2026 CVE Vulnerabilities
85,245 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-0617 | HIGH | 7.2 | 0.4% | Feb 3, 2026 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-S... |
| CVE-2026-24694 | HIGH | 8.4 | 0.1% | Feb 3, 2026 | The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could ... |
| CVE-2026-0950 | MEDIUM | 5.3 | 0.3% | Feb 3, 2026 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Di... |
| CVE-2026-24936 | CRITICAL | 9.8 | 0.8% | Feb 3, 2026 | When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerab... |
| CVE-2026-1788 | MEDIUM | 6.6 | 0.4% | Feb 3, 2026 | : Out-of-bounds Write vulnerability in Xquic Project Xquic Server xquic on Linux (QUIC protocol implementation, packet p... |
| CVE-2026-0909 | MEDIUM | 5.3 | 0.3% | Feb 3, 2026 | The WP ULike plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including... |
| CVE-2026-0383 | HIGH | 7.8 | 0.2% | Feb 3, 2026 | A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash she... |
| CVE-2026-24935 | MEDIUM | 5.6 | 0.1% | Feb 3, 2026 | A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While... |
| CVE-2026-24934 | LOW | 3.7 | 0.2% | Feb 3, 2026 | The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an externa... |
| CVE-2026-24933 | MEDIUM | 5.9 | 0.2% | Feb 3, 2026 | The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An ... |
| CVE-2026-24932 | MEDIUM | 5.9 | 0.2% | Feb 3, 2026 | The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Althou... |
| CVE-2026-25228 | MEDIUM | 4.3 | 0.4% | Feb 2, 2026 | Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerab... |
| CVE-2026-25222 | HIGH | 7.5 | 0.4% | Feb 2, 2026 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in ... |
| CVE-2026-25221 | HIGH | 8.1 | 0.2% | Feb 2, 2026 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for ... |
| CVE-2026-25144 | MEDIUM | 5.3 | 0.3% | Feb 2, 2026 | Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter i... |
| CVE-2026-25142 | CRITICAL | 10 | 1.1% | Feb 2, 2026 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ whic... |
| CVE-2026-25137 | CRITICAL | 9.1 | 10.1% | Feb 2, 2026 | The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odo... |
| CVE-2026-25134 | HIGH | 8.8 | 0.8% | Feb 2, 2026 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5... |
| CVE-2026-25060 | HIGH | 8.1 | 0.2% | Feb 2, 2026 | OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for a... |
| CVE-2026-25059 | HIGH | 8.8 | 0.6% | Feb 2, 2026 | OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability... |
| CVE-2026-24763 | HIGH | 8.8 | 4.8% | Feb 2, 2026 | OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command inje... |
| CVE-2026-24737 | HIGH | 8.1 | 0.5% | Feb 2, 2026 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acrofor... |
| CVE-2026-24471 | CRITICAL | 9.3 | 0.3% | Feb 2, 2026 | continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote serve... |
| CVE-2026-24133 | MEDIUM | 6.5 | 0.6% | Feb 2, 2026 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage me... |
| CVE-2026-24051 | HIGH | 7 | 0.2% | Feb 2, 2026 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulner... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now