2026 CVE Vulnerabilities
85,248 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-24304 | CRITICAL | 9.9 | 0.6% | Jan 23, 2026 | Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-24138 | HIGH | 7.5 | 0.4% | Jan 23, 2026 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below conta... |
| CVE-2026-24137 | MEDIUM | 5.8 | 0.4% | Jan 23, 2026 | sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the... |
| CVE-2026-24132 | CRITICAL | 9.8 | 0.7% | Jan 23, 2026 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.... |
| CVE-2026-20613 | HIGH | 7.8 | 0.2% | Jan 23, 2026 | The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname valid... |
| CVE-2026-24307 | HIGH | 7.5 | 0.8% | Jan 22, 2026 | Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information o... |
| CVE-2026-24306 | CRITICAL | 9.8 | 0.8% | Jan 22, 2026 | Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-24305 | CRITICAL | 9.8 | 0.5% | Jan 22, 2026 | Azure Entra ID Elevation of Privilege Vulnerability |
| CVE-2026-24130 | MEDIUM | 5.3 | 0.3% | Jan 22, 2026 | Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, inst... |
| CVE-2026-24129 | HIGH | 8.8 | 0.5% | Jan 22, 2026 | Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versi... |
| CVE-2026-24124 | CRITICAL | 9.8 | 0.7% | Jan 22, 2026 | Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below,... |
| CVE-2026-21524 | HIGH | 7.4 | 0.5% | Jan 22, 2026 | Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to dis... |
| CVE-2026-21521 | HIGH | 7.4 | 0.5% | Jan 22, 2026 | Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose inf... |
| CVE-2026-21520 | HIGH | 7.5 | 1.4% | Jan 22, 2026 | Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view s... |
| CVE-2026-21264 | MEDIUM | 6.1 | 0.4% | Jan 22, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unau... |
| CVE-2026-21227 | CRITICAL | 9.8 | 0.5% | Jan 22, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize... |
| CVE-2026-24117 | MEDIUM | 5.3 | 0.3% | Jan 22, 2026 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary ... |
| CVE-2026-24058 | CRITICAL | 9.8 | 0.5% | Jan 22, 2026 | Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication ... |
| CVE-2026-23988 | HIGH | 7 | 0.2% | Jan 22, 2026 | Rufus is a utility that helps format and create bootable USB flash drives. Versions 4.11 and below contain a race condit... |
| CVE-2026-23954 | HIGH | 8.7 | 0.7% | Jan 22, 2026 | Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to laun... |
| CVE-2026-23953 | HIGH | 8.7 | 0.5% | Jan 22, 2026 | Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch... |
| CVE-2026-23831 | MEDIUM | 5.3 | 0.4% | Jan 22, 2026 | Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on at... |
| CVE-2026-20912 | CRITICAL | 9.1 | 0.4% | Jan 22, 2026 | Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a ... |
| CVE-2026-20904 | MEDIUM | 6.5 | 0.3% | Jan 22, 2026 | Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to cha... |
| CVE-2026-20897 | CRITICAL | 9.1 | 0.4% | Jan 22, 2026 | Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repos... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now