2026 CVE Vulnerabilities
85,257 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1245 | MEDIUM | 6.5 | 0.5% | Jan 20, 2026 | A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code exec... |
| CVE-2026-0726 | HIGH | 8.1 | 0.5% | Jan 20, 2026 | The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to PHP Object Injection in all versi... |
| CVE-2026-0690 | MEDIUM | 6.4 | 0.2% | Jan 20, 2026 | The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... |
| CVE-2026-0608 | MEDIUM | 6.4 | 0.2% | Jan 20, 2026 | The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta ... |
| CVE-2026-0554 | MEDIUM | 4.3 | 0.3% | Jan 20, 2026 | The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch... |
| CVE-2026-0548 | MEDIUM | 5.4 | 0.2% | Jan 20, 2026 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment delet... |
| CVE-2026-22844 | CRITICAL | 9.9 | 13.0% | Jan 20, 2026 | A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting p... |
| CVE-2026-1183 | MEDIUM | 5.1 | 0.3% | Jan 20, 2026 | HTML injection vulnerability in multiple Botble products such as TransP, Athena, Martfury, and Homzen, consisting of an ... |
| CVE-2026-1180 | MEDIUM | 5.8 | 0.4% | Jan 20, 2026 | A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using p... |
| CVE-2026-0895 | MEDIUM | 5.2 | 0.1% | Jan 20, 2026 | The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-... |
| CVE-2026-1223 | MEDIUM | 6.9 | 0.4% | Jan 20, 2026 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability,... |
| CVE-2026-1222 | HIGH | 8.6 | 0.6% | Jan 20, 2026 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Arbitrary File Upload vulnerability, allowing privi... |
| CVE-2026-1221 | CRITICAL | 9.8 | 0.4% | Jan 20, 2026 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowi... |
| CVE-2026-1218 | MEDIUM | 6.3 | 0.2% | Jan 20, 2026 | A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClient... |
| CVE-2026-1045 | MEDIUM | 4.4 | 0.2% | Jan 20, 2026 | The Viet contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up... |
| CVE-2026-1042 | MEDIUM | 4.4 | 0.2% | Jan 20, 2026 | The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' p... |
| CVE-2026-23917 | — | — | — | Jan 20, 2026 | Rejected reason: Not used |
| CVE-2026-23916 | — | — | — | Jan 20, 2026 | Rejected reason: Not used |
| CVE-2026-23915 | — | — | — | Jan 20, 2026 | Rejected reason: Not used |
| CVE-2026-23914 | — | — | — | Jan 20, 2026 | Rejected reason: Not used |
| CVE-2026-23913 | — | — | — | Jan 20, 2026 | Rejected reason: Not used |
| CVE-2026-23912 | — | — | — | Jan 20, 2026 | Rejected reason: Not used |
| CVE-2026-23911 | — | — | — | Jan 20, 2026 | Rejected reason: Not used |
| CVE-2026-23910 | — | — | — | Jan 20, 2026 | Rejected reason: Not used |
| CVE-2026-23909 | — | — | — | Jan 20, 2026 | Rejected reason: Not used |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now