2026 CVE Vulnerabilities
74,274 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-26017 | MEDIUM | 6.3 | 0.4% | Mar 6, 2026 | CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS acce... |
| CVE-2026-24696 | HIGH | 8.7 | 0.4% | Mar 6, 2026 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc... |
| CVE-2026-20882 | HIGH | 8.7 | 0.4% | Mar 6, 2026 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc... |
| CVE-2026-20748 | HIGH | 8.6 | 0.3% | Mar 6, 2026 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to ... |
| CVE-2026-2754 | HIGH | 7.5 | 0.5% | Mar 6, 2026 | Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. ... |
| CVE-2026-2753 | HIGH | 7.5 | 0.5% | Mar 6, 2026 | An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to ... |
| CVE-2026-2752 | MEDIUM | 5.3 | 0.3% | Mar 6, 2026 | Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send ... |
| CVE-2026-26051 | CRITICAL | 9.8 | 0.9% | Mar 6, 2026 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat... |
| CVE-2026-1799 | — | — | — | Mar 6, 2026 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate has been determined not to be a v... |
| CVE-2026-28106 | MEDIUM | 4.7 | 0.3% | Mar 6, 2026 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This ... |
| CVE-2026-28080 | MEDIUM | 4.3 | 0.2% | Mar 6, 2026 | Missing Authorization vulnerability in Rank Math Rank Math SEO PRO allows Exploiting Incorrectly Configured Access Contr... |
| CVE-2026-1468 | MEDIUM | 5.1 | 0.2% | Mar 6, 2026 | QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, w... |
| CVE-2026-3589 | HIGH | 7.5 | 0.1% | Mar 6, 2026 | The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allo... |
| CVE-2026-23925 | HIGH | 8.1 | 0.3% | Mar 6, 2026 | An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configur... |
| CVE-2026-2830 | MEDIUM | 6.1 | 0.2% | Mar 6, 2026 | The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflect... |
| CVE-2026-2331 | CRITICAL | 9.8 | 0.9% | Mar 6, 2026 | An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileac... |
| CVE-2026-2330 | CRITICAL | 9.4 | 0.7% | Mar 6, 2026 | An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelis... |
| CVE-2026-29183 | MEDIUM | 6.1 | 0.6% | Mar 6, 2026 | SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability... |
| CVE-2026-29074 | HIGH | 7.5 | 0.6% | Mar 6, 2026 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version ... |
| CVE-2026-29073 | HIGH | 8.8 | 0.3% | Mar 6, 2026 | SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directl... |
| CVE-2026-29062 | HIGH | 7.5 | 0.6% | Mar 6, 2026 | jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Pr... |
| CVE-2026-29059 | HIGH | 7.5 | 2.6% | Mar 6, 2026 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to vers... |
| CVE-2026-29068 | HIGH | 7.5 | 0.3% | Mar 6, 2026 | PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, there is a stack b... |
| CVE-2026-29065 | CRITICAL | 9.1 | 0.5% | Mar 6, 2026 | changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, a Zip Slip vulnerabili... |
| CVE-2026-29058 | CRITICAL | 9.8 | 2.1% | Mar 6, 2026 | AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now