2026 CVE Vulnerabilities
75,947 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-27900 | HIGH | 7.7 | 0.5% | Feb 26, 2026 | The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackS... |
| CVE-2026-27899 | HIGH | 8.8 | 0.3% | Feb 26, 2026 | WireGuard Portal (or wg-portal) is a web-based configuration portal for WireGuard server management. Prior to version 2.... |
| CVE-2026-27887 | MEDIUM | 6.9 | 0.2% | Feb 26, 2026 | Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin... |
| CVE-2026-22728 | MEDIUM | 4.9 | 0.4% | Feb 26, 2026 | Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotati... |
| CVE-2026-1557 | HIGH | 7.5 | 1.7% | Feb 26, 2026 | The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 ... |
| CVE-2026-27946 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's... |
| CVE-2026-27945 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta i... |
| CVE-2026-27896 | HIGH | 7.5 | 0.3% | Feb 26, 2026 | The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prio... |
| CVE-2026-27888 | HIGH | 7.5 | 0.3% | Feb 26, 2026 | pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can cra... |
| CVE-2026-27884 | MEDIUM | 5.3 | 0.3% | Feb 26, 2026 | NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file a... |
| CVE-2026-27840 | MEDIUM | 4.3 | 0.1% | Feb 26, 2026 | ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.... |
| CVE-2026-27837 | CRITICAL | 9.8 | 0.3% | Feb 26, 2026 | Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete ... |
| CVE-2026-27831 | HIGH | 7.5 | 0.4% | Feb 26, 2026 | rldns is an open source DNS server. Version 1.3 has a heap-based out-of-bounds read that leads to denial of service. Ver... |
| CVE-2026-27830 | HIGH | 8 | 0.5% | Feb 26, 2026 | c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `ja... |
| CVE-2026-27829 | HIGH | 7.2 | 0.3% | Feb 26, 2026 | Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing `image.domai... |
| CVE-2026-27976 | HIGH | 8.8 | 0.5% | Feb 26, 2026 | Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`... |
| CVE-2026-27967 | HIGH | 7.1 | 0.2% | Feb 26, 2026 | Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (`read_file`, `e... |
| CVE-2026-27933 | MEDIUM | 6.8 | 0.3% | Feb 26, 2026 | Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on ... |
| CVE-2026-27821 | HIGH | 7.8 | 0.3% | Feb 26, 2026 | GPAC is an open-source multimedia framework. In versions up to and including 26.02.0, a stack buffer overflow occurs dur... |
| CVE-2026-27818 | HIGH | 7.5 | 0.2% | Feb 26, 2026 | TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A v... |
| CVE-2026-27812 | CRITICAL | 9.1 | 0.2% | Feb 26, 2026 | Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vuln... |
| CVE-2026-27809 | CRITICAL | 9.1 | 0.4% | Feb 26, 2026 | psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file conta... |
| CVE-2026-27808 | HIGH | 8.6 | 0.5% | Feb 26, 2026 | Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{I... |
| CVE-2026-27804 | CRITICAL | 9.1 | 0.2% | Feb 26, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version... |
| CVE-2026-27800 | HIGH | 7.4 | 0.3% | Feb 26, 2026 | Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionali... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now