2026 CVE Vulnerabilities
85,257 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-22402 | HIGH | 7.5 | 0.4% | Jan 22, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in... |
| CVE-2026-22401 | HIGH | 7.5 | 0.4% | Jan 22, 2026 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in... |
| CVE-2026-22400 | MEDIUM | 5.4 | 0.2% | Jan 22, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrec... |
| CVE-2026-22398 | MEDIUM | 5.4 | 0.2% | Jan 22, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectl... |
| CVE-2026-22396 | MEDIUM | 5.4 | 0.2% | Jan 22, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Inco... |
| CVE-2026-22393 | MEDIUM | 5.4 | 0.2% | Jan 22, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectl... |
| CVE-2026-22391 | MEDIUM | 5.4 | 0.2% | Jan 22, 2026 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectl... |
| CVE-2026-22388 | MEDIUM | 5.9 | 0.2% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Owl Caro... |
| CVE-2026-22382 | MEDIUM | 5.4 | 0.1% | Jan 22, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pa... |
| CVE-2026-22360 | MEDIUM | 4.3 | 0.1% | Jan 22, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This ... |
| CVE-2026-22359 | MEDIUM | 4.3 | 0.1% | Jan 22, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team Wordpress Movies Bulk Importer movies importer allows Cross S... |
| CVE-2026-22358 | MEDIUM | 5.4 | 0.2% | Jan 22, 2026 | Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Electrician - Electrical Service WordPress electrician... |
| CVE-2026-22355 | HIGH | 7.1 | 0.1% | Jan 22, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in gregmolnar Simple XML Sitemap simple-xml-sitemap allows Stored XSS.Th... |
| CVE-2026-22353 | MEDIUM | 6.5 | 0.2% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winkm89 teachPress... |
| CVE-2026-22349 | MEDIUM | 6.5 | 0.2% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linux4me2 Menu In ... |
| CVE-2026-22348 | MEDIUM | 5.3 | 0.2% | Jan 22, 2026 | Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrect... |
| CVE-2026-22347 | MEDIUM | 6.5 | 0.2% | Jan 22, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in subhansanjaya Caro... |
| CVE-2026-22278 | CRITICAL | 9.8 | 0.4% | Jan 22, 2026 | Dell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts v... |
| CVE-2026-1260 | HIGH | 7.8 | 0.2% | Jan 22, 2026 | Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created... |
| CVE-2026-0535 | HIGH | 8.1 | 0.6% | Jan 22, 2026 | A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cros... |
| CVE-2026-0534 | HIGH | 8.1 | 0.5% | Jan 22, 2026 | A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site ... |
| CVE-2026-0533 | HIGH | 8.1 | 0.6% | Jan 22, 2026 | A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by... |
| CVE-2026-24009 | CRITICAL | 9.8 | 1.4% | Jan 22, 2026 | Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing ... |
| CVE-2026-23760 | CRITICAL | 9.8 | 96.3% | Jan 22, 2026 | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password res... |
| CVE-2026-1329 | HIGH | 8.8 | 1.1% | Jan 22, 2026 | A flaw has been found in Tenda AX1803 1.0.0.1. The affected element is the function fromGetWifiGuestBasic of the file /g... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now