2026 CVE Vulnerabilities
64,803 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-41654 | HIGH | 8.1 | 0.4% | May 7, 2026 | Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (de... |
| CVE-2026-41650 | MEDIUM | 6.1 | 0.2% | May 7, 2026 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version ... |
| CVE-2026-41519 | MEDIUM | 5.4 | 0.2% | May 7, 2026 | Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions ... |
| CVE-2026-41505 | HIGH | 8.7 | 0.3% | May 7, 2026 | RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation ... |
| CVE-2026-41422 | HIGH | 8.3 | 0.3% | May 7, 2026 | Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column an... |
| CVE-2026-36458 | CRITICAL | 9.8 | 0.4% | May 7, 2026 | ChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated i... |
| CVE-2026-32686 | MEDIUM | 6.9 | 0.3% | May 7, 2026 | Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The ... |
| CVE-2026-6795 | CRITICAL | 9.6 | 0.2% | May 7, 2026 | URL redirection to untrusted site ('open redirect') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive... |
| CVE-2026-41685 | MEDIUM | 4.3 | 0.3% | May 7, 2026 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by auth... |
| CVE-2026-41684 | MEDIUM | 6.5 | 0.4% | May 7, 2026 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline back... |
| CVE-2026-41648 | MEDIUM | 5 | 0.3% | May 7, 2026 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs... |
| CVE-2026-41647 | MEDIUM | 6.5 | 0.4% | May 7, 2026 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an ... |
| CVE-2026-41589 | CRITICAL | 9.6 | 0.4% | May 7, 2026 | Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP... |
| CVE-2026-41554 | HIGH | 7.1 | 0.1% | May 7, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder all... |
| CVE-2026-41490 | HIGH | 8.3 | 0.3% | May 7, 2026 | Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster C... |
| CVE-2026-30496 | CRITICAL | 9.8 | 0.3% | May 7, 2026 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that... |
| CVE-2026-30495 | HIGH | 8.8 | 0.2% | May 7, 2026 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP... |
| CVE-2026-8094 | CRITICAL | 9.8 | 0.4% | May 7, 2026 | Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2. |
| CVE-2026-8093 | HIGH | 8.1 | 0.3% | May 7, 2026 | Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume th... |
| CVE-2026-8092 | HIGH | 8.1 | 0.4% | May 7, 2026 | Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed ... |
| CVE-2026-8091 | CRITICAL | 9.8 | 0.5% | May 7, 2026 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thund... |
| CVE-2026-8090 | HIGH | 7.3 | 0.3% | May 7, 2026 | Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, ... |
| CVE-2026-6002 | HIGH | 8.8 | 0.3% | May 7, 2026 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in DivvyDrive Information Te... |
| CVE-2026-5791 | MEDIUM | 6.5 | 0.1% | May 7, 2026 | Cross-Site request forgery (CSRF) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross Site... |
| CVE-2026-5784 | HIGH | 8.8 | 0.3% | May 7, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Informa... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now