2026 CVE Vulnerabilities
79,826 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-26704 | CRITICAL | 9.8 | 0.4% | Mar 2, 2026 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php. |
| CVE-2026-0655 | HIGH | 8 | 0.3% | Mar 2, 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (... |
| CVE-2026-0654 | HIGH | 8 | 0.3% | Mar 2, 2026 | Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be execute... |
| CVE-2026-28401 | MEDIUM | 5.4 | 0.2% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via... |
| CVE-2026-28399 | HIGH | 8.8 | 0.3% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator ... |
| CVE-2026-28398 | MEDIUM | 5.4 | 0.1% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments... |
| CVE-2026-28397 | MEDIUM | 5.4 | 0.2% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html withou... |
| CVE-2026-28396 | MEDIUM | 6.5 | 0.2% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not rev... |
| CVE-2026-28361 | MEDIUM | 6.3 | 0.2% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not valid... |
| CVE-2026-28360 | MEDIUM | 5.3 | 0.2% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored i... |
| CVE-2026-28359 | MEDIUM | 5.4 | 0.1% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor r... |
| CVE-2026-28358 | MEDIUM | 5.3 | 0.6% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint return... |
| CVE-2026-28357 | MEDIUM | 5.4 | 0.1% | Mar 2, 2026 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists i... |
| CVE-2026-28286 | CRITICAL | 9.9 | 0.4% | Mar 2, 2026 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, t... |
| CVE-2026-26708 | CRITICAL | 9.8 | 0.3% | Mar 2, 2026 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php. |
| CVE-2026-26700 | CRITICAL | 9.8 | 0.4% | Mar 2, 2026 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php. |
| CVE-2026-24105 | CRITICAL | 9.8 | 1.7% | Mar 2, 2026 | An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not check... |
| CVE-2026-23865 | MEDIUM | 5.3 | 0.1% | Mar 2, 2026 | An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13... |
| CVE-2026-21385 | HIGH | 7.8 | 1.1% | Mar 2, 2026 | Memory corruption while using alignments for memory allocation. |
| CVE-2026-28412 | HIGH | 7.5 | 0.3% | Mar 2, 2026 | Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server imposes no limi... |
| CVE-2026-28403 | HIGH | 7.6 | 0.1% | Mar 2, 2026 | Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server (`ws://127.0.0.... |
| CVE-2026-26720 | CRITICAL | 9.8 | 0.8% | Mar 2, 2026 | An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts mod... |
| CVE-2026-26701 | CRITICAL | 9.8 | 0.5% | Mar 2, 2026 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user... |
| CVE-2026-26699 | HIGH | 7.2 | 0.6% | Mar 2, 2026 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin... |
| CVE-2026-24112 | CRITICAL | 9.8 | 0.5% | Mar 2, 2026 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now