2026 CVE Vulnerabilities
85,283 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-0990 | MEDIUM | 5.9 | 0.8% | Jan 15, 2026 | A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogX... |
| CVE-2026-0989 | LOW | 3.7 | 0.5% | Jan 15, 2026 | A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser... |
| CVE-2026-22646 | HIGH | 7.5 | 0.4% | Jan 15, 2026 | Certain error messages returned by the application expose internal system details that should not be visible to end user... |
| CVE-2026-22645 | MEDIUM | 5.3 | 0.4% | Jan 15, 2026 | The application discloses all used components, versions and license information to unauthenticated actors, giving attack... |
| CVE-2026-22644 | HIGH | 7.5 | 0.5% | Jan 15, 2026 | Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft throu... |
| CVE-2026-22643 | — | — | — | Jan 15, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-22642 | — | — | — | Jan 15, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-22641 | — | — | — | Jan 15, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-22640 | — | — | — | Jan 15, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-22639 | — | — | — | Jan 15, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-22638 | — | — | — | Jan 15, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-0897 | HIGH | 7.5 | 0.3% | Jan 15, 2026 | Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through ... |
| CVE-2026-22920 | — | — | — | Jan 15, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-22919 | MEDIUM | 4.8 | 0.3% | Jan 15, 2026 | An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site... |
| CVE-2026-22918 | HIGH | 8.2 | 0.3% | Jan 15, 2026 | An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions thr... |
| CVE-2026-22917 | HIGH | 7.5 | 0.5% | Jan 15, 2026 | Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service. |
| CVE-2026-22916 | MEDIUM | 5.4 | 0.3% | Jan 15, 2026 | An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without... |
| CVE-2026-22915 | MEDIUM | 6.5 | 0.4% | Jan 15, 2026 | An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing ... |
| CVE-2026-22914 | MEDIUM | 6.5 | 0.3% | Jan 15, 2026 | An attacker with limited permissions may still be able to write files to specific locations on the device, potentially l... |
| CVE-2026-22913 | MEDIUM | 6.1 | 0.3% | Jan 15, 2026 | Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead ... |
| CVE-2026-22912 | MEDIUM | 6.1 | 0.3% | Jan 15, 2026 | Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authenticatio... |
| CVE-2026-22911 | HIGH | 7.5 | 0.5% | Jan 15, 2026 | Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover cre... |
| CVE-2026-22910 | CRITICAL | 9.1 | 0.4% | Jan 15, 2026 | The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the ris... |
| CVE-2026-22909 | CRITICAL | 9.1 | 0.5% | Jan 15, 2026 | Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete inst... |
| CVE-2026-22908 | CRITICAL | 9.1 | 0.5% | Jan 15, 2026 | Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially comprom... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now