2026 CVE Vulnerabilities
50,357 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-4812 | MEDIUM | 5.3 | 0.6% | Apr 15, 2026 | The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disc... |
| CVE-2026-40105 | MEDIUM | 6.1 | 0.5% | Apr 15, 2026 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-r... |
| CVE-2026-40096 | MEDIUM | 5.4 | 0.2% | Apr 15, 2026 | immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open re... |
| CVE-2026-40091 | MEDIUM | 4.4 | 0.2% | Apr 15, 2026 | SpiceDB is an open source database system for creating and managing security-critical application permissions. In versio... |
| CVE-2026-39984 | MEDIUM | 5.5 | 0.1% | Apr 15, 2026 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authoriza... |
| CVE-2026-39963 | MEDIUM | 6.9 | 0.2% | Apr 15, 2026 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in in... |
| CVE-2026-2396 | MEDIUM | 4.4 | 0.2% | Apr 15, 2026 | The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event descriptio... |
| CVE-2026-1541 | MEDIUM | 4.3 | 0.3% | Apr 15, 2026 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, a... |
| CVE-2026-1509 | MEDIUM | 5.4 | 0.3% | Apr 15, 2026 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up... |
| CVE-2026-1314 | MEDIUM | 5.3 | 0.9% | Apr 15, 2026 | The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauth... |
| CVE-2026-35034 | MEDIUM | 6.5 | 0.3% | Apr 14, 2026 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability... |
| CVE-2026-27301 | MEDIUM | 5.5 | 0.2% | Apr 14, 2026 | Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead ... |
| CVE-2026-27300 | MEDIUM | 5.5 | 0.2% | Apr 14, 2026 | Adobe Framemaker versions 2022.8 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could... |
| CVE-2026-27299 | MEDIUM | 6.3 | 0.2% | Apr 14, 2026 | Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead ... |
| CVE-2026-34370 | MEDIUM | 6.5 | 0.2% | Apr 14, 2026 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains ... |
| CVE-2026-34213 | MEDIUM | 5.4 | 0.2% | Apr 14, 2026 | Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.7... |
| CVE-2026-34212 | MEDIUM | 5.4 | 0.2% | Apr 14, 2026 | Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralizati... |
| CVE-2026-33193 | MEDIUM | 4.6 | 0.2% | Apr 14, 2026 | Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a store... |
| CVE-2026-33146 | MEDIUM | 4.3 | 0.3% | Apr 14, 2026 | Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions ... |
| CVE-2026-34161 | MEDIUM | 5.4 | 0.2% | Apr 14, 2026 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting... |
| CVE-2026-25133 | MEDIUM | 4.8 | 0.2% | Apr 14, 2026 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cros... |
| CVE-2026-25125 | MEDIUM | 4.9 | 0.3% | Apr 14, 2026 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side... |
| CVE-2026-27222 | MEDIUM | 5.5 | 0.2% | Apr 14, 2026 | Bridge versions 16.0.2, 15.1.4 and earlier are affected by a Divide By Zero vulnerability that could lead to application... |
| CVE-2026-34625 | MEDIUM | 5.4 | 0.2% | Apr 14, 2026 | Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vuln... |
| CVE-2026-34624 | MEDIUM | 5.4 | 0.2% | Apr 14, 2026 | Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vuln... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now