2026 CVE Vulnerabilities
70,951 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-27588 | CRITICAL | 9.1 | 0.4% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request ma... |
| CVE-2026-27587 | CRITICAL | 9.1 | 0.4% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request ma... |
| CVE-2026-27586 | CRITICAL | 9.1 | 0.3% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `Clien... |
| CVE-2026-27585 | MEDIUM | 6.5 | 0.3% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine ... |
| CVE-2026-27571 | HIGH | 7.5 | 0.5% | Feb 24, 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling ... |
| CVE-2026-27521 | HIGH | 7.5 | 0.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior do not implement rate limiting or accoun... |
| CVE-2026-27520 | HIGH | 8.7 | 0.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side c... |
| CVE-2026-27519 | HIGH | 8.7 | 0.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded i... |
| CVE-2026-27518 | MEDIUM | 5.1 | 0.1% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior lack CSRF protections for state-changing... |
| CVE-2026-27517 | MEDIUM | 6.1 | 0.1% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior reflect unsanitized user input in the we... |
| CVE-2026-27516 | HIGH | 8.6 | 0.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext withi... |
| CVE-2026-27515 | CRITICAL | 9.3 | 0.3% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session ide... |
| CVE-2026-27507 | CRITICAL | 9.8 | 0.4% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain hard-coded administrative creden... |
| CVE-2026-23678 | HIGH | 8.8 | 1.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerabilit... |
| CVE-2026-3102 | HIGH | 8.8 | 3.4% | Feb 24, 2026 | A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the fil... |
| CVE-2026-3101 | HIGH | 8.8 | 3.5% | Feb 24, 2026 | A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping ... |
| CVE-2026-27732 | HIGH | 8.1 | 0.2% | Feb 24, 2026 | WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a... |
| CVE-2026-27584 | HIGH | 7.5 | 0.4% | Feb 24, 2026 | Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualB... |
| CVE-2026-27568 | MEDIUM | 6.1 | 0.2% | Feb 24, 2026 | WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses P... |
| CVE-2026-27567 | MEDIUM | 4.8 | 0.3% | Feb 24, 2026 | Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SS... |
| CVE-2026-27483 | HIGH | 8.8 | 11.1% | Feb 24, 2026 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a p... |
| CVE-2026-27208 | HIGH | 7.8 | 0.7% | Feb 24, 2026 | bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involvi... |
| CVE-2026-0402 | MEDIUM | 4.9 | 0.3% | Feb 24, 2026 | A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall. |
| CVE-2026-0401 | MEDIUM | 4.9 | 0.3% | Feb 24, 2026 | A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall. |
| CVE-2026-0400 | MEDIUM | 4.9 | 0.4% | Feb 24, 2026 | A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall. |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now