2026 CVE Vulnerabilities
70,504 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-27975 | CRITICAL | 9.8 | 0.5% | Feb 26, 2026 | Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access... |
| CVE-2026-27974 | MEDIUM | 4.8 | 0.2% | Feb 26, 2026 | Audiobookshelf is a self-hosted audiobook and podcast server. A cross-site scripting (XSS) vulnerability exists in versi... |
| CVE-2026-27963 | MEDIUM | 4.8 | 0.2% | Feb 26, 2026 | Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists i... |
| CVE-2026-27465 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s configuration A... |
| CVE-2026-25963 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s ce... |
| CVE-2026-24004 | MEDIUM | 5.3 | 0.3% | Feb 26, 2026 | Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub... |
| CVE-2026-23999 | MEDIUM | 5.5 | 0.1% | Feb 26, 2026 | Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs ... |
| CVE-2026-1779 | HIGH | 8.1 | 0.3% | Feb 26, 2026 | The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and in... |
| CVE-2026-2506 | MEDIUM | 6.1 | 0.2% | Feb 26, 2026 | The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin... |
| CVE-2026-2499 | MEDIUM | 4.4 | 0.2% | Feb 26, 2026 | The Custom Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up ... |
| CVE-2026-2498 | MEDIUM | 4.4 | 0.2% | Feb 26, 2026 | The WP Social Meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions ... |
| CVE-2026-2489 | MEDIUM | 4.4 | 0.2% | Feb 26, 2026 | The TP2WP Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Watched domains' textarea ... |
| CVE-2026-2029 | MEDIUM | 6.4 | 0.2% | Feb 26, 2026 | The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[labb_... |
| CVE-2026-27973 | MEDIUM | 4.8 | 0.2% | Feb 26, 2026 | Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists i... |
| CVE-2026-27970 | MEDIUM | 6.1 | 0.5% | Feb 26, 2026 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other... |
| CVE-2026-27969 | HIGH | 8.8 | 0.4% | Feb 26, 2026 | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with... |
| CVE-2026-27968 | MEDIUM | 4.3 | 0.2% | Feb 26, 2026 | Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, Rep... |
| CVE-2026-27966 | CRITICAL | 9.8 | 33.7% | Feb 26, 2026 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent nod... |
| CVE-2026-27965 | CRITICAL | 9.9 | 0.4% | Feb 26, 2026 | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with... |
| CVE-2026-27961 | HIGH | 8.8 | 0.3% | Feb 26, 2026 | Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior... |
| CVE-2026-27959 | HIGH | 7.5 | 0.3% | Feb 26, 2026 | Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API... |
| CVE-2026-27954 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52,... |
| CVE-2026-27952 | CRITICAL | 9.9 | 0.5% | Feb 26, 2026 | Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability e... |
| CVE-2026-27948 | MEDIUM | 6.1 | 0.2% | Feb 26, 2026 | Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via U... |
| CVE-2026-27943 | MEDIUM | 6.5 | 0.3% | Feb 26, 2026 | OpenEMR is a free and open source electronic health records and medical practice management application. In versions up ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now