2026 CVE Vulnerabilities
79,936 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-27965 | CRITICAL | 9.9 | 0.4% | Feb 26, 2026 | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with... |
| CVE-2026-27961 | HIGH | 8.8 | 0.3% | Feb 26, 2026 | Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior... |
| CVE-2026-27959 | HIGH | 7.5 | 0.3% | Feb 26, 2026 | Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API... |
| CVE-2026-27954 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52,... |
| CVE-2026-27952 | CRITICAL | 9.9 | 0.5% | Feb 26, 2026 | Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability e... |
| CVE-2026-27948 | MEDIUM | 6.1 | 0.2% | Feb 26, 2026 | Copyparty is a portable file server. In versions prior to 1.20.9, an XSS allows for reflected cross-site scripting via U... |
| CVE-2026-27943 | MEDIUM | 6.5 | 0.3% | Feb 26, 2026 | OpenEMR is a free and open source electronic health records and medical practice management application. In versions up ... |
| CVE-2026-27942 | HIGH | 7.5 | 0.5% | Feb 26, 2026 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based li... |
| CVE-2026-27941 | CRITICAL | 9.9 | 0.4% | Feb 26, 2026 | OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in Open... |
| CVE-2026-27938 | HIGH | 7.7 | 0.8% | Feb 26, 2026 | WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository con... |
| CVE-2026-27904 | HIGH | 7.5 | 0.5% | Feb 26, 2026 | minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version... |
| CVE-2026-27903 | HIGH | 7.5 | 0.5% | Feb 26, 2026 | minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version... |
| CVE-2026-27902 | MEDIUM | 5.4 | 0.2% | Feb 26, 2026 | Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly esca... |
| CVE-2026-27901 | MEDIUM | 6.1 | 0.2% | Feb 26, 2026 | Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textConte... |
| CVE-2026-27900 | HIGH | 7.7 | 0.5% | Feb 26, 2026 | The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackS... |
| CVE-2026-27899 | HIGH | 8.8 | 0.3% | Feb 26, 2026 | WireGuard Portal (or wg-portal) is a web-based configuration portal for WireGuard server management. Prior to version 2.... |
| CVE-2026-27887 | MEDIUM | 6.9 | 0.2% | Feb 26, 2026 | Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin... |
| CVE-2026-22728 | MEDIUM | 4.9 | 0.4% | Feb 26, 2026 | Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotati... |
| CVE-2026-1557 | HIGH | 7.5 | 1.7% | Feb 26, 2026 | The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 ... |
| CVE-2026-27946 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's... |
| CVE-2026-27945 | MEDIUM | 6.5 | 0.2% | Feb 26, 2026 | ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta i... |
| CVE-2026-27896 | HIGH | 7.5 | 0.3% | Feb 26, 2026 | The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prio... |
| CVE-2026-27888 | HIGH | 7.5 | 0.3% | Feb 26, 2026 | pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can cra... |
| CVE-2026-27884 | MEDIUM | 5.3 | 0.3% | Feb 26, 2026 | NetExec is a network execution tool. Prior to version 1.5.1, the module spider_plus improperly creates the output file a... |
| CVE-2026-27840 | MEDIUM | 4.3 | 0.1% | Feb 26, 2026 | ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now