-2026-14265 Amazon Advanced Jdbc Wrapper | HIGH7.7 | Amazon Advanced Jdbc Wrapper | CWE-502 Deserialization of Untrusted Data | 0.7% | Jul 1, 2026 |
| CVE-2026-13759 Ibm Websphere Extreme Scale | HIGH7.5 | Ibm Websphere Extreme Scale | CWE-502 Deserialization of Untrusted Data | 0.5% | Jun 30, 2026 |
| CVE-2025-71378 Mmaitre314 Picklescan | HIGH7.6 | Mmaitre314 Picklescan | CWE-502 Deserialization of Untrusted Data | 0.5% | Jun 21, 2026 |
| CVE-2025-71357 Mmaitre314 Picklescan | HIGH7.6 | Mmaitre314 Picklescan | CWE-502 Deserialization of Untrusted Data | 0.4% | Jun 21, 2026 |
| CVE-2025-71348 Mmaitre314 Picklescan | HIGH7.6 | Mmaitre314 Picklescan | CWE-502 Deserialization of Untrusted Data | 0.6% | Jun 21, 2026 |
| CVE-2026-8024 the affected product | CRITICAL9.3 | the affected product | CWE-502 Deserialization of Untrusted Data | 0.7% | Jun 18, 2026 |
| CVE-2026-12569 Exploited PTC Windchill and FlexPLM | CRITICAL9.3 | PTC Windchill and FlexPLM | CWE-20 Improper Input Validation | 46.0% | Jun 18, 2026 |
| CVE-2026-10748 Sonatype Nexus Repository Manager | HIGH8.6 | Sonatype Nexus Repository Manager | CWE-502 Deserialization of Untrusted Data | 0.3% | Jun 16, 2026 |
| CVE-2026-41699 Vmware Spring For Graphql | HIGH8.1 | Vmware Spring For Graphql | CWE-502 Deserialization of Untrusted Data | 0.7% | Jun 11, 2026 |
| CVE-2026-40993 Vmware Spring Security | HIGH7.3 | Vmware Spring Security | CWE-502 Deserialization of Untrusted Data | 0.3% | Jun 10, 2026 |
| CVE-2026-41855 Vmware Spring Framework | HIGH8.1 | Vmware Spring Framework | CWE-502 Deserialization of Untrusted Data | 0.5% | Jun 9, 2026 |
| CVE-2026-49121 Amd Aiter | CRITICAL9.2 | Amd Aiter | CWE-502 Deserialization of Untrusted Data | 1.5% | Jun 1, 2026 |
| CVE-2026-41104 Microsoft Planetary Computer | CRITICAL10.0 | Microsoft Planetary Computer | CWE-502 Deserialization of Untrusted Data | 1.7% | May 22, 2026 |
| CVE-2026-8135 Concretecms Concrete Cms | HIGH8.9 | Concretecms Concrete Cms | CWE-502 Deserialization of Untrusted Data | 0.7% | May 21, 2026 |
| CVE-2026-24163 Nvidia Tensorrt Llm | HIGH7.5 | Nvidia Tensorrt Llm | CWE-502 Deserialization of Untrusted Data | 0.6% | May 20, 2026 |
| CVE-2025-33255 Nvidia Tensorrt Llm | HIGH7.5 | Nvidia Tensorrt Llm | CWE-502 Deserialization of Untrusted Data | 0.6% | May 20, 2026 |
| CVE-2026-31223 Snorkel | HIGH8.8 | Snorkel | CWE-502 Deserialization of Untrusted Data | 0.7% | May 12, 2026 |
| CVE-2026-31222 Snorkel | HIGH8.8 | Snorkel | CWE-502 Deserialization of Untrusted Data | 0.7% | May 12, 2026 |
| CVE-2026-31221 Lightningai Pytorch Lightning | HIGH7.8 | Lightningai Pytorch Lightning | CWE-502 Deserialization of Untrusted Data | 0.6% | May 12, 2026 |
| CVE-2026-7818 Pgadmin 4 | HIGH7.3 | Pgadmin 4 | CWE-502 Deserialization of Untrusted Data | 0.4% | May 11, 2026 |
| CVE-2026-41486 Anyscale Ray | HIGH8.9 | Anyscale Ray | CWE-94 Code Injection | 0.7% | May 8, 2026 |
| CVE-2026-41586 Hyperledger Fabric | CRITICAL9.3 | Hyperledger Fabric | CWE-502 Deserialization of Untrusted Data | 0.6% | May 7, 2026 |
| CVE-2026-34084 Phpoffice Phpspreadsheet | CRITICAL9.2 | Phpoffice Phpspreadsheet | CWE-502 Deserialization of Untrusted Data | 0.8% | May 5, 2026 |
| CVE-2026-33819 Microsoft Bing | CRITICAL10.0 | Microsoft Bing | CWE-502 Deserialization of Untrusted Data | 1.5% | Apr 23, 2026 |
| CVE-2026-25874 Huggingface Lerobot | CRITICAL9.3 | Huggingface Lerobot | CWE-502 Deserialization of Untrusted Data | 1.0% | Apr 23, 2026 |
| CVE-2026-6023 Progress Telerik Ui For Asp.Net Ajax | HIGH8.1 | Progress Telerik Ui For Asp.Net Ajax | CWE-502 Deserialization of Untrusted Data | 0.7% | Apr 22, 2026 |
| CVE-2026-40901 Dataease | HIGH7.5 | Dataease | CWE-502 Deserialization of Untrusted Data | 0.8% | Apr 16, 2026 |
| CVE-2026-34615 Adobe Connect | CRITICAL9.3 | Adobe Connect | CWE-502 Deserialization of Untrusted Data | 1.8% | Apr 14, 2026 |
Page 1 of 2
Your next credential
Earn your free CTEM certification.
Knowing the CVE is step one. Learn to scope, prioritize, validate and mobilize fixes with a free CTEM certification.
Free to takePublicly verifiable
Beginner / Practitioner / Program Leader
Explore certifications