2026 CVE Vulnerabilities
85,287 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-22633 | — | — | — | Jan 9, 2026 | Rejected reason: Not used |
| CVE-2026-22632 | — | — | — | Jan 9, 2026 | Rejected reason: Not used |
| CVE-2026-22631 | — | — | — | Jan 9, 2026 | Rejected reason: Not used |
| CVE-2026-22630 | — | — | — | Jan 9, 2026 | Rejected reason: Not used |
| CVE-2026-22714 | LOW | 2.3 | 0.3% | Jan 9, 2026 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed... |
| CVE-2026-22713 | MEDIUM | 5.4 | 0.2% | Jan 9, 2026 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed... |
| CVE-2026-22712 | MEDIUM | 4.3 | 0.2% | Jan 9, 2026 | Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia ... |
| CVE-2026-22710 | MEDIUM | 5.4 | 0.2% | Jan 9, 2026 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed... |
| CVE-2026-0733 | HIGH | 8.8 | 0.4% | Jan 9, 2026 | A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown functi... |
| CVE-2026-0732 | CRITICAL | 9.8 | 10.0% | Jan 9, 2026 | A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.as... |
| CVE-2026-0731 | HIGH | 7.5 | 0.6% | Jan 8, 2026 | A vulnerability has been found in TOTOLINK WA1200 5.9c.2914. The impacted element is an unknown function of the file cst... |
| CVE-2026-0730 | MEDIUM | 4.8 | 0.2% | Jan 8, 2026 | A flaw has been found in PHPGurukul Staff Leave Management System 1.0. The affected element is the function ADD_STAFF/UP... |
| CVE-2026-0729 | HIGH | 7.2 | 0.3% | Jan 8, 2026 | A vulnerability was detected in code-projects Intern Membership Management System 1.0. Impacted is an unknown function o... |
| CVE-2026-22588 | MEDIUM | 6.5 | 0.4% | Jan 8, 2026 | Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5,... |
| CVE-2026-0728 | HIGH | 7.2 | 0.4% | Jan 8, 2026 | A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects ... |
| CVE-2026-0747 | LOW | 3.3 | 0.2% | Jan 8, 2026 | Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025... |
| CVE-2026-22257 | HIGH | 8.8 | 0.3% | Jan 8, 2026 | Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder... |
| CVE-2026-22256 | HIGH | 8.8 | 0.3% | Jan 8, 2026 | Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generate an file view of a folder... |
| CVE-2026-22253 | MEDIUM | 5.4 | 0.3% | Jan 8, 2026 | Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the L... |
| CVE-2026-21860 | MEDIUM | 5.3 | 0.4% | Jan 8, 2026 | Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows p... |
| CVE-2026-22587 | MEDIUM | 5.5 | 0.2% | Jan 8, 2026 | Ideagen DevonWay contains a stored cross site scripting vulnerability. A remote, authenticated attacker could craft a pa... |
| CVE-2026-22235 | HIGH | 8.7 | 0.3% | Jan 8, 2026 | OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate thro... |
| CVE-2026-22234 | CRITICAL | 9.8 | 0.4% | Jan 8, 2026 | OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endp... |
| CVE-2026-22233 | MEDIUM | 5.4 | 0.2% | Jan 8, 2026 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field... |
| CVE-2026-22232 | MEDIUM | 5.4 | 0.2% | Jan 8, 2026 | OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now