2026 CVE Vulnerabilities
65,368 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-101044 | HIGH | 7.1 | — | Sep 27, 2026 | pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.... |
| CVE-2026-101043 | HIGH | 7.4 | — | Sep 27, 2026 | pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the htt... |
| CVE-2026-88778 | HIGH | 7.5 | 0.4% | Sep 27, 2026 | Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This i... |
| CVE-2026-88777 | CRITICAL | 9.8 | 0.4% | Sep 27, 2026 | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects AD... |
| CVE-2026-88776 | CRITICAL | 9.8 | 0.4% | Sep 27, 2026 | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC... |
| CVE-2026-88775 | CRITICAL | 9.8 | 0.4% | Sep 27, 2026 | Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1... |
| CVE-2026-88774 | HIGH | 7.2 | 0.2% | Sep 27, 2026 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 1... |
| CVE-2026-88773 | CRITICAL | 10 | 0.4% | Sep 27, 2026 | Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC a... |
| CVE-2026-88772 | HIGH | 8.1 | — | Sep 27, 2026 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 1... |
| CVE-2026-88771 | CRITICAL | 9.8 | — | Sep 27, 2026 | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: b... |
| CVE-2026-101050 | MEDIUM | 6.5 | — | Sep 27, 2026 | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credent... |
| CVE-2026-101049 | MEDIUM | 6.5 | — | Sep 27, 2026 | Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing... |
| CVE-2026-101042 | MEDIUM | 6.4 | — | Sep 27, 2026 | Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-ba... |
| CVE-2026-101041 | MEDIUM | 6.3 | 0.2% | Sep 27, 2026 | The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check... |
| CVE-2026-101033 | MEDIUM | 4.3 | — | Sep 27, 2026 | KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati... |
| CVE-2026-101032 | HIGH | 7 | — | Sep 27, 2026 | navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Atta... |
| CVE-2026-100872 | HIGH | 7.5 | — | Sep 27, 2026 | Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthentic... |
| CVE-2026-100871 | HIGH | 8.8 | — | Sep 27, 2026 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT token... |
| CVE-2026-100870 | HIGH | 8.8 | — | Sep 27, 2026 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the r... |
| CVE-2026-100869 | MEDIUM | 5.9 | — | Sep 27, 2026 | Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing cust... |
| CVE-2026-100868 | MEDIUM | 6.3 | — | Sep 27, 2026 | Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in si... |
| CVE-2026-100867 | LOW | 3.3 | — | Sep 27, 2026 | spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before renderi... |
| CVE-2026-100866 | LOW | 3.3 | — | Sep 27, 2026 | onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, ... |
| CVE-2026-97165 | MEDIUM | 5.3 | — | Sep 27, 2026 | Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” par... |
| CVE-2026-97164 | HIGH | 7 | 0.3% | Sep 27, 2026 | Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extensio... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now