2026 CVE Vulnerabilities
85,245 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1690 | MEDIUM | 4.7 | 3.5% | Jan 30, 2026 | A flaw has been found in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. This affects the function system of the file /b... |
| CVE-2026-1689 | HIGH | 7.3 | 2.3% | Jan 30, 2026 | A vulnerability was detected in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. The impacted element is the function che... |
| CVE-2026-25128 | HIGH | 7.5 | 0.6% | Jan 30, 2026 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based li... |
| CVE-2026-25050 | MEDIUM | 5.3 | 0.4% | Jan 30, 2026 | Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenti... |
| CVE-2026-24855 | MEDIUM | 5.4 | 0.2% | Jan 30, 2026 | ChurchCRM is an open-source church management system. Versions prior to 6.7.2 have a Stored Cross-Site Scripting (XSS) v... |
| CVE-2026-24854 | HIGH | 8.8 | 0.4% | Jan 30, 2026 | ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor... |
| CVE-2026-1688 | CRITICAL | 9.8 | 0.3% | Jan 30, 2026 | A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an u... |
| CVE-2026-1687 | HIGH | 7.3 | 2.4% | Jan 30, 2026 | A weakness has been identified in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. Impacted is an unknown function of the... |
| CVE-2026-1686 | HIGH | 8.8 | 0.7% | Jan 30, 2026 | A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig... |
| CVE-2026-1685 | MEDIUM | 5.9 | 1.0% | Jan 30, 2026 | A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the comp... |
| CVE-2026-1684 | HIGH | 7.5 | 0.5% | Jan 30, 2026 | A vulnerability was found in Free5GC SMF up to 4.1.0. Affected by this issue is the function HandleReports of the file /... |
| CVE-2026-1683 | HIGH | 7.5 | 0.6% | Jan 30, 2026 | A vulnerability has been found in Free5GC SMF up to 4.1.0. Affected by this vulnerability is the function HandlePfcpSess... |
| CVE-2026-1682 | HIGH | 7.5 | 0.7% | Jan 30, 2026 | A flaw has been found in Free5GC SMF up to 4.1.0. Affected is the function HandlePfcpAssociationReleaseRequest of the fi... |
| CVE-2026-1498 | HIGH | 7 | 0.7% | Jan 30, 2026 | An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensit... |
| CVE-2026-22626 | MEDIUM | 4.9 | 0.4% | Jan 30, 2026 | Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can... |
| CVE-2026-22625 | MEDIUM | 4.6 | 0.2% | Jan 30, 2026 | Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files. |
| CVE-2026-22624 | MEDIUM | 4.3 | 0.2% | Jan 30, 2026 | Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file r... |
| CVE-2026-22623 | HIGH | 7.2 | 0.5% | Jan 30, 2026 | Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can... |
| CVE-2026-0709 | HIGH | 7.2 | 0.8% | Jan 30, 2026 | Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input valida... |
| CVE-2026-1699 | HIGH | 8.8 | 0.5% | Jan 30, 2026 | In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_tar... |
| CVE-2026-22277 | HIGH | 7.8 | 0.6% | Jan 30, 2026 | Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command... |
| CVE-2026-21418 | HIGH | 7.8 | 0.6% | Jan 30, 2026 | Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ... |
| CVE-2026-25211 | LOW | 3.2 | 0.2% | Jan 30, 2026 | Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log. |
| CVE-2026-25210 | HIGH | 7.8 | 0.2% | Jan 30, 2026 | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no... |
| CVE-2026-1680 | HIGH | 7.8 | 0.2% | Jan 30, 2026 | Improper access control in the WCF endpoint in Edgemo (now owned by Danoffice IT) Local Admin Service 1.2.7.23180 on Win... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now