2026 CVE Vulnerabilities
50,042 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-40515 | MEDIUM | 5.5 | 0.2% | Apr 17, 2026 | OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive fil... |
| CVE-2026-6497 | MEDIUM | 6.3 | 0.3% | Apr 17, 2026 | A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this vulnerability is an unknown fu... |
| CVE-2026-21709 | MEDIUM | 6.7 | 0.2% | Apr 17, 2026 | A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement. |
| CVE-2026-6496 | MEDIUM | 5.4 | 0.5% | Apr 17, 2026 | A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /fileman... |
| CVE-2026-6492 | MEDIUM | 5.5 | 0.4% | Apr 17, 2026 | A vulnerability was detected in arnobt78 Hotel Booking Management System up to f8922d0e0f6ac1cc761974c7616f44c2bbc04bea.... |
| CVE-2026-6491 | MEDIUM | 5.3 | 0.2% | Apr 17, 2026 | A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec o... |
| CVE-2026-40458 | MEDIUM | 6.5 | 0.2% | Apr 17, 2026 | PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website wh... |
| CVE-2026-6489 | MEDIUM | 6.3 | 0.3% | Apr 17, 2026 | A security flaw has been discovered in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This issue affects ... |
| CVE-2026-6488 | MEDIUM | 6.3 | 0.2% | Apr 17, 2026 | A vulnerability was identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This vulnerability affec... |
| CVE-2026-6487 | MEDIUM | 4.3 | 0.4% | Apr 17, 2026 | A flaw has been found in Qihui jtbc5 CMS 5.0.3.6. Affected is an unknown function of the file /dev/code/common/diplomat/... |
| CVE-2026-28263 | MEDIUM | 4.8 | 0.2% | Apr 17, 2026 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5,... |
| CVE-2026-23777 | MEDIUM | 6.5 | 0.3% | Apr 17, 2026 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5,... |
| CVE-2026-5131 | MEDIUM | 6.9 | 0.4% | Apr 17, 2026 | GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access cont... |
| CVE-2026-35153 | MEDIUM | 6.7 | 0.2% | Apr 17, 2026 | Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release vers... |
| CVE-2026-35074 | MEDIUM | 6.7 | 0.6% | Apr 17, 2026 | Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release vers... |
| CVE-2026-35073 | MEDIUM | 6.7 | 0.6% | Apr 17, 2026 | Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release vers... |
| CVE-2026-35072 | MEDIUM | 6.7 | 0.6% | Apr 17, 2026 | Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release vers... |
| CVE-2026-23779 | MEDIUM | 6.7 | 0.5% | Apr 17, 2026 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5,... |
| CVE-2026-6494 | MEDIUM | 5.3 | 0.3% | Apr 17, 2026 | A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by ... |
| CVE-2026-6439 | MEDIUM | 4.4 | 0.2% | Apr 17, 2026 | The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. Th... |
| CVE-2026-23775 | MEDIUM | 5.7 | 0.3% | Apr 17, 2026 | Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 throu... |
| CVE-2026-6451 | MEDIUM | 4.3 | 0.2% | Apr 17, 2026 | The cms-fuer-motorrad-werkstaetten plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to an... |
| CVE-2026-6441 | MEDIUM | 4.3 | 0.3% | Apr 17, 2026 | The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due... |
| CVE-2026-5797 | MEDIUM | 5.3 | 0.5% | Apr 17, 2026 | The Quiz And Survey Master plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to and inc... |
| CVE-2026-35496 | MEDIUM | 5.1 | 0.3% | Apr 17, 2026 | A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privileg... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now