2026 CVE Vulnerabilities
85,188 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-24935 | MEDIUM | 5.6 | 0.1% | Feb 3, 2026 | A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While... |
| CVE-2026-24934 | LOW | 3.7 | 0.2% | Feb 3, 2026 | The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an externa... |
| CVE-2026-24933 | MEDIUM | 5.9 | 0.2% | Feb 3, 2026 | The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An ... |
| CVE-2026-24932 | MEDIUM | 5.9 | 0.2% | Feb 3, 2026 | The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Althou... |
| CVE-2026-25228 | MEDIUM | 4.3 | 0.4% | Feb 2, 2026 | Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerab... |
| CVE-2026-25222 | HIGH | 7.5 | 0.4% | Feb 2, 2026 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in ... |
| CVE-2026-25221 | HIGH | 8.1 | 0.2% | Feb 2, 2026 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for ... |
| CVE-2026-25144 | MEDIUM | 5.3 | 0.3% | Feb 2, 2026 | Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter i... |
| CVE-2026-25142 | CRITICAL | 10 | 1.1% | Feb 2, 2026 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ whic... |
| CVE-2026-25137 | CRITICAL | 9.1 | 10.1% | Feb 2, 2026 | The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odo... |
| CVE-2026-25134 | HIGH | 8.8 | 0.8% | Feb 2, 2026 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5... |
| CVE-2026-25060 | HIGH | 8.1 | 0.2% | Feb 2, 2026 | OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for a... |
| CVE-2026-25059 | HIGH | 8.8 | 0.6% | Feb 2, 2026 | OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability... |
| CVE-2026-24763 | HIGH | 8.8 | 4.8% | Feb 2, 2026 | OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command inje... |
| CVE-2026-24737 | HIGH | 8.1 | 0.5% | Feb 2, 2026 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acrofor... |
| CVE-2026-24471 | CRITICAL | 9.3 | 0.3% | Feb 2, 2026 | continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote serve... |
| CVE-2026-24133 | MEDIUM | 6.5 | 0.6% | Feb 2, 2026 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage me... |
| CVE-2026-24051 | HIGH | 7 | 0.2% | Feb 2, 2026 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulner... |
| CVE-2026-24043 | MEDIUM | 5.4 | 0.3% | Feb 2, 2026 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata... |
| CVE-2026-24040 | MEDIUM | 4.8 | 0.3% | Feb 2, 2026 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes ... |
| CVE-2026-24007 | MEDIUM | 4.6 | 0.1% | Feb 2, 2026 | Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protecti... |
| CVE-2026-23997 | CRITICAL | 9 | 0.4% | Feb 2, 2026 | FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cro... |
| CVE-2026-23515 | HIGH | 8.8 | 4.2% | Feb 2, 2026 | Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulner... |
| CVE-2026-23476 | MEDIUM | 5.4 | 0.3% | Feb 2, 2026 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to 2025.8, there a reflected X... |
| CVE-2026-22780 | MEDIUM | 6.1 | 0.2% | Feb 2, 2026 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be expl... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now