2026 CVE Vulnerabilities
51,000 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-42855 | HIGH | 7.5 | 0.4% | May 12, 2026 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Pr... |
| CVE-2026-42844 | HIGH | 8.8 | 0.3% | May 12, 2026 | Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write ca... |
| CVE-2026-42544 | HIGH | 7.5 | 0.3% | May 12, 2026 | Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unau... |
| CVE-2026-42268 | HIGH | 7.5 | 0.4% | May 12, 2026 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.... |
| CVE-2026-40902 | HIGH | 7.5 | 0.4% | May 12, 2026 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, ... |
| CVE-2026-40863 | HIGH | 7.5 | 0.4% | May 12, 2026 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, ... |
| CVE-2026-35555 | HIGH | 7 | 0.2% | May 12, 2026 | PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an... |
| CVE-2026-26289 | HIGH | 8.4 | 0.1% | May 12, 2026 | PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to ... |
| CVE-2026-44403 | HIGH | 8.6 | 2.6% | May 12, 2026 | Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization ... |
| CVE-2026-44246 | HIGH | 7.2 | 0.2% | May 12, 2026 | nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nn... |
| CVE-2026-44240 | HIGH | 7.5 | 0.5% | May 12, 2026 | basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when pa... |
| CVE-2026-44232 | HIGH | 8.7 | 0.3% | May 12, 2026 | DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, eve... |
| CVE-2026-44224 | HIGH | 8.8 | 0.4% | May 12, 2026 | Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbi... |
| CVE-2026-44012 | HIGH | 7.1 | 0.3% | May 12, 2026 | Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() ... |
| CVE-2026-44011 | HIGH | 8.6 | 0.3% | May 12, 2026 | Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an inp... |
| CVE-2026-44010 | HIGH | 7.1 | 0.3% | May 12, 2026 | Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element res... |
| CVE-2026-7474 | HIGH | 8.8 | 6.9% | May 12, 2026 | HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path t... |
| CVE-2026-44872 | HIGH | 7.2 | 0.8% | May 12, 2026 | A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Su... |
| CVE-2026-44870 | HIGH | 8.8 | 0.9% | May 12, 2026 | Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS... |
| CVE-2026-44869 | HIGH | 8.8 | 0.9% | May 12, 2026 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Suc... |
| CVE-2026-44868 | HIGH | 8.8 | 0.9% | May 12, 2026 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Suc... |
| CVE-2026-44867 | HIGH | 8.8 | 0.9% | May 12, 2026 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Suc... |
| CVE-2026-44866 | HIGH | 8.8 | 0.9% | May 12, 2026 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Suc... |
| CVE-2026-44865 | HIGH | 7.2 | 0.9% | May 12, 2026 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Suc... |
| CVE-2026-44864 | HIGH | 7.2 | 0.3% | May 12, 2026 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 com... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now