2026 CVE Vulnerabilities
85,287 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-0492 | HIGH | 8.8 | 0.3% | Jan 13, 2026 | SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switc... |
| CVE-2026-0491 | CRITICAL | 9.1 | 0.4% | Jan 13, 2026 | SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module ... |
| CVE-2026-22813 | MEDIUM | 6.1 | 0.9% | Jan 12, 2026 | OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into... |
| CVE-2026-22812 | HIGH | 8.8 | 17.0% | Jan 12, 2026 | OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP serv... |
| CVE-2026-22805 | HIGH | 8.6 | 0.2% | Jan 12, 2026 | Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that ... |
| CVE-2026-22804 | MEDIUM | 4.7 | 0.2% | Jan 12, 2026 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0... |
| CVE-2026-22801 | HIGH | 7.8 | 0.1% | Jan 12, 2026 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) ... |
| CVE-2026-22800 | MEDIUM | 4.5 | 0.1% | Jan 12, 2026 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Reque... |
| CVE-2026-22695 | HIGH | 7.1 | 0.2% | Jan 12, 2026 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) ... |
| CVE-2026-22214 | CRITICAL | 9.8 | 0.4% | Jan 12, 2026 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos ... |
| CVE-2026-22213 | CRITICAL | 9.8 | 0.4% | Jan 12, 2026 | RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapsli... |
| CVE-2026-22212 | MEDIUM | 4.8 | 0.1% | Jan 12, 2026 | TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility... |
| CVE-2026-22799 | HIGH | 8.8 | 0.6% | Jan 12, 2026 | Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-a... |
| CVE-2026-22798 | MEDIUM | 5 | 0.2% | Jan 12, 2026 | hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to ... |
| CVE-2026-22794 | HIGH | 8.8 | 0.4% | Jan 12, 2026 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin ... |
| CVE-2026-22789 | HIGH | 8.8 | 0.2% | Jan 12, 2026 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 con... |
| CVE-2026-22788 | HIGH | 8.2 | 0.5% | Jan 12, 2026 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2... |
| CVE-2026-22786 | HIGH | 7.2 | 0.9% | Jan 12, 2026 | Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulner... |
| CVE-2026-22772 | MEDIUM | 5.3 | 0.2% | Jan 12, 2026 | Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to ... |
| CVE-2026-22785 | CRITICAL | 9.8 | 0.7% | Jan 12, 2026 | orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0... |
| CVE-2026-22784 | MEDIUM | 4.3 | 0.2% | Jan 12, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's a... |
| CVE-2026-22783 | HIGH | 8.1 | 0.3% | Jan 12, 2026 | Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior... |
| CVE-2026-22781 | CRITICAL | 9.8 | 2.2% | Jan 12, 2026 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable... |
| CVE-2026-22776 | HIGH | 7.5 | 0.4% | Jan 12, 2026 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of S... |
| CVE-2026-22771 | HIGH | 8.8 | 0.6% | Jan 12, 2026 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now