2026 CVE Vulnerabilities
85,283 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-23492 | MEDIUM | 4.9 | 0.4% | Jan 14, 2026 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injectio... |
| CVE-2026-23477 | MEDIUM | 6.5 | 0.3% | Jan 14, 2026 | Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0,... |
| CVE-2026-22036 | HIGH | 7.5 | 0.4% | Jan 14, 2026 | Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is ... |
| CVE-2026-22859 | CRITICAL | 9.1 | 0.8% | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bou... |
| CVE-2026-22858 | CRITICAL | 9.1 | 0.6% | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in... |
| CVE-2026-22857 | CRITICAL | 9.8 | 0.5% | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_th... |
| CVE-2026-22856 | HIGH | 8.1 | 0.3% | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP threa... |
| CVE-2026-22855 | CRITICAL | 9.1 | 0.8% | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in th... |
| CVE-2026-22854 | CRITICAL | 9.8 | 0.5% | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive... |
| CVE-2026-22853 | CRITICAL | 9.8 | 0.7% | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not per... |
| CVE-2026-22852 | CRITICAL | 9.8 | 0.4% | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a h... |
| CVE-2026-22851 | MEDIUM | 5.9 | 0.2% | Jan 14, 2026 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dy... |
| CVE-2026-22819 | LOW | 3.1 | 0.2% | Jan 14, 2026 | Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more t... |
| CVE-2026-22787 | MEDIUM | 6.1 | 0.3% | Jan 14, 2026 | html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js cont... |
| CVE-2026-22779 | MEDIUM | 5.3 | 0.3% | Jan 14, 2026 | BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP ... |
| CVE-2026-22708 | CRITICAL | 9.8 | 0.5% | Jan 14, 2026 | Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode wi... |
| CVE-2026-22694 | MEDIUM | 6.1 | 0.1% | Jan 14, 2026 | AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through ... |
| CVE-2026-21889 | HIGH | 7.5 | 0.3% | Jan 14, 2026 | Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server... |
| CVE-2026-22211 | MEDIUM | 5.1 | 0.2% | Jan 14, 2026 | TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted out... |
| CVE-2026-22820 | LOW | 3.7 | 0.2% | Jan 14, 2026 | Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the s... |
| CVE-2026-22240 | HIGH | 7.5 | 3.0% | Jan 14, 2026 | The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unau... |
| CVE-2026-22239 | MEDIUM | 5.3 | 0.3% | Jan 14, 2026 | The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker co... |
| CVE-2026-22238 | CRITICAL | 9.8 | 0.6% | Jan 14, 2026 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remot... |
| CVE-2026-22237 | CRITICAL | 9.8 | 0.4% | Jan 14, 2026 | The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated rem... |
| CVE-2026-22236 | CRITICAL | 9.8 | 0.5% | Jan 14, 2026 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated rem... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now