2026 CVE Vulnerabilities
84,034 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-21229 | HIGH | 8.8 | 0.9% | Feb 10, 2026 | Improper input validation in Power BI allows an authorized attacker to execute code over a network. |
| CVE-2026-21228 | HIGH | 8.1 | 0.7% | Feb 10, 2026 | Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network. |
| CVE-2026-21222 | MEDIUM | 5.5 | 0.6% | Feb 10, 2026 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information... |
| CVE-2026-21218 | HIGH | 7.5 | 1.0% | Feb 10, 2026 | Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-20846 | HIGH | 7.5 | 1.3% | Feb 10, 2026 | Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network. |
| CVE-2026-20841 | HIGH | 7.8 | 11.7% | Feb 10, 2026 | Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an una... |
| CVE-2026-1997 | MEDIUM | 5.3 | 0.2% | Feb 10, 2026 | Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, poten... |
| CVE-2026-1996 | MEDIUM | 5.3 | 0.3% | Feb 10, 2026 | Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled,... |
| CVE-2026-0653 | MEDIUM | 6.5 | 0.4% | Feb 10, 2026 | On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending... |
| CVE-2026-0652 | HIGH | 8.8 | 22.8% | Feb 10, 2026 | On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters ... |
| CVE-2026-0651 | HIGH | 7.8 | 0.3% | Feb 10, 2026 | A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP ser... |
| CVE-2026-25530 | MEDIUM | 4.3 | 0.2% | Feb 10, 2026 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks... |
| CVE-2026-24885 | HIGH | 8 | 0.2% | Feb 10, 2026 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CS... |
| CVE-2026-22153 | HIGH | 8.1 | 0.7% | Feb 10, 2026 | An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6... |
| CVE-2026-21743 | HIGH | 7.2 | 0.3% | Feb 10, 2026 | A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all ver... |
| CVE-2026-1774 | CRITICAL | 9.8 | 0.6% | Feb 10, 2026 | CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability. |
| CVE-2026-1603 | HIGH | 7.5 | 81.1% | Feb 10, 2026 | An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to ... |
| CVE-2026-1602 | MEDIUM | 6.5 | 0.7% | Feb 10, 2026 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrar... |
| CVE-2026-2268 | HIGH | 7.5 | 0.3% | Feb 10, 2026 | The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin... |
| CVE-2026-25656 | HIGH | 8.5 | 0.2% | Feb 10, 2026 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All version... |
| CVE-2026-25655 | HIGH | 8.5 | 0.2% | Feb 10, 2026 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected application permits improper mo... |
| CVE-2026-24343 | HIGH | 8.8 | 0.7% | Feb 10, 2026 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This is... |
| CVE-2026-23906 | CRITICAL | 9.8 | 1.0% | Feb 10, 2026 | Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0... |
| CVE-2026-23901 | LOW | 2.5 | 0.2% | Feb 10, 2026 | Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.... |
| CVE-2026-23720 | HIGH | 7.3 | 0.2% | Feb 10, 2026 | A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512).... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now