2026 CVE Vulnerabilities
85,185 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-25885 | HIGH | 7.5 | 0.3% | Feb 9, 2026 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss:/... |
| CVE-2026-25881 | CRITICAL | 10 | 0.6% | Feb 9, 2026 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to m... |
| CVE-2026-25880 | HIGH | 7.8 | 0.2% | Feb 9, 2026 | SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious bi... |
| CVE-2026-25875 | CRITICAL | 9.8 | 0.3% | Feb 9, 2026 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorizatio... |
| CVE-2026-25814 | CRITICAL | 9.8 | 0.3% | Feb 9, 2026 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query ... |
| CVE-2026-25813 | HIGH | 7.5 | 0.3% | Feb 9, 2026 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs h... |
| CVE-2026-25812 | HIGH | 8.8 | 0.1% | Feb 9, 2026 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enable... |
| CVE-2026-25811 | CRITICAL | 9.1 | 0.3% | Feb 9, 2026 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derive... |
| CVE-2026-25808 | HIGH | 7.5 | 0.4% | Feb 9, 2026 | Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 an... |
| CVE-2026-25807 | HIGH | 8.8 | 0.6% | Feb 9, 2026 | ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, t... |
| CVE-2026-25878 | MEDIUM | 5.3 | 0.4% | Feb 9, 2026 | FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessi... |
| CVE-2026-25876 | CRITICAL | 9.1 | 0.2% | Feb 9, 2026 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes... |
| CVE-2026-25810 | CRITICAL | 9.1 | 0.2% | Feb 9, 2026 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes... |
| CVE-2026-25809 | CRITICAL | 9.8 | 0.3% | Feb 9, 2026 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation en... |
| CVE-2026-25806 | MEDIUM | 6.5 | 0.2% | Feb 9, 2026 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/... |
| CVE-2026-25791 | HIGH | 7.5 | 0.4% | Feb 9, 2026 | Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener acc... |
| CVE-2026-25765 | MEDIUM | 5.8 | 0.4% | Feb 9, 2026 | Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1... |
| CVE-2026-25761 | HIGH | 8.8 | 1.3% | Feb 9, 2026 | Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Supe... |
| CVE-2026-25740 | MEDIUM | 5.8 | 0.1% | Feb 9, 2026 | captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings. In 25.05 and... |
| CVE-2026-25639 | HIGH | 7.5 | 2.8% | Feb 9, 2026 | Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig f... |
| CVE-2026-25528 | MEDIUM | 5.8 | 0.3% | Feb 9, 2026 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing... |
| CVE-2026-2246 | LOW | 3.3 | 0.2% | Feb 9, 2026 | A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the ... |
| CVE-2026-2245 | LOW | 3.3 | 0.1% | Feb 9, 2026 | A vulnerability was identified in CCExtractor up to 183. This affects the function parse_PAT/parse_PMT in the library sr... |
| CVE-2026-25598 | MEDIUM | 5.3 | 0.3% | Feb 9, 2026 | Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security v... |
| CVE-2026-25498 | HIGH | 7.2 | 1.0% | Feb 9, 2026 | Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now