2026 CVE Vulnerabilities
82,850 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-3223 | HIGH | 7.8 | 0.1% | Feb 27, 2026 | Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer. |
| CVE-2026-2751 | CRITICAL | 9.8 | 0.3% | Feb 27, 2026 | Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web ... |
| CVE-2026-2831 | MEDIUM | 4.9 | 0.3% | Feb 27, 2026 | The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, an... |
| CVE-2026-24352 | CRITICAL | 9.8 | 0.4% | Feb 27, 2026 | PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the sa... |
| CVE-2026-24351 | MEDIUM | 5.4 | 0.2% | Feb 27, 2026 | PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can injec... |
| CVE-2026-24350 | MEDIUM | 5.4 | 0.2% | Feb 27, 2026 | PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file... |
| CVE-2026-1434 | MEDIUM | 6.1 | 0.2% | Feb 27, 2026 | Omega-PSIR is vulnerable to Reflected XSS via the lang parameter. An attacker can craft a malicious URL that, when opene... |
| CVE-2026-21660 | CRITICAL | 9.8 | 0.2% | Feb 27, 2026 | A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in... |
| CVE-2026-21659 | CRITICAL | 9.8 | 0.9% | Feb 27, 2026 | Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in John... |
| CVE-2026-1305 | MEDIUM | 5.3 | 0.4% | Feb 27, 2026 | The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and inclu... |
| CVE-2026-2383 | MEDIUM | 6.4 | 0.2% | Feb 27, 2026 | The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all ve... |
| CVE-2026-2362 | MEDIUM | 6.4 | 0.2% | Feb 27, 2026 | The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute... |
| CVE-2026-2252 | HIGH | 7.5 | 0.3% | Feb 27, 2026 | An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via craft... |
| CVE-2026-2251 | CRITICAL | 9.8 | 0.4% | Feb 27, 2026 | Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows... |
| CVE-2026-21658 | CRITICAL | 9.8 | 0.6% | Feb 27, 2026 | Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Joh... |
| CVE-2026-21657 | CRITICAL | 9.8 | 0.4% | Feb 27, 2026 | Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD al... |
| CVE-2026-21656 | CRITICAL | 9.8 | 0.4% | Feb 27, 2026 | Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD al... |
| CVE-2026-21654 | CRITICAL | 9.8 | 1.5% | Feb 27, 2026 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Cont... |
| CVE-2026-1627 | HIGH | 8.1 | 0.2% | Feb 27, 2026 | An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromis... |
| CVE-2026-1626 | CRITICAL | 9.1 | 0.2% | Feb 27, 2026 | An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or ma... |
| CVE-2026-27776 | HIGH | 8.8 | 0.4% | Feb 27, 2026 | IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only... |
| CVE-2026-0980 | HIGH | 8.8 | 0.8% | Feb 27, 2026 | A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An... |
| CVE-2026-0871 | MEDIUM | 4.9 | 0.3% | Feb 27, 2026 | A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can vi... |
| CVE-2026-3302 | MEDIUM | 6.1 | 0.4% | Feb 27, 2026 | A weakness has been identified in SourceCodester Doctor Appointment System 1.0. Affected by this issue is some unknown f... |
| CVE-2026-3301 | CRITICAL | 9.8 | 4.0% | Feb 27, 2026 | A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the functi... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now