2026 CVE Vulnerabilities
85,245 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-24748 | HIGH | 7.2 | 0.3% | Jan 27, 2026 | Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was fo... |
| CVE-2026-24747 | HIGH | 8.8 | 0.7% | Jan 27, 2026 | PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `wei... |
| CVE-2026-24741 | HIGH | 8.1 | 0.4% | Jan 27, 2026 | ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-con... |
| CVE-2026-24740 | CRITICAL | 9.9 | 0.4% | Jan 27, 2026 | Dozzle is a realtime log viewer for docker containers. Prior to version 9.0.3, a flaw in Dozzle’s agent-backed shell end... |
| CVE-2026-24738 | MEDIUM | 6.5 | 0.3% | Jan 27, 2026 | gmrtd is a Go library for reading Machine Readable Travel Documents (MRTDs). Prior to version 0.17.2, ReadFile accepts T... |
| CVE-2026-24736 | HIGH | 8.8 | 0.4% | Jan 27, 2026 | Squidex is an open source headless content management system and content management hub. Versions of the application up ... |
| CVE-2026-1504 | MEDIUM | 6.5 | 0.2% | Jan 27, 2026 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker ... |
| CVE-2026-24858 | CRITICAL | 9.8 | 85.8% | Jan 27, 2026 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnaly... |
| CVE-2026-24771 | MEDIUM | 4.7 | 0.3% | Jan 27, 2026 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-S... |
| CVE-2026-24688 | MEDIUM | 4.3 | 0.4% | Jan 27, 2026 | pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is pre... |
| CVE-2026-24473 | MEDIUM | 5.3 | 0.4% | Jan 27, 2026 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve sta... |
| CVE-2026-24472 | MEDIUM | 5.3 | 0.5% | Jan 27, 2026 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Mid... |
| CVE-2026-24883 | MEDIUM | 5.5 | 0.4% | Jan 27, 2026 | In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to ... |
| CVE-2026-24882 | HIGH | 7.8 | 0.4% | Jan 27, 2026 | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for ... |
| CVE-2026-24881 | CRITICAL | 9.8 | 1.7% | Jan 27, 2026 | In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause... |
| CVE-2026-24398 | MEDIUM | 6.5 | 0.3% | Jan 27, 2026 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restri... |
| CVE-2026-24116 | MEDIUM | 5.5 | 0.2% | Jan 27, 2026 | Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x8... |
| CVE-2026-23892 | MEDIUM | 5.9 | 0.5% | Jan 27, 2026 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 a... |
| CVE-2026-22264 | CRITICAL | 9.1 | 0.3% | Jan 27, 2026 | Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead ... |
| CVE-2026-22263 | MEDIUM | 5.3 | 0.4% | Jan 27, 2026 | Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in htt... |
| CVE-2026-22262 | CRITICAL | 9.8 | 0.5% | Jan 27, 2026 | Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior ... |
| CVE-2026-22261 | MEDIUM | 5.3 | 0.3% | Jan 27, 2026 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, various inefficiencies in xff handlin... |
| CVE-2026-0746 | MEDIUM | 6.4 | 0.2% | Jan 27, 2026 | The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.... |
| CVE-2026-23593 | HIGH | 7.5 | 0.6% | Jan 27, 2026 | A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthentic... |
| CVE-2026-23592 | HIGH | 7.2 | 0.8% | Jan 27, 2026 | Insecure file operations in HPE Aruba Networking Fabric Composer’s backup functionality could allow authenticated atta... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now