2026 CVE Vulnerabilities
49,842 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-44462 | HIGH | 8.8 | 0.4% | May 28, 2026 | Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash variable expansio... |
| CVE-2026-44461 | HIGH | 8.6 | 0.3% | May 28, 2026 | Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with ex... |
| CVE-2026-48526 | HIGH | 7.4 | 0.4% | May 28, 2026 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, whil... |
| CVE-2026-45017 | HIGH | 7.5 | 0.3% | May 28, 2026 | Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and Cac... |
| CVE-2026-44594 | HIGH | 7.5 | 0.3% | May 28, 2026 | esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI... |
| CVE-2026-44593 | HIGH | 8.7 | 0.4% | May 28, 2026 | esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first ret... |
| CVE-2026-44358 | HIGH | 8.2 | 0.2% | May 28, 2026 | Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior t... |
| CVE-2026-41565 | HIGH | 7.5 | 0.5% | May 28, 2026 | CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_dec... |
| CVE-2026-35676 | HIGH | 8.8 | 0.2% | May 28, 2026 | phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint ... |
| CVE-2026-35675 | HIGH | 8.8 | 0.3% | May 28, 2026 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthe... |
| CVE-2026-35672 | HIGH | 8.7 | 0.4% | May 28, 2026 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientT... |
| CVE-2026-35671 | HIGH | 8.8 | 0.3% | May 28, 2026 | phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint... |
| CVE-2026-49238 | HIGH | 8.4 | 0.5% | May 28, 2026 | An issue was discovered in Canonical Multipass before version 1.16.3. The host-side SFTP server component (sshfs_server)... |
| CVE-2026-49237 | HIGH | 7.8 | 0.1% | May 28, 2026 | An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-519... |
| CVE-2026-37579 | HIGH | 7.3 | 0.3% | May 28, 2026 | An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMe... |
| CVE-2026-37266 | HIGH | 8 | 0.3% | May 28, 2026 | An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary ... |
| CVE-2026-9658 | HIGH | 7.3 | 0.2% | May 28, 2026 | Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. T... |
| CVE-2026-47074 | HIGH | 8.7 | 0.2% | May 28, 2026 | Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows ... |
| CVE-2026-46241 | HIGH | 7.8 | 0.1% | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix use-after-free on registration fa... |
| CVE-2026-46240 | HIGH | 7.8 | 0.1% | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix use-after-free in iris_release_int... |
| CVE-2026-46238 | HIGH | 8.8 | 0.3% | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: stop caching unowned originator pointer... |
| CVE-2026-46234 | HIGH | 7.8 | 0.1% | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order In vsock_upd... |
| CVE-2026-46232 | HIGH | 8.1 | 0.3% | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A device... |
| CVE-2026-46230 | HIGH | 7.1 | 0.1% | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec... |
| CVE-2026-46227 | HIGH | 7.8 | 0.1% | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now