2026 CVE Vulnerabilities
49,638 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-43000 | HIGH | 8.8 | 0.3% | May 28, 2026 | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation ... |
| CVE-2026-42999 | HIGH | 8.8 | 0.3% | May 28, 2026 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditi... |
| CVE-2026-42998 | HIGH | 8.8 | 0.3% | May 28, 2026 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin d... |
| CVE-2026-30761 | HIGH | 7.3 | 0.4% | May 28, 2026 | An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6... |
| CVE-2026-30760 | HIGH | 7.3 | 0.3% | May 28, 2026 | An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the... |
| CVE-2026-45373 | HIGH | 7.4 | 0.2% | May 28, 2026 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames t... |
| CVE-2026-45353 | HIGH | 7.8 | 0.1% | May 28, 2026 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vul... |
| CVE-2026-45348 | HIGH | 8.7 | 0.2% | May 28, 2026 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template a... |
| CVE-2026-45310 | HIGH | 7.4 | 0.2% | May 28, 2026 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's... |
| CVE-2026-45296 | HIGH | 7.7 | 0.2% | May 28, 2026 | OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey ro... |
| CVE-2026-44798 | HIGH | 7.1 | 0.3% | May 28, 2026 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to ... |
| CVE-2026-44797 | HIGH | 8.5 | 0.2% | May 28, 2026 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook dat... |
| CVE-2026-34126 | HIGH | 7.5 | 0.1% | May 28, 2026 | TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth... |
| CVE-2026-9096 | HIGH | 7.5 | 0.3% | May 28, 2026 | Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-val... |
| CVE-2026-9095 | HIGH | 8.1 | 0.3% | May 28, 2026 | Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlRespon... |
| CVE-2026-8697 | HIGH | 8.8 | 0.5% | May 28, 2026 | Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service all... |
| CVE-2026-6720 | HIGH | 7.2 | 0.2% | May 28, 2026 | When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded ... |
| CVE-2026-44543 | HIGH | 8.7 | 0.4% | May 28, 2026 | Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.3... |
| CVE-2026-44466 | HIGH | 8.6 | 0.2% | May 28, 2026 | Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash arithmetic expans... |
| CVE-2026-44465 | HIGH | 8.6 | 0.3% | May 28, 2026 | Zed is a code editor. Prior to 0.227.1, Zed IDE executes arbitrary commands when opening a folder with a malicious .git/... |
| CVE-2026-44463 | HIGH | 7.8 | 0.2% | May 28, 2026 | Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment ... |
| CVE-2026-44462 | HIGH | 8.8 | 0.4% | May 28, 2026 | Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash variable expansio... |
| CVE-2026-44461 | HIGH | 8.6 | 0.3% | May 28, 2026 | Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with ex... |
| CVE-2026-48526 | HIGH | 7.4 | 0.4% | May 28, 2026 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, whil... |
| CVE-2026-45017 | HIGH | 7.5 | 0.3% | May 28, 2026 | Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and Cac... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now