2026 CVE Vulnerabilities
64,772 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-94497 | HIGH | 8.3 | 0.3% | Sep 21, 2026 | jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resour... |
| CVE-2026-94496 | HIGH | 8.3 | 0.3% | Sep 21, 2026 | jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to mo... |
| CVE-2026-94495 | HIGH | 7.1 | 0.4% | Sep 21, 2026 | jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authen... |
| CVE-2026-94412 | HIGH | 8.8 | 0.3% | Sep 21, 2026 | jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authen... |
| CVE-2026-94411 | HIGH | 8.8 | 0.5% | Sep 21, 2026 | jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authen... |
| CVE-2026-94403 | HIGH | 8.8 | 0.1% | Sep 21, 2026 | A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library e... |
| CVE-2026-63330 | HIGH | 7.7 | 0.4% | Sep 21, 2026 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in war... |
| CVE-2026-49810 | HIGH | 7.8 | 0.1% | Sep 21, 2026 | Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log... |
| CVE-2026-17052 | HIGH | 7.8 | 0.1% | Sep 21, 2026 | The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_... |
| CVE-2026-94488 | HIGH | 8.2 | 0.1% | Sep 21, 2026 | Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in... |
| CVE-2026-62369 | HIGH | 8.1 | 0.9% | Sep 21, 2026 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at ... |
| CVE-2026-62182 | HIGH | 8.8 | 0.9% | Sep 21, 2026 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at ... |
| CVE-2026-48976 | HIGH | 8.1 | 0.3% | Sep 21, 2026 | HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data... |
| CVE-2026-48975 | HIGH | 8.1 | 0.3% | Sep 21, 2026 | HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceE... |
| CVE-2026-48826 | HIGH | 8.1 | 0.3% | Sep 21, 2026 | HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1... |
| CVE-2026-94449 | HIGH | 7.5 | 0.5% | Sep 21, 2026 | A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries an... |
| CVE-2026-84990 | HIGH | 8.8 | 0.3% | Sep 21, 2026 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/config... |
| CVE-2026-83621 | HIGH | 8.1 | 0.3% | Sep 21, 2026 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_bl... |
| CVE-2026-77560 | HIGH | 8.1 | 0.6% | Sep 21, 2026 | Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensi... |
| CVE-2026-76898 | HIGH | 7.7 | 0.5% | Sep 21, 2026 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/... |
| CVE-2026-63116 | HIGH | 8.8 | 0.5% | Sep 21, 2026 | deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From... |
| CVE-2026-62371 | HIGH | 8.8 | 0.9% | Sep 21, 2026 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at ... |
| CVE-2026-82412 | HIGH | 8.8 | 0.4% | Sep 21, 2026 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scri... |
| CVE-2026-61687 | HIGH | 7.1 | 0.2% | Sep 21, 2026 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, Va... |
| CVE-2026-55563 | HIGH | 8.9 | 0.5% | Sep 21, 2026 | Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_te... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now