2026 CVE Vulnerabilities
71,031 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-27156 | MEDIUM | 6.1 | 0.2% | Feb 24, 2026 | NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side... |
| CVE-2026-26222 | CRITICAL | 9.8 | 0.7% | Feb 24, 2026 | Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP... |
| CVE-2026-25603 | MEDIUM | 6.6 | 0.3% | Feb 24, 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys ... |
| CVE-2026-27590 | CRITICAL | 9.8 | 0.5% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting... |
| CVE-2026-27589 | MEDIUM | 6.5 | 0.2% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (def... |
| CVE-2026-27588 | CRITICAL | 9.1 | 0.4% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request ma... |
| CVE-2026-27587 | CRITICAL | 9.1 | 0.4% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request ma... |
| CVE-2026-27586 | CRITICAL | 9.1 | 0.3% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `Clien... |
| CVE-2026-27585 | MEDIUM | 6.5 | 0.3% | Feb 24, 2026 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine ... |
| CVE-2026-27571 | HIGH | 7.5 | 0.5% | Feb 24, 2026 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling ... |
| CVE-2026-27521 | HIGH | 7.5 | 0.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior do not implement rate limiting or accoun... |
| CVE-2026-27520 | HIGH | 8.7 | 0.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side c... |
| CVE-2026-27519 | HIGH | 8.7 | 0.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded i... |
| CVE-2026-27518 | MEDIUM | 5.1 | 0.1% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior lack CSRF protections for state-changing... |
| CVE-2026-27517 | MEDIUM | 6.1 | 0.1% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior reflect unsanitized user input in the we... |
| CVE-2026-27516 | HIGH | 8.6 | 0.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext withi... |
| CVE-2026-27515 | CRITICAL | 9.3 | 0.3% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session ide... |
| CVE-2026-27507 | CRITICAL | 9.8 | 0.4% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain hard-coded administrative creden... |
| CVE-2026-23678 | HIGH | 8.8 | 1.2% | Feb 24, 2026 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerabilit... |
| CVE-2026-3102 | HIGH | 8.8 | 3.4% | Feb 24, 2026 | A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the fil... |
| CVE-2026-3101 | HIGH | 8.8 | 3.5% | Feb 24, 2026 | A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping ... |
| CVE-2026-27732 | HIGH | 8.1 | 0.2% | Feb 24, 2026 | WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a... |
| CVE-2026-27584 | HIGH | 7.5 | 0.4% | Feb 24, 2026 | Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualB... |
| CVE-2026-27568 | MEDIUM | 6.1 | 0.2% | Feb 24, 2026 | WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses P... |
| CVE-2026-27567 | MEDIUM | 4.8 | 0.3% | Feb 24, 2026 | Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SS... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now