2026 CVE Vulnerabilities
65,368 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-35620 | MEDIUM | 5.4 | 0.4% | Apr 10, 2026 | OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handle... |
| CVE-2026-35619 | MEDIUM | 5.3 | 0.3% | Apr 10, 2026 | OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to e... |
| CVE-2026-35602 | HIGH | 7.1 | 0.3% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses th... |
| CVE-2026-35601 | MEDIUM | 4.1 | 0.2% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCale... |
| CVE-2026-35600 | MEDIUM | 5.4 | 0.2% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into M... |
| CVE-2026-35599 | MEDIUM | 6.5 | 0.3% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function use... |
| CVE-2026-35598 | MEDIUM | 4.3 | 0.2% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesB... |
| CVE-2026-35597 | HIGH | 7.5 | 0.3% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanis... |
| CVE-2026-35596 | MEDIUM | 4.3 | 0.3% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a... |
| CVE-2026-35595 | HIGH | 8.3 | 0.3% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/projec... |
| CVE-2026-22560 | MEDIUM | 5.3 | 0.3% | Apr 10, 2026 | An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by... |
| CVE-2026-40228 | LOW | 3.3 | 0.2% | Apr 10, 2026 | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p em... |
| CVE-2026-40227 | MEDIUM | 5.5 | 0.2% | Apr 10, 2026 | In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that... |
| CVE-2026-40226 | MEDIUM | 6.4 | 0.1% | Apr 10, 2026 | In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. |
| CVE-2026-40225 | MEDIUM | 6.4 | 0.1% | Apr 10, 2026 | In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel outp... |
| CVE-2026-40224 | HIGH | 7.3 | 0.1% | Apr 10, 2026 | In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach ... |
| CVE-2026-40223 | MEDIUM | 5.5 | 0.1% | Apr 10, 2026 | In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exi... |
| CVE-2026-40023 | MEDIUM | 5.3 | 0.5% | Apr 10, 2026 | Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions... |
| CVE-2026-40021 | MEDIUM | 5.3 | 0.8% | Apr 10, 2026 | Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLa... |
| CVE-2026-35594 | MEDIUM | 6.5 | 0.3% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (Get... |
| CVE-2026-34727 | CRITICAL | 9.1 | 0.3% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full ... |
| CVE-2026-34481 | HIGH | 7.5 | 0.6% | Apr 10, 2026 | Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions u... |
| CVE-2026-34480 | HIGH | 7.5 | 0.9% | Apr 10, 2026 | Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to an... |
| CVE-2026-34479 | HIGH | 7.5 | 0.5% | Apr 10, 2026 | The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standa... |
| CVE-2026-34478 | HIGH | 7.5 | 0.8% | Apr 10, 2026 | Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now