2026 CVE Vulnerabilities
49,764 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-44655 | HIGH | 8.6 | 0.3% | May 28, 2026 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.3.0 to 2.28.1, unescaped Project Name allows an at... |
| CVE-2026-42398 | HIGH | 7.7 | 0.3% | May 28, 2026 | Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypas... |
| CVE-2026-42071 | HIGH | 7.2 | 0.3% | May 28, 2026 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 2.23.0 to 2.28.1, a missing authorization check in M... |
| CVE-2026-35277 | HIGH | 8.1 | 0.3% | May 28, 2026 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. E... |
| CVE-2026-35266 | HIGH | 7.9 | 0.1% | May 28, 2026 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. D... |
| CVE-2026-9039 | HIGH | 8.6 | 0.2% | May 28, 2026 | A configuration weakness in the device’s remote management service allows an authenticated session to be established ove... |
| CVE-2026-9038 | HIGH | 8.6 | 0.2% | May 28, 2026 | A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with... |
| CVE-2026-49128 | HIGH | 8.7 | 0.5% | May 28, 2026 | Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow a... |
| CVE-2026-49127 | HIGH | 8.8 | 0.5% | May 28, 2026 | Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be f... |
| CVE-2026-33590 | HIGH | 8.5 | 0.5% | May 28, 2026 | Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access a... |
| CVE-2026-33462 | HIGH | 7.3 | 0.2% | May 28, 2026 | A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with... |
| CVE-2026-32847 | HIGH | 8.7 | 0.4% | May 28, 2026 | DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/mai... |
| CVE-2026-4944 | HIGH | 8.8 | 0.7% | May 28, 2026 | vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in t... |
| CVE-2026-47333 | HIGH | 7.8 | 0.1% | May 28, 2026 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an i... |
| CVE-2026-47331 | HIGH | 7.8 | 0.1% | May 28, 2026 | Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivile... |
| CVE-2026-46509 | HIGH | 8.2 | 0.3% | May 28, 2026 | deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when prope... |
| CVE-2026-45332 | HIGH | 7.5 | 0.3% | May 28, 2026 | Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Acce... |
| CVE-2026-45044 | HIGH | 8.8 | 0.3% | May 28, 2026 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelis... |
| CVE-2026-45042 | HIGH | 7.1 | 0.2% | May 28, 2026 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the Upload... |
| CVE-2026-45041 | HIGH | 8.7 | 0.2% | May 28, 2026 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a ... |
| CVE-2026-44394 | HIGH | 8.1 | 0.2% | May 28, 2026 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not p... |
| CVE-2026-43000 | HIGH | 8.8 | 0.3% | May 28, 2026 | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation ... |
| CVE-2026-42999 | HIGH | 8.8 | 0.3% | May 28, 2026 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditi... |
| CVE-2026-42998 | HIGH | 8.8 | 0.3% | May 28, 2026 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin d... |
| CVE-2026-30761 | HIGH | 7.3 | 0.4% | May 28, 2026 | An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now