2026 CVE Vulnerabilities
48,018 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-9646 | MEDIUM | 6.1 | 0.2% | May 28, 2026 | A reflected cross-site scripting issue exists in URL handling. |
| CVE-2026-49095 | MEDIUM | 6.5 | 0.3% | May 28, 2026 | Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation.... |
| CVE-2026-49094 | MEDIUM | 6.5 | 0.3% | May 28, 2026 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)... |
| CVE-2026-46843 | MEDIUM | 5.3 | 0.3% | May 28, 2026 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E... |
| CVE-2026-46842 | MEDIUM | 5.3 | 0.2% | May 28, 2026 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E... |
| CVE-2026-46841 | MEDIUM | 5.3 | 0.2% | May 28, 2026 | Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.1.0... |
| CVE-2026-46830 | MEDIUM | 5.3 | 0.2% | May 28, 2026 | Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.... |
| CVE-2026-42400 | MEDIUM | 6.5 | 0.3% | May 28, 2026 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)... |
| CVE-2026-42399 | MEDIUM | 6.5 | 0.3% | May 28, 2026 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)... |
| CVE-2026-42070 | MEDIUM | 5.3 | 0.3% | May 28, 2026 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, the mc_issue_update() function in Mantis... |
| CVE-2026-41897 | MEDIUM | 5.3 | 0.3% | May 28, 2026 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.0.0 to 2.28.1, lack of validation of filter_target... |
| CVE-2026-49130 | MEDIUM | 6.9 | 0.3% | May 28, 2026 | Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function ... |
| CVE-2026-49129 | MEDIUM | 6.9 | 0.3% | May 28, 2026 | Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin... |
| CVE-2026-42401 | MEDIUM | 5.4 | 0.1% | May 28, 2026 | Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user... |
| CVE-2026-33464 | MEDIUM | 6.5 | 0.2% | May 28, 2026 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-13... |
| CVE-2026-33463 | MEDIUM | 5.3 | 0.2% | May 28, 2026 | Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclos... |
| CVE-2026-47335 | MEDIUM | 5.5 | 0.1% | May 28, 2026 | Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notificatio... |
| CVE-2026-47334 | MEDIUM | 5.5 | 0.1% | May 28, 2026 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notifi... |
| CVE-2026-47332 | MEDIUM | 5.5 | 0.1% | May 28, 2026 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structu... |
| CVE-2026-47328 | MEDIUM | 6.1 | 0.1% | May 28, 2026 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not ... |
| CVE-2026-47326 | MEDIUM | 5.5 | 0.1% | May 28, 2026 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor not... |
| CVE-2026-47136 | MEDIUM | 6.9 | 0.3% | May 28, 2026 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rus... |
| CVE-2026-46685 | MEDIUM | 6 | 0.1% | May 28, 2026 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is ... |
| CVE-2026-46526 | MEDIUM | 5 | 0.2% | May 28, 2026 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.10, the URL checking ... |
| CVE-2026-45040 | MEDIUM | 5.3 | 0.2% | May 28, 2026 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive inform... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now