2026 CVE Vulnerabilities
85,248 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-20888 | MEDIUM | 4.3 | 0.3% | Jan 22, 2026 | Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with rea... |
| CVE-2026-20883 | MEDIUM | 6.5 | 0.3% | Jan 22, 2026 | Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository ... |
| CVE-2026-20800 | MEDIUM | 6.5 | 0.3% | Jan 22, 2026 | Gitea's notification API does not re-validate repository access permissions when returning notification details. After a... |
| CVE-2026-20750 | CRITICAL | 9.1 | 0.4% | Jan 22, 2026 | Gitea does not properly validate project ownership in organization project operations. A user with project write access ... |
| CVE-2026-20736 | HIGH | 7.5 | 0.4% | Jan 22, 2026 | Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachmen... |
| CVE-2026-1201 | CRITICAL | 9.4 | 0.5% | Jan 22, 2026 | An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior... |
| CVE-2026-0798 | LOW | 3.5 | 0.2% | Jan 22, 2026 | Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repos... |
| CVE-2026-22281 | MEDIUM | 4.8 | 0.2% | Jan 22, 2026 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.1... |
| CVE-2026-22280 | MEDIUM | 5.5 | 0.1% | Jan 22, 2026 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.5.1.5, versions 9.6.0.0 through 9.7.1.10, versions 9.8.0.0 through 9.1... |
| CVE-2026-22279 | HIGH | 7.5 | 0.2% | Jan 22, 2026 | Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. An unauthenticated attac... |
| CVE-2026-24390 | HIGH | 7.5 | 0.3% | Jan 22, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in... |
| CVE-2026-24389 | MEDIUM | 6.5 | 0.1% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery P... |
| CVE-2026-24388 | MEDIUM | 4.3 | 0.2% | Jan 22, 2026 | Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configur... |
| CVE-2026-24387 | MEDIUM | 4.3 | 0.2% | Jan 22, 2026 | Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting... |
| CVE-2026-24386 | MEDIUM | 4.3 | 0.2% | Jan 22, 2026 | Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allo... |
| CVE-2026-24384 | MEDIUM | 5.4 | 0.1% | Jan 22, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in launchinteractive Merge + Minify + Refresh merge-minify-refresh allow... |
| CVE-2026-24383 | MEDIUM | 6.5 | 0.1% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider ... |
| CVE-2026-24381 | MEDIUM | 5.4 | 0.1% | Jan 22, 2026 | Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This i... |
| CVE-2026-24380 | MEDIUM | 5.3 | 0.2% | Jan 22, 2026 | Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incor... |
| CVE-2026-24379 | MEDIUM | 6.5 | 0.2% | Jan 22, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploit... |
| CVE-2026-24377 | MEDIUM | 4.3 | 0.2% | Jan 22, 2026 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-p... |
| CVE-2026-24374 | MEDIUM | 5.4 | 0.1% | Jan 22, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-sub... |
| CVE-2026-24371 | MEDIUM | 4.3 | 0.2% | Jan 22, 2026 | Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorre... |
| CVE-2026-24368 | MEDIUM | 5.3 | 0.2% | Jan 22, 2026 | Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Securit... |
| CVE-2026-24367 | HIGH | 8.5 | 0.2% | Jan 22, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Travele... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now