2026 CVE Vulnerabilities
64,952 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-41267 | CRITICAL | 9.8 | 0.3% | Apr 23, 2026 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mas... |
| CVE-2026-41266 | HIGH | 7.5 | 0.3% | Apr 23, 2026 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-... |
| CVE-2026-41265 | CRITICAL | 9.8 | 0.5% | Apr 23, 2026 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific fl... |
| CVE-2026-41264 | CRITICAL | 9.8 | 0.5% | Apr 23, 2026 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific fl... |
| CVE-2026-41138 | HIGH | 8.8 | 0.6% | Apr 23, 2026 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remo... |
| CVE-2026-41137 | HIGH | 8.8 | 1.5% | Apr 23, 2026 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent al... |
| CVE-2026-25874 | CRITICAL | 9.8 | 15.5% | Apr 23, 2026 | LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.load... |
| CVE-2026-6074 | CRITICAL | 9.8 | 0.6% | Apr 23, 2026 | Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_fi... |
| CVE-2026-41259 | HIGH | 7.5 | 0.2% | Apr 23, 2026 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Masto... |
| CVE-2026-41247 | CRITICAL | 9.8 | 1.6% | Apr 23, 2026 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contai... |
| CVE-2026-41246 | HIGH | 8.1 | 0.5% | Apr 23, 2026 | Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Cont... |
| CVE-2026-41241 | MEDIUM | 5.4 | 0.2% | Apr 23, 2026 | pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submissio... |
| CVE-2026-41213 | MEDIUM | 5.9 | 0.3% | Apr 23, 2026 | @node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7... |
| CVE-2026-41205 | HIGH | 7.5 | 0.4% | Apr 23, 2026 | Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path trave... |
| CVE-2026-41173 | MEDIUM | 5.9 | 0.3% | Apr 23, 2026 | The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0... |
| CVE-2026-41078 | MEDIUM | 5.9 | 0.2% | Apr 23, 2026 | OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow... |
| CVE-2026-40894 | MEDIUM | 5.3 | 0.5% | Apr 23, 2026 | OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Exte... |
| CVE-2026-40886 | HIGH | 7.7 | 0.4% | Apr 23, 2026 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.... |
| CVE-2026-33694 | HIGH | 7.8 | 0.1% | Apr 23, 2026 | This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privile... |
| CVE-2026-31173 | MEDIUM | 6.5 | 0.3% | Apr 23, 2026 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm... |
| CVE-2026-31169 | MEDIUM | 6.5 | 0.3% | Apr 23, 2026 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm... |
| CVE-2026-31168 | MEDIUM | 6.5 | 0.3% | Apr 23, 2026 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm... |
| CVE-2026-31167 | MEDIUM | 6.5 | 0.3% | Apr 23, 2026 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm... |
| CVE-2026-31166 | MEDIUM | 6.5 | 0.3% | Apr 23, 2026 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm... |
| CVE-2026-31163 | MEDIUM | 6.5 | 0.3% | Apr 23, 2026 | An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary comm... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now