2026 CVE Vulnerabilities
83,493 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-26203 | MEDIUM | 6.5 | 0.1% | Feb 19, 2026 | PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer und... |
| CVE-2026-26202 | HIGH | 7.5 | 0.4% | Feb 19, 2026 | Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user c... |
| CVE-2026-26201 | HIGH | 7.5 | 0.3% | Feb 19, 2026 | emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 3.21.2, multiple shared maps are access... |
| CVE-2026-26200 | HIGH | 7.8 | 0.4% | Feb 19, 2026 | HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 c... |
| CVE-2026-26193 | MEDIUM | 5.4 | 0.2% | Feb 19, 2026 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.... |
| CVE-2026-26192 | MEDIUM | 5.4 | 0.2% | Feb 19, 2026 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.... |
| CVE-2026-26189 | HIGH | 8.1 | 1.3% | Feb 19, 2026 | Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulne... |
| CVE-2026-26063 | HIGH | 8.8 | 0.3% | Feb 19, 2026 | CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attack... |
| CVE-2026-27475 | CRITICAL | 9.2 | 0.8% | Feb 19, 2026 | SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterat... |
| CVE-2026-27474 | MEDIUM | 6.1 | 0.3% | Feb 19, 2026 | SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8... |
| CVE-2026-27473 | MEDIUM | 6.4 | 0.3% | Feb 19, 2026 | SPIP before 4.4.9 allows Stored Cross-Site Scripting (XSS) via syndicated sites in the private area. The #URL_SYNDIC out... |
| CVE-2026-27472 | MEDIUM | 5.3 | 0.3% | Feb 19, 2026 | SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing... |
| CVE-2026-26059 | MEDIUM | 5.4 | 0.2% | Feb 19, 2026 | ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated u... |
| CVE-2026-26057 | CRITICAL | 9.1 | 0.3% | Feb 19, 2026 | Skill Scanner is a security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious ... |
| CVE-2026-23621 | MEDIUM | 5.3 | 0.2% | Feb 19, 2026 | GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the L... |
| CVE-2026-2817 | MEDIUM | 4.8 | 0.1% | Feb 19, 2026 | Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directorie... |
| CVE-2026-2409 | CRITICAL | 9.3 | 0.2% | Feb 19, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suit... |
| CVE-2026-2243 | MEDIUM | 5.1 | 0.1% | Feb 19, 2026 | A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially ... |
| CVE-2026-26339 | CRITICAL | 9.8 | 0.5% | Feb 19, 2026 | Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the arg... |
| CVE-2026-26338 | CRITICAL | 9.8 | 0.4% | Feb 19, 2026 | Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) th... |
| CVE-2026-26337 | HIGH | 8.8 | 0.4% | Feb 19, 2026 | Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-s... |
| CVE-2026-23620 | MEDIUM | 5.3 | 0.2% | Feb 19, 2026 | GFI MailEssentials AI versions prior to 22.4 contain an arbitrary file existence enumeration vulnerability in the ListSe... |
| CVE-2026-23619 | MEDIUM | 5.4 | 0.2% | Feb 19, 2026 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Local Domains se... |
| CVE-2026-23618 | MEDIUM | 5.4 | 0.2% | Feb 19, 2026 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Che... |
| CVE-2026-23617 | MEDIUM | 5.4 | 0.2% | Feb 19, 2026 | GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Che... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now