2026 CVE Vulnerabilities
85,245 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1506 | HIGH | 7.3 | 5.1% | Jan 28, 2026 | A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php o... |
| CVE-2026-1513 | MEDIUM | 6.1 | 0.2% | Jan 28, 2026 | billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart ... |
| CVE-2026-1505 | HIGH | 7.3 | 4.5% | Jan 28, 2026 | A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes... |
| CVE-2026-24852 | HIGH | 8.1 | 0.2% | Jan 28, 2026 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color ... |
| CVE-2026-24850 | MEDIUM | 5.3 | 0.3% | Jan 28, 2026 | The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard (ML-DSA). Starting in v... |
| CVE-2026-24842 | HIGH | 8.2 | 0.5% | Jan 28, 2026 | node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink en... |
| CVE-2026-24841 | CRITICAL | 9.9 | 2.5% | Jan 28, 2026 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection... |
| CVE-2026-24840 | HIGH | 8.8 | 0.3% | Jan 28, 2026 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in th... |
| CVE-2026-24839 | MEDIUM | 6.1 | 0.2% | Jan 28, 2026 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, the Dokploy web interface is... |
| CVE-2026-24838 | MEDIUM | 5.4 | 0.2% | Jan 28, 2026 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v... |
| CVE-2026-21569 | HIGH | 7.9 | 0.3% | Jan 28, 2026 | This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Cente... |
| CVE-2026-24837 | MEDIUM | 5.4 | 0.2% | Jan 28, 2026 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i... |
| CVE-2026-24836 | MEDIUM | 5.4 | 0.2% | Jan 28, 2026 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i... |
| CVE-2026-24833 | MEDIUM | 5.4 | 0.2% | Jan 28, 2026 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to v... |
| CVE-2026-24785 | CRITICAL | 9.1 | 0.1% | Jan 28, 2026 | Clatter is a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. Vers... |
| CVE-2026-24784 | MEDIUM | 4.8 | 0.2% | Jan 28, 2026 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting i... |
| CVE-2026-24134 | MEDIUM | 6.5 | 0.3% | Jan 28, 2026 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a... |
| CVE-2026-23830 | CRITICAL | 10 | 1.1% | Jan 28, 2026 | SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `Async... |
| CVE-2026-24910 | MEDIUM | 5.9 | 0.1% | Jan 27, 2026 | In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in... |
| CVE-2026-24909 | MEDIUM | 5.9 | 0.2% | Jan 27, 2026 | vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction. |
| CVE-2026-24783 | HIGH | 7.5 | 0.4% | Jan 27, 2026 | soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mul... |
| CVE-2026-24779 | HIGH | 7.1 | 0.5% | Jan 27, 2026 | vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request... |
| CVE-2026-24778 | MEDIUM | 6.1 | 0.3% | Jan 27, 2026 | Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an... |
| CVE-2026-24770 | CRITICAL | 9.8 | 0.9% | Jan 27, 2026 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In version 0.23.1 and possibly earlier versions, ... |
| CVE-2026-24765 | HIGH | 7.8 | 0.3% | Jan 27, 2026 | PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.6... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now