2026 CVE Vulnerabilities
85,188 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-22778 | CRITICAL | 9.8 | 3.8% | Feb 2, 2026 | vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid i... |
| CVE-2026-1778 | HIGH | 8.2 | 0.2% | Feb 2, 2026 | Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made b... |
| CVE-2026-1777 | HIGH | 8.5 | 0.5% | Feb 2, 2026 | The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext r... |
| CVE-2026-0924 | HIGH | 7 | 0.2% | Feb 2, 2026 | BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root ... |
| CVE-2026-22229 | HIGH | 7.2 | 1.9% | Feb 2, 2026 | A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN clie... |
| CVE-2026-22227 | HIGH | 7.2 | 2.6% | Feb 2, 2026 | A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restora... |
| CVE-2026-22226 | HIGH | 7.2 | 2.4% | Feb 2, 2026 | A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration modu... |
| CVE-2026-22225 | HIGH | 7.2 | 2.7% | Feb 2, 2026 | A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the... |
| CVE-2026-22224 | HIGH | 7.2 | 2.6% | Feb 2, 2026 | A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface... |
| CVE-2026-22223 | HIGH | 8 | 1.5% | Feb 2, 2026 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authent... |
| CVE-2026-22222 | HIGH | 8 | 1.5% | Feb 2, 2026 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent a... |
| CVE-2026-22221 | HIGH | 8 | 1.4% | Feb 2, 2026 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent authenti... |
| CVE-2026-0631 | HIGH | 8 | 1.6% | Feb 2, 2026 | An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Archer BE230 v1.2, BE36... |
| CVE-2026-0630 | HIGH | 8 | 1.3% | Feb 2, 2026 | An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent ... |
| CVE-2026-1770 | MEDIUM | 4.5 | 0.4% | Feb 2, 2026 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticat... |
| CVE-2026-1232 | MEDIUM | 6.8 | 0.1% | Feb 2, 2026 | A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Und... |
| CVE-2026-0921 | — | — | — | Feb 2, 2026 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All r... |
| CVE-2026-1703 | LOW | 2 | 0.4% | Feb 2, 2026 | When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installati... |
| CVE-2026-24071 | HIGH | 7.8 | 0.1% | Feb 2, 2026 | It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting clie... |
| CVE-2026-24070 | HIGH | 8.8 | 0.2% | Feb 2, 2026 | During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helpe... |
| CVE-2026-1761 | HIGH | 8.6 | 1.1% | Feb 2, 2026 | A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP ... |
| CVE-2026-1760 | MEDIUM | 5.3 | 0.4% | Feb 2, 2026 | A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles r... |
| CVE-2026-1186 | HIGH | 8.6 | 0.3% | Feb 2, 2026 | EAP Legislator is vulnerable to Path Traversal in file extraction functionality. Attacker can prepare zipx archive (defa... |
| CVE-2026-1757 | MEDIUM | 6.2 | 0.2% | Feb 2, 2026 | A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocat... |
| CVE-2026-0599 | HIGH | 7.5 | 23.7% | Feb 2, 2026 | A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploi... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now