2026 CVE Vulnerabilities
85,248 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-24478 | HIGH | 7.2 | 0.9% | Jan 27, 2026 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti... |
| CVE-2026-24477 | HIGH | 7.5 | 1.6% | Jan 27, 2026 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti... |
| CVE-2026-1449 | HIGH | 7.3 | 0.4% | Jan 27, 2026 | A flaw has been found in Hisense TransTech Smart Bus Management System up to 20260113. Affected is the function Page_Loa... |
| CVE-2026-1448 | HIGH | 7.3 | 5.3% | Jan 27, 2026 | A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_ma... |
| CVE-2026-24476 | MEDIUM | 5.4 | 0.1% | Jan 26, 2026 | Shaarli is a personal bookmarking service. Prior to version 0.16.0, crafting a malicious tag which starting with `"` pre... |
| CVE-2026-24470 | HIGH | 8.1 | 0.3% | Jan 26, 2026 | Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an... |
| CVE-2026-24408 | MEDIUM | 5 | 0.2% | Jan 26, 2026 | sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-... |
| CVE-2026-24400 | CRITICAL | 9.1 | 0.5% | Jan 26, 2026 | AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and pr... |
| CVE-2026-24123 | MEDIUM | 6.5 | 0.4% | Jan 26, 2026 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to vers... |
| CVE-2026-24131 | MEDIUM | 5.5 | 0.2% | Jan 26, 2026 | pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `p... |
| CVE-2026-24056 | MEDIUM | 6.5 | 0.5% | Jan 26, 2026 | pnpm is a package manager. Prior to version 10.28.2, when pnpm installs a `file:` (directory) or `git:` dependency, it f... |
| CVE-2026-24003 | MEDIUM | 5.3 | 0.3% | Jan 26, 2026 | EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequen... |
| CVE-2026-23890 | MEDIUM | 6.5 | 0.4% | Jan 26, 2026 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicio... |
| CVE-2026-23889 | MEDIUM | 6.5 | 0.4% | Jan 26, 2026 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows ... |
| CVE-2026-23888 | MEDIUM | 6.5 | 0.4% | Jan 26, 2026 | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's binary fetcher allows mali... |
| CVE-2026-22709 | CRITICAL | 10 | 1.2% | Jan 26, 2026 | vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototyp... |
| CVE-2026-22696 | CRITICAL | 9.3 | 0.2% | Jan 26, 2026 | dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present ... |
| CVE-2026-1445 | MEDIUM | 4.7 | 0.2% | Jan 26, 2026 | A vulnerability was found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This vulnerability... |
| CVE-2026-1444 | LOW | 2.4 | 0.2% | Jan 26, 2026 | A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c. This affects ... |
| CVE-2026-23864 | HIGH | 7.5 | 2.5% | Jan 26, 2026 | Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-ser... |
| CVE-2026-1443 | CRITICAL | 9.8 | 0.5% | Jan 26, 2026 | A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of th... |
| CVE-2026-1190 | LOW | 3.1 | 0.4% | Jan 26, 2026 | A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Asser... |
| CVE-2026-0810 | HIGH | 7.1 | 0.2% | Jan 26, 2026 | A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid no... |
| CVE-2026-24440 | HIGH | 8.8 | 0.3% | Jan 26, 2026 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed thr... |
| CVE-2026-24439 | MEDIUM | 6.5 | 0.2% | Jan 26, 2026 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Option... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now