2026 CVE Vulnerabilities
85,245 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-0963 | HIGH | 8.8 | 0.7% | Jan 30, 2026 | An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote... |
| CVE-2026-0805 | HIGH | 8.8 | 0.6% | Jan 30, 2026 | An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authen... |
| CVE-2026-25097 | — | — | — | Jan 30, 2026 | Rejected reason: Not used |
| CVE-2026-25096 | — | — | — | Jan 30, 2026 | Rejected reason: Not used |
| CVE-2026-25095 | — | — | — | Jan 30, 2026 | Rejected reason: Not used |
| CVE-2026-25094 | — | — | — | Jan 30, 2026 | Rejected reason: Not used |
| CVE-2026-25093 | — | — | — | Jan 30, 2026 | Rejected reason: Not used |
| CVE-2026-25092 | — | — | — | Jan 30, 2026 | Rejected reason: Not used |
| CVE-2026-25091 | — | — | — | Jan 30, 2026 | Rejected reason: Not used |
| CVE-2026-25090 | — | — | — | Jan 30, 2026 | Rejected reason: Not used |
| CVE-2026-24729 | CRITICAL | 10 | 0.3% | Jan 30, 2026 | An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker ver... |
| CVE-2026-24728 | CRITICAL | 9.3 | 0.4% | Jan 30, 2026 | A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker ... |
| CVE-2026-24714 | HIGH | 8.7 | 0.2% | Jan 30, 2026 | Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telne... |
| CVE-2026-1638 | HIGH | 8.8 | 1.8% | Jan 30, 2026 | A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZ... |
| CVE-2026-1665 | MEDIUM | 5.4 | 0.8% | Jan 29, 2026 | A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() fun... |
| CVE-2026-1637 | HIGH | 8.8 | 0.6% | Jan 29, 2026 | A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function fromAdvSetMacMtuWan of th... |
| CVE-2026-25126 | HIGH | 7.1 | 0.3% | Jan 29, 2026 | PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/... |
| CVE-2026-25117 | HIGH | 8.3 | 0.6% | Jan 29, 2026 | pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6... |
| CVE-2026-25116 | HIGH | 8.8 | 0.6% | Jan 29, 2026 | Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated ... |
| CVE-2026-25063 | HIGH | 7.8 | 0.7% | Jan 29, 2026 | gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gr... |
| CVE-2026-25061 | HIGH | 7.5 | 0.5% | Jan 29, 2026 | tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame ... |
| CVE-2026-25047 | HIGH | 8.8 | 0.7% | Jan 29, 2026 | deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution ... |
| CVE-2026-25046 | LOW | 2.9 | 0.1% | Jan 29, 2026 | Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publis... |
| CVE-2026-25040 | HIGH | 8.8 | 0.5% | Jan 29, 2026 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and includin... |
| CVE-2026-24905 | HIGH | 7.8 | 1.3% | Jan 29, 2026 | Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Li... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now