2026 CVE Vulnerabilities
83,673 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-21438 | MEDIUM | 5.3 | 0.4% | Feb 12, 2026 | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memo... |
| CVE-2026-21435 | HIGH | 7.5 | 0.4% | Feb 12, 2026 | webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of s... |
| CVE-2026-21434 | HIGH | 7.5 | 0.4% | Feb 12, 2026 | webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive ... |
| CVE-2026-26217 | HIGH | 7.5 | 2.1% | Feb 12, 2026 | Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute... |
| CVE-2026-26216 | CRITICAL | 10 | 5.5% | Feb 12, 2026 | Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl ... |
| CVE-2026-26214 | CRITICAL | 9.1 | 0.2% | Feb 12, 2026 | Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HT... |
| CVE-2026-1104 | HIGH | 8.8 | 0.3% | Feb 12, 2026 | The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creatio... |
| CVE-2026-2007 | HIGH | 8.2 | 0.5% | Feb 12, 2026 | Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string.... |
| CVE-2026-2006 | HIGH | 8.8 | 1.1% | Feb 12, 2026 | Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted... |
| CVE-2026-2005 | HIGH | 8.8 | 1.2% | Feb 12, 2026 | Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating syst... |
| CVE-2026-2004 | HIGH | 8.8 | 0.8% | Feb 12, 2026 | Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object cre... |
| CVE-2026-2003 | MEDIUM | 4.3 | 0.3% | Feb 12, 2026 | Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. ... |
| CVE-2026-1320 | HIGH | 7.2 | 0.3% | Feb 12, 2026 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
| CVE-2026-1671 | MEDIUM | 6.5 | 0.3% | Feb 12, 2026 | The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabi... |
| CVE-2026-1316 | HIGH | 7.2 | 0.3% | Feb 12, 2026 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[].... |
| CVE-2026-2276 | MEDIUM | 5.3 | 0.4% | Feb 12, 2026 | Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.c... |
| CVE-2026-1356 | MEDIUM | 4.8 | 0.2% | Feb 12, 2026 | The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Reques... |
| CVE-2026-21722 | MEDIUM | 5.3 | 0.3% | Feb 12, 2026 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the publi... |
| CVE-2026-2327 | HIGH | 7.5 | 0.5% | Feb 12, 2026 | Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service... |
| CVE-2026-2391 | HIGH | 7.5 | 0.5% | Feb 12, 2026 | ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabl... |
| CVE-2026-26092 | — | — | — | Feb 12, 2026 | Rejected reason: Not used |
| CVE-2026-26091 | — | — | — | Feb 12, 2026 | Rejected reason: Not used |
| CVE-2026-26090 | — | — | — | Feb 12, 2026 | Rejected reason: Not used |
| CVE-2026-26089 | — | — | — | Feb 12, 2026 | Rejected reason: Not used |
| CVE-2026-26088 | — | — | — | Feb 12, 2026 | Rejected reason: Not used |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now