2026 CVE Vulnerabilities
85,283 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-0532 | HIGH | 8.6 | 0.4% | Jan 14, 2026 | External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker... |
| CVE-2026-0529 | MEDIUM | 6.5 | 0.2% | Jan 14, 2026 | Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Over... |
| CVE-2026-23550 | CRITICAL | 9.8 | 20.6% | Jan 14, 2026 | Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This... |
| CVE-2026-0813 | MEDIUM | 4.4 | 0.2% | Jan 14, 2026 | The Short Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'short_link_post_title' and 'sh... |
| CVE-2026-0812 | MEDIUM | 4.4 | 0.2% | Jan 14, 2026 | The LinkedIn SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'linkedin_sc_date_format', 'li... |
| CVE-2026-0741 | MEDIUM | 4.4 | 0.2% | Jan 14, 2026 | The Electric Studio Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin se... |
| CVE-2026-0739 | MEDIUM | 4.4 | 0.2% | Jan 14, 2026 | The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in a... |
| CVE-2026-0734 | MEDIUM | 4.4 | 0.2% | Jan 14, 2026 | The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter... |
| CVE-2026-0717 | MEDIUM | 5.3 | 0.3% | Jan 14, 2026 | The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all... |
| CVE-2026-0694 | MEDIUM | 6.4 | 0.2% | Jan 14, 2026 | The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all... |
| CVE-2026-0680 | MEDIUM | 4.4 | 0.2% | Jan 14, 2026 | The Real Post Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in a... |
| CVE-2026-0678 | MEDIUM | 4.9 | 0.3% | Jan 14, 2026 | The Flat Shipping Rate by City for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'c... |
| CVE-2026-0635 | MEDIUM | 4.3 | 0.2% | Jan 14, 2026 | The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing... |
| CVE-2026-0594 | MEDIUM | 6.1 | 0.7% | Jan 14, 2026 | The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' paramete... |
| CVE-2026-22718 | MEDIUM | 6.8 | 0.5% | Jan 14, 2026 | The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users mac... |
| CVE-2026-22686 | CRITICAL | 10 | 0.6% | Jan 14, 2026 | Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sa... |
| CVE-2026-0716 | MEDIUM | 4.8 | 0.4% | Jan 13, 2026 | A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration... |
| CVE-2026-23478 | CRITICAL | 9.8 | 0.4% | Jan 13, 2026 | Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JW... |
| CVE-2026-22871 | CRITICAL | 9.8 | 0.9% | Jan 13, 2026 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exis... |
| CVE-2026-22870 | HIGH | 7.5 | 0.4% | Jan 13, 2026 | GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not ... |
| CVE-2026-22869 | CRITICAL | 9.8 | 0.5% | Jan 13, 2026 | Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allow... |
| CVE-2026-22868 | HIGH | 7.5 | 0.6% | Jan 13, 2026 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced ... |
| CVE-2026-22862 | HIGH | 7.5 | 0.6% | Jan 13, 2026 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced ... |
| CVE-2026-22861 | HIGH | 8.8 | 0.6% | Jan 13, 2026 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio... |
| CVE-2026-21303 | MEDIUM | 5.5 | 0.2% | Jan 13, 2026 | Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now