2026 CVE Vulnerabilities
79,853 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-27638 | HIGH | 7.1 | 0.3% | Feb 26, 2026 | Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoi... |
| CVE-2026-3263 | HIGH | 8.8 | 0.3% | Feb 26, 2026 | A vulnerability was found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected by this... |
| CVE-2026-3262 | HIGH | 8.8 | 0.4% | Feb 26, 2026 | A vulnerability has been found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected is... |
| CVE-2026-3261 | CRITICAL | 9.8 | 0.3% | Feb 26, 2026 | A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settin... |
| CVE-2026-28227 | LOW | 2.7 | 3.1% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publ... |
| CVE-2026-28219 | MEDIUM | 4.3 | 0.2% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an improper author... |
| CVE-2026-28218 | MEDIUM | 5.4 | 0.2% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access c... |
| CVE-2026-27835 | MEDIUM | 4.3 | 0.3% | Feb 26, 2026 | wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet`... |
| CVE-2026-27457 | MEDIUM | 4.3 | 0.3% | Feb 26, 2026 | Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`... |
| CVE-2026-27449 | HIGH | 7.5 | 0.4% | Feb 26, 2026 | Umbraco Engage is a business intelligence platform. A vulnerability has been identified in Umbraco Engage prior to versi... |
| CVE-2026-27154 | MEDIUM | 6.1 | 0.2% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name c... |
| CVE-2026-27153 | LOW | 2.7 | 0.2% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, moderators could e... |
| CVE-2026-25741 | HIGH | 7.1 | 0.3% | Feb 26, 2026 | Zulip is an open-source team collaboration tool. Prior to commit bf28c82dc9b1f630fa8e9106358771b20a0040f7, the API endpo... |
| CVE-2026-27162 | MEDIUM | 4.9 | 0.2% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `posts_nearby` was... |
| CVE-2026-27152 | LOW | 3.8 | 0.2% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-p... |
| CVE-2026-27151 | LOW | 2.7 | 0.2% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` a... |
| CVE-2026-27150 | LOW | 3.8 | 0.2% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_... |
| CVE-2026-27149 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in P... |
| CVE-2026-27021 | MEDIUM | 5.3 | 0.3% | Feb 26, 2026 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoin... |
| CVE-2026-22207 | CRITICAL | 9.8 | 0.4% | Feb 26, 2026 | OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows u... |
| CVE-2026-22206 | HIGH | 8.8 | 0.6% | Feb 26, 2026 | SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to exe... |
| CVE-2026-22205 | HIGH | 8.7 | 0.5% | Feb 26, 2026 | SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows una... |
| CVE-2026-27510 | HIGH | 8.8 | 0.3% | Feb 26, 2026 | Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.dogg... |
| CVE-2026-27509 | HIGH | 8.5 | 0.5% | Feb 26, 2026 | Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorizat... |
| CVE-2026-27141 | HIGH | 7.5 | 0.5% | Feb 26, 2026 | Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now