2026 CVE Vulnerabilities
83,491 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-26314 | HIGH | 7.5 | 0.6% | Feb 19, 2026 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulne... |
| CVE-2026-26275 | HIGH | 7.5 | 0.2% | Feb 19, 2026 | httpsig-hyper is a hyper extension for http message signatures. An issue was discovered in `httpsig-hyper` prior to vers... |
| CVE-2026-2738 | MEDIUM | 5.6 | 0.1% | Feb 19, 2026 | Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packet... |
| CVE-2026-27476 | CRITICAL | 9.8 | 2.6% | Feb 19, 2026 | RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded ins... |
| CVE-2026-27440 | MEDIUM | 6.5 | 0.2% | Feb 19, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred ... |
| CVE-2026-27387 | MEDIUM | 5.4 | 0.2% | Feb 19, 2026 | Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configu... |
| CVE-2026-27368 | MEDIUM | 5.3 | 0.2% | Feb 19, 2026 | Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd comi... |
| CVE-2026-27360 | MEDIUM | 5.9 | 0.2% | Feb 19, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Galler... |
| CVE-2026-27343 | HIGH | 7.5 | 0.4% | Feb 19, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in... |
| CVE-2026-27328 | MEDIUM | 5.3 | 0.2% | Feb 19, 2026 | Missing Authorization vulnerability in DevsBlink EduBlink edublink allows Exploiting Incorrectly Configured Access Contr... |
| CVE-2026-27327 | MEDIUM | 4.3 | 0.2% | Feb 19, 2026 | Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Contr... |
| CVE-2026-27114 | HIGH | 7.5 | 0.3% | Feb 19, 2026 | NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOf... |
| CVE-2026-27014 | MEDIUM | 5.5 | 0.2% | Feb 19, 2026 | NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOff... |
| CVE-2026-26313 | HIGH | 7.5 | 0.6% | Feb 19, 2026 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an atta... |
| CVE-2026-26312 | MEDIUM | 6.5 | 0.4% | Feb 19, 2026 | Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0... |
| CVE-2026-26286 | HIGH | 8.5 | 0.3% | Feb 19, 2026 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode... |
| CVE-2026-26282 | MEDIUM | 6.6 | 0.2% | Feb 19, 2026 | NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an ou... |
| CVE-2026-27013 | MEDIUM | 6.1 | 0.3% | Feb 19, 2026 | Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content ... |
| CVE-2026-26318 | HIGH | 8.8 | 1.1% | Feb 19, 2026 | systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command... |
| CVE-2026-26280 | HIGH | 7.8 | 1.2% | Feb 19, 2026 | systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection v... |
| CVE-2026-26278 | HIGH | 7.5 | 0.8% | Feb 19, 2026 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based li... |
| CVE-2026-26267 | HIGH | 7.5 | 0.3% | Feb 19, 2026 | soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` ma... |
| CVE-2026-26205 | HIGH | 7.1 | 0.4% | Feb 19, 2026 | opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability i... |
| CVE-2026-26203 | MEDIUM | 6.5 | 0.1% | Feb 19, 2026 | PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer und... |
| CVE-2026-26202 | HIGH | 7.5 | 0.4% | Feb 19, 2026 | Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user c... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now