2026 CVE Vulnerabilities
85,180 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1748 | MEDIUM | 4.3 | 0.3% | Feb 11, 2026 | The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data du... |
| CVE-2026-1560 | HIGH | 8.8 | 9.1% | Feb 11, 2026 | The Custom Block Builder – Lazy Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to... |
| CVE-2026-1215 | MEDIUM | 4.3 | 0.2% | Feb 11, 2026 | The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ... |
| CVE-2026-0815 | MEDIUM | 4.4 | 0.2% | Feb 11, 2026 | The Category Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag-image' parameter in al... |
| CVE-2026-0724 | MEDIUM | 4.4 | 0.3% | Feb 11, 2026 | The WPlyr Media Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_wplyr_accent_color' pa... |
| CVE-2026-1357 | CRITICAL | 9.8 | 32.7% | Feb 11, 2026 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitr... |
| CVE-2026-1235 | MEDIUM | 6.5 | 0.3% | Feb 11, 2026 | The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthentic... |
| CVE-2026-26079 | MEDIUM | 4.7 | 0.3% | Feb 11, 2026 | Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comme... |
| CVE-2026-26044 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26043 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26042 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26041 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26040 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26039 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26038 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26037 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-26036 | — | — | — | Feb 11, 2026 | Rejected reason: Not used |
| CVE-2026-1893 | MEDIUM | 6.4 | 0.2% | Feb 11, 2026 | The Orbisius Random Name Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_label'... |
| CVE-2026-1231 | MEDIUM | 6.4 | 0.2% | Feb 11, 2026 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site ... |
| CVE-2026-1571 | MEDIUM | 6.1 | 0.3% | Feb 11, 2026 | User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbit... |
| CVE-2026-25872 | MEDIUM | 6.9 | 0.7% | Feb 10, 2026 | JUNG Smart Panel KNX firmware version L1.12.22 and prior contain an unauthenticated path traversal vulnerability in the ... |
| CVE-2026-25870 | MEDIUM | 6.9 | 0.3% | Feb 10, 2026 | DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fe... |
| CVE-2026-25251 | — | — | — | Feb 10, 2026 | Rejected reason: This has been moved to the REJECTED state because the information source is under review. If circumstan... |
| CVE-2026-26013 | LOW | 3.7 | 0.4% | Feb 10, 2026 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_token... |
| CVE-2026-26007 | MEDIUM | 6.5 | 0.3% | Feb 10, 2026 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5,... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now