2026 CVE Vulnerabilities
75,943 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-28132 | MEDIUM | 5.3 | 0.2% | Feb 26, 2026 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Ph... |
| CVE-2026-28131 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-e... |
| CVE-2026-28083 | MEDIUM | 6.5 | 0.1% | Feb 26, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome... |
| CVE-2026-1698 | MEDIUM | 6.1 | 0.2% | Feb 26, 2026 | A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 throu... |
| CVE-2026-1697 | MEDIUM | 6.5 | 0.1% | Feb 26, 2026 | The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in versio... |
| CVE-2026-1696 | MEDIUM | 6.1 | 0.1% | Feb 26, 2026 | Some HTTP security headers are not properly set by the web server when sending responses to the client application. |
| CVE-2026-1695 | MEDIUM | 6.1 | 0.2% | Feb 26, 2026 | An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of P... |
| CVE-2026-1694 | MEDIUM | 4.3 | 0.2% | Feb 26, 2026 | HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of t... |
| CVE-2026-1693 | HIGH | 7.5 | 0.3% | Feb 26, 2026 | The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVu... |
| CVE-2026-1692 | MEDIUM | 6.1 | 0.1% | Feb 26, 2026 | A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebSc... |
| CVE-2026-25191 | HIGH | 8.4 | 0.1% | Feb 26, 2026 | The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is... |
| CVE-2026-23703 | HIGH | 8.5 | 0.1% | Feb 26, 2026 | The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability.... |
| CVE-2026-1311 | HIGH | 8.8 | 0.7% | Feb 26, 2026 | The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 ... |
| CVE-2026-2356 | MEDIUM | 5.3 | 0.2% | Feb 26, 2026 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vuln... |
| CVE-2026-27975 | CRITICAL | 9.8 | 0.5% | Feb 26, 2026 | Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access... |
| CVE-2026-27974 | MEDIUM | 4.8 | 0.2% | Feb 26, 2026 | Audiobookshelf is a self-hosted audiobook and podcast server. A cross-site scripting (XSS) vulnerability exists in versi... |
| CVE-2026-27963 | MEDIUM | 4.8 | 0.2% | Feb 26, 2026 | Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists i... |
| CVE-2026-27465 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s configuration A... |
| CVE-2026-25963 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s ce... |
| CVE-2026-24004 | MEDIUM | 5.3 | 0.3% | Feb 26, 2026 | Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub... |
| CVE-2026-23999 | MEDIUM | 5.5 | 0.1% | Feb 26, 2026 | Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs ... |
| CVE-2026-1779 | HIGH | 8.1 | 0.3% | Feb 26, 2026 | The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and in... |
| CVE-2026-2506 | MEDIUM | 6.1 | 0.2% | Feb 26, 2026 | The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin... |
| CVE-2026-2499 | MEDIUM | 4.4 | 0.2% | Feb 26, 2026 | The Custom Logo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up ... |
| CVE-2026-2498 | MEDIUM | 4.4 | 0.2% | Feb 26, 2026 | The WP Social Meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now