2026 CVE Database
Every Critical and High CVE published in 2026, with the signals you need to decide what to fix first.
73 CVEs found
| CVE | Severity | Product | Weakness | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-103366 the affected product | HIGH7.5 | the affected product | CWE-639 Insecure Direct Object Reference | 0.5% | Oct 14, 2026 |
| CVE-2026-109164 the affected product | HIGH7.1 | the affected product | CWE-639 Insecure Direct Object Reference | 0.3% | Oct 12, 2026 |
| CVE-2026-78023 Dell Policy Manager For Secure Connect Gateway | HIGH7.1 | Dell Policy Manager For Secure Connect Gateway | CWE-639 Insecure Direct Object Reference | 0.2% | Oct 9, 2026 |
| CVE-2026-102775 Phoca Cart | HIGH8.7 | Phoca Cart | CWE-639 Insecure Direct Object Reference | 0.4% | Oct 5, 2026 |
| CVE-2026-86725 the affected product | HIGH7.1 | the affected product | CWE-639 Insecure Direct Object Reference | 0.4% | Sep 8, 2026 |
| CVE-2026-86720 the affected product | HIGH8.6 | the affected product | CWE-639 Insecure Direct Object Reference | 0.4% | Sep 8, 2026 |
| CVE-2026-85594 Traefik | HIGH7.0 | Traefik | CWE-639 Insecure Direct Object Reference | 0.5% | Sep 4, 2026 |
| CVE-2026-69857 Microsoft Azure Cosmos Db | HIGH8.5 | Microsoft Azure Cosmos Db | CWE-639 Insecure Direct Object Reference | 0.6% | Sep 3, 2026 |
| CVE-2026-85214 the affected product | HIGH7.2 | the affected product | CWE-639 Insecure Direct Object Reference | 0.5% | Sep 3, 2026 |
| CVE-2026-85211 the affected product | HIGH8.3 | the affected product | CWE-639 Insecure Direct Object Reference | 0.4% | Sep 3, 2026 |
| CVE-2026-85182 the affected product | HIGH7.7 | the affected product | CWE-639 Insecure Direct Object Reference | 0.4% | Sep 3, 2026 |
| CVE-2026-72001 the affected product | HIGH8.6 | the affected product | CWE-639 Insecure Direct Object Reference | 0.5% | Aug 31, 2026 |
| CVE-2026-18904 Langflow | HIGH8.2 | Langflow | CWE-639 Insecure Direct Object Reference | 0.3% | Aug 28, 2026 |
| CVE-2026-77079 N8n | HIGH7.4 | N8n | CWE-639 Insecure Direct Object Reference | 0.5% | Aug 20, 2026 |
| CVE-2026-58650 Microsoft Visual Studio Code | HIGH7.8 | Microsoft Visual Studio Code | CWE-639 Insecure Direct Object Reference | 0.3% | Aug 11, 2026 |
| CVE-2026-70476 Flowiseai Flowise | HIGH8.3 | Flowiseai Flowise | CWE-284 Improper Access Control | 0.5% | Aug 4, 2026 |
| CVE-2026-69258 Flowiseai Flowise | HIGH8.8 | Flowiseai Flowise | CWE-639 Insecure Direct Object Reference | 0.7% | Aug 4, 2026 |
| CVE-2026-69250 Flowiseai Flowise | HIGH8.5 | Flowiseai Flowise | CWE-639 Insecure Direct Object Reference | 0.6% | Aug 4, 2026 |
| CVE-2026-57510 the affected product | HIGH8.7 | the affected product | CWE-639 Insecure Direct Object Reference | 0.6% | Jul 28, 2026 |
| CVE-2026-65016 N8n | HIGH7.7 | N8n | CWE-639 Insecure Direct Object Reference | 0.4% | Jul 22, 2026 |
| CVE-2026-13381 Vsee Clinic | HIGH8.7 | Vsee Clinic | CWE-639 Insecure Direct Object Reference | 0.4% | Jul 20, 2026 |
| CVE-2026-63763 Surrealdb | HIGH7.5 | Surrealdb | CWE-639 Insecure Direct Object Reference | 0.5% | Jul 20, 2026 |
| CVE-2026-54052 N8n-Mcp | CRITICAL9.9 | N8n-Mcp | CWE-639 Insecure Direct Object Reference | 0.4% | Jul 15, 2026 |
| CVE-2026-59216 Openwebui Open Webui | HIGH7.7 | Openwebui Open Webui | CWE-94 Code Injection | 0.5% | Jul 9, 2026 |
| CVE-2026-60104 Bitwarden Server | CRITICAL9.3 | Bitwarden Server | CWE-639 Insecure Direct Object Reference | 0.4% | Jul 8, 2026 |
| CVE-2026-12411 Canonical Lxd | HIGH8.4 | Canonical Lxd | CWE-639 Insecure Direct Object Reference | 0.3% | Jun 26, 2026 |
| CVE-2026-45732 N8n | HIGH8.3 | N8n | CWE-639 Insecure Direct Object Reference | 0.4% | Jun 23, 2026 |
| CVE-2026-56424 Misp-Project Misp | HIGH7.1 | Misp-Project Misp | CWE-639 Insecure Direct Object Reference | 0.5% | Jun 22, 2026 |
| CVE-2026-45832 Trychroma Chromadb | HIGH8.8 | Trychroma Chromadb | CWE-639 Insecure Direct Object Reference | 0.5% | Jun 12, 2026 |
| CVE-2026-45830 Trychroma Chromadb | HIGH8.8 | Trychroma Chromadb | CWE-639 Insecure Direct Object Reference | 0.5% | Jun 12, 2026 |
| CVE-2026-7787 Langflow | HIGH7.5 | Langflow | CWE-639 Insecure Direct Object Reference | 0.4% | Jun 11, 2026 |
| CVE-2026-53471 Kebev2v Migration Assessment | CRITICAL9.6 | Kebev2v Migration Assessment | CWE-639 Insecure Direct Object Reference | 0.5% | Jun 10, 2026 |
| CVE-2026-53470 Kebev2v Migration Assessment | CRITICAL9.6 | Kebev2v Migration Assessment | CWE-639 Insecure Direct Object Reference | 0.5% | Jun 10, 2026 |
| CVE-2026-44083 Qnap Qumagie | HIGH8.7 | Qnap Qumagie | CWE-639 Insecure Direct Object Reference | 0.6% | Jun 9, 2026 |
| CVE-2026-46441 Flowiseai Flowise | HIGH7.6 | Flowiseai Flowise | CWE-284 Improper Access Control | 0.4% | Jun 8, 2026 |
| CVE-2026-42863 Flowiseai Flowise | HIGH7.6 | Flowiseai Flowise | CWE-284 Improper Access Control | 0.4% | Jun 8, 2026 |
| CVE-2026-42861 Flowiseai Flowise | HIGH7.6 | Flowiseai Flowise | CWE-284 Improper Access Control | 0.4% | Jun 8, 2026 |
| CVE-2026-42097 Sparxsystems Pro Cloud Server | CRITICAL9.3 | Sparxsystems Pro Cloud Server | CWE-639 Insecure Direct Object Reference | 0.9% | May 19, 2026 |
| CVE-2026-41949 Dify | HIGH8.2 | Dify | CWE-639 Insecure Direct Object Reference | 0.6% | May 18, 2026 |
| CVE-2026-42463 Fit2cloud Sqlbot | HIGH8.6 | Fit2cloud Sqlbot | CWE-639 Insecure Direct Object Reference | 0.4% | May 13, 2026 |
| CVE-2026-44400 Mailenable | HIGH8.7 | Mailenable | CWE-639 Insecure Direct Object Reference | 0.6% | May 8, 2026 |
| CVE-2026-41279 Flowiseai Flowise | HIGH8.2 | Flowiseai Flowise | CWE-639 Insecure Direct Object Reference | 0.4% | Apr 23, 2026 |
| CVE-2026-41277 Flowiseai Flowise | HIGH7.6 | Flowiseai Flowise | CWE-284 Improper Access Control | 0.5% | Apr 23, 2026 |
| CVE-2026-41267 Flowiseai Flowise | HIGH8.1 | Flowiseai Flowise | CWE-639 Insecure Direct Object Reference | 0.5% | Apr 23, 2026 |
| CVE-2026-5845 Github Enterprise Server | HIGH7.2 | Github Enterprise Server | CWE-639 Insecure Direct Object Reference | 0.5% | Apr 21, 2026 |
| CVE-2026-39942 Monospace Directus | HIGH8.5 | Monospace Directus | CWE-284 Improper Access Control | 0.4% | Apr 9, 2026 |
| CVE-2026-35478 Inventree Project Inventree | HIGH8.3 | Inventree Project Inventree | CWE-639 Insecure Direct Object Reference | 0.4% | Apr 8, 2026 |
| CVE-2026-39384 Freescout | HIGH7.6 | Freescout | CWE-639 Insecure Direct Object Reference | 0.3% | Apr 7, 2026 |
| CVE-2026-34444 Scoder Lupa | HIGH7.9 | Scoder Lupa | CWE-284 Improper Access Control | 0.8% | Apr 6, 2026 |
| CVE-2026-25197 Mygardyn Cloud Api | CRITICAL9.3 | Mygardyn Cloud Api | CWE-639 Insecure Direct Object Reference | 0.3% | Apr 3, 2026 |
Page 1 of 2
Your next credential
Earn your free CTEM certification.
Knowing the CVE is step one. Learn to scope, prioritize, validate and mobilize fixes with a free CTEM certification.
Free to takePublicly verifiable
Beginner / Practitioner / Program Leader
Explore certifications