2026 CVE Vulnerabilities
65,293 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-101910 | MEDIUM | 6.9 | — | Sep 28, 2026 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, th... |
| CVE-2026-101909 | HIGH | 8.3 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFo... |
| CVE-2026-101908 | MEDIUM | 6.9 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs ... |
| CVE-2026-101907 | HIGH | 7 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses t... |
| CVE-2026-101906 | HIGH | 8.2 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy appl... |
| CVE-2026-101905 | HIGH | 7.6 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib... |
| CVE-2026-101904 | MEDIUM | 6.9 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function ... |
| CVE-2026-101903 | HIGH | 8.2 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular express... |
| CVE-2026-101902 | MEDIUM | 6.9 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-ins... |
| CVE-2026-101901 | HIGH | 8.2 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not insta... |
| CVE-2026-101900 | MEDIUM | 6.9 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherite... |
| CVE-2026-101898 | HIGH | 7 | — | Sep 28, 2026 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup d... |
| CVE-2026-101102 | MEDIUM | 6.3 | — | Sep 28, 2026 | A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function run_code of the com... |
| CVE-2026-101101 | MEDIUM | 4.3 | — | Sep 28, 2026 | A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of t... |
| CVE-2026-101100 | MEDIUM | 5.4 | — | Sep 28, 2026 | A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsM... |
| CVE-2026-101099 | MEDIUM | 4.3 | — | Sep 28, 2026 | A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParse... |
| CVE-2026-88816 | — | — | — | Sep 28, 2026 | DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref us... |
| CVE-2026-88815 | — | — | — | Sep 28, 2026 | DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to S... |
| CVE-2026-87969 | HIGH | 8.6 | — | Sep 28, 2026 | An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execu... |
| CVE-2026-87114 | HIGH | 7.1 | — | Sep 28, 2026 | A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untr... |
| CVE-2026-86102 | CRITICAL | 9.3 | — | Sep 28, 2026 | An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access t... |
| CVE-2026-85644 | — | — | — | Sep 28, 2026 | XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS... |
| CVE-2026-58464 | — | — | — | Sep 28, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-58463 | — | — | — | Sep 28, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-55096 | HIGH | 7.1 | — | Sep 28, 2026 | fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools acce... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now