2026 CVE Vulnerabilities
85,180 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-25227 | HIGH | 7.2 | 0.6% | Feb 12, 2026 | authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using de... |
| CVE-2026-24895 | CRITICAL | 9.8 | 0.6% | Feb 12, 2026 | FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly han... |
| CVE-2026-24894 | HIGH | 7.5 | 0.4% | Feb 12, 2026 | FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSIO... |
| CVE-2026-24044 | CRITICAL | 9.2 | 0.3% | Feb 12, 2026 | Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kuberne... |
| CVE-2026-26219 | CRITICAL | 9.3 | 0.2% | Feb 12, 2026 | newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not inco... |
| CVE-2026-26218 | CRITICAL | 9.8 | 0.4% | Feb 12, 2026 | newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisi... |
| CVE-2026-22821 | MEDIUM | 6.5 | 0.2% | Feb 12, 2026 | mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vul... |
| CVE-2026-21438 | MEDIUM | 5.3 | 0.4% | Feb 12, 2026 | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memo... |
| CVE-2026-21435 | HIGH | 7.5 | 0.4% | Feb 12, 2026 | webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of s... |
| CVE-2026-21434 | HIGH | 7.5 | 0.4% | Feb 12, 2026 | webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive ... |
| CVE-2026-26217 | HIGH | 7.5 | 2.1% | Feb 12, 2026 | Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute... |
| CVE-2026-26216 | CRITICAL | 10 | 5.5% | Feb 12, 2026 | Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl ... |
| CVE-2026-26214 | CRITICAL | 9.1 | 0.2% | Feb 12, 2026 | Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HT... |
| CVE-2026-1104 | HIGH | 8.8 | 0.3% | Feb 12, 2026 | The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creatio... |
| CVE-2026-2007 | HIGH | 8.2 | 0.5% | Feb 12, 2026 | Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string.... |
| CVE-2026-2006 | HIGH | 8.8 | 1.1% | Feb 12, 2026 | Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted... |
| CVE-2026-2005 | HIGH | 8.8 | 1.2% | Feb 12, 2026 | Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating syst... |
| CVE-2026-2004 | HIGH | 8.8 | 0.8% | Feb 12, 2026 | Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object cre... |
| CVE-2026-2003 | MEDIUM | 4.3 | 0.3% | Feb 12, 2026 | Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. ... |
| CVE-2026-1320 | HIGH | 7.2 | 0.3% | Feb 12, 2026 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
| CVE-2026-1671 | MEDIUM | 6.5 | 0.3% | Feb 12, 2026 | The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabi... |
| CVE-2026-1316 | HIGH | 7.2 | 0.3% | Feb 12, 2026 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[].... |
| CVE-2026-2276 | MEDIUM | 5.3 | 0.4% | Feb 12, 2026 | Reflected Cross-Site Scripting (XSS) vulnerability in the Wix web application, where the endpoint ' https://manage.wix.c... |
| CVE-2026-1356 | MEDIUM | 4.8 | 0.2% | Feb 12, 2026 | The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Reques... |
| CVE-2026-21722 | MEDIUM | 5.3 | 0.3% | Feb 12, 2026 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the publi... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now