2026 CVE Vulnerabilities
64,779 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-41250 | MEDIUM | 5.7 | 0.3% | May 11, 2026 | Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front is vulnerable to stor... |
| CVE-2026-40612 | MEDIUM | 5.5 | 0.2% | May 11, 2026 | jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth... |
| CVE-2026-3609 | HIGH | 7.8 | 0.2% | May 11, 2026 | Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vuln... |
| CVE-2026-3048 | LOW | 3.8 | 0.3% | May 11, 2026 | An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3... |
| CVE-2026-38569 | MEDIUM | 5.4 | 0.2% | May 11, 2026 | HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fi... |
| CVE-2026-38568 | HIGH | 8.1 | 0.2% | May 11, 2026 | HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on ... |
| CVE-2026-38567 | CRITICAL | 9.8 | 0.5% | May 11, 2026 | HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated di... |
| CVE-2026-38566 | HIGH | 8.1 | 0.2% | May 11, 2026 | HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms (password change a... |
| CVE-2026-36983 | HIGH | 7.3 | 1.2% | May 11, 2026 | D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd. The man... |
| CVE-2026-36962 | HIGH | 7.3 | 0.4% | May 11, 2026 | SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve... |
| CVE-2026-34095 | MEDIUM | 6.1 | 0.2% | May 11, 2026 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/... |
| CVE-2026-34094 | LOW | 3.8 | 0.2% | May 11, 2026 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Art... |
| CVE-2026-34093 | MEDIUM | 5.3 | 0.2% | May 11, 2026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulne... |
| CVE-2026-30635 | HIGH | 8.1 | 1.0% | May 11, 2026 | Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via ... |
| CVE-2026-2393 | HIGH | 7.1 | 0.3% | May 11, 2026 | A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` fun... |
| CVE-2026-2291 | HIGH | 7.3 | 0.8% | May 11, 2026 | dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS... |
| CVE-2026-44738 | HIGH | 7.7 | 0.3% | May 11, 2026 | Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.page... |
| CVE-2026-44737 | MEDIUM | 6.2 | 0.3% | May 11, 2026 | grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Gra... |
| CVE-2026-42845 | HIGH | 7.7 | 0.6% | May 11, 2026 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-con... |
| CVE-2026-42843 | HIGH | 8.8 | 0.4% | May 11, 2026 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configur... |
| CVE-2026-42842 | MEDIUM | 5.4 | 0.1% | May 11, 2026 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) v... |
| CVE-2026-42603 | HIGH | 8.8 | 0.3% | May 11, 2026 | OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and m... |
| CVE-2026-42349 | HIGH | 8.1 | 0.2% | May 11, 2026 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related auth... |
| CVE-2026-36906 | MEDIUM | 6.1 | 0.3% | May 11, 2026 | Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log ... |
| CVE-2026-33362 | HIGH | 8.6 | 0.2% | May 11, 2026 | In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now