2026 CVE Vulnerabilities
50,848 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-33774 | MEDIUM | 5.3 | 0.2% | Apr 9, 2026 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper N... |
| CVE-2026-33773 | MEDIUM | 6.9 | 0.2% | Apr 9, 2026 | An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS... |
| CVE-2026-21904 | MEDIUM | 6.1 | 0.2% | Apr 9, 2026 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Network... |
| CVE-2026-40107 | MEDIUM | 6.5 | 0.3% | Apr 9, 2026 | SiYuan is a personal knowledge management system. Prior to 3.6.4, SiYuan configures Mermaid.js with securityLevel: "loos... |
| CVE-2026-35206 | MEDIUM | 4.4 | 0.2% | Apr 9, 2026 | Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart wi... |
| CVE-2026-40087 | MEDIUM | 5.3 | 0.3% | Apr 9, 2026 | LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-str... |
| CVE-2026-39977 | MEDIUM | 6.3 | 0.3% | Apr 9, 2026 | flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key take... |
| CVE-2026-34500 | MEDIUM | 6.5 | 0.5% | Apr 9, 2026 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Ap... |
| CVE-2026-32990 | MEDIUM | 5.3 | 0.3% | Apr 9, 2026 | Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects... |
| CVE-2026-25854 | MEDIUM | 6.1 | 0.5% | Apr 9, 2026 | Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDraini... |
| CVE-2026-35195 | MEDIUM | 5.4 | 0.2% | Apr 9, 2026 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transco... |
| CVE-2026-34988 | MEDIUM | 6.3 | 0.3% | Apr 9, 2026 | Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of it... |
| CVE-2026-34983 | MEDIUM | 5 | 0.1% | Apr 9, 2026 | Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free... |
| CVE-2026-34945 | MEDIUM | 6.5 | 0.3% | Apr 9, 2026 | Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler conta... |
| CVE-2026-34944 | MEDIUM | 5.7 | 0.2% | Apr 9, 2026 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabl... |
| CVE-2026-34942 | MEDIUM | 6.5 | 0.4% | Apr 9, 2026 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transco... |
| CVE-2026-5329 | MEDIUM | 6.5 | 0.4% | Apr 9, 2026 | Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring... |
| CVE-2026-40071 | MEDIUM | 5.4 | 0.2% | Apr 9, 2026 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /j... |
| CVE-2026-39985 | MEDIUM | 6.1 | 0.2% | Apr 9, 2026 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project... |
| CVE-2026-39961 | MEDIUM | 4.9 | 0.4% | Apr 9, 2026 | Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.3... |
| CVE-2026-39315 | MEDIUM | 6.1 | 0.3% | Apr 9, 2026 | Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable that Nuxt's own documen... |
| CVE-2026-35207 | MEDIUM | 5.4 | 0.1% | Apr 9, 2026 | dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-contr... |
| CVE-2026-39957 | MEDIUM | 4.3 | 0.2% | Apr 9, 2026 | Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController:... |
| CVE-2026-39943 | MEDIUM | 6.5 | 0.2% | Apr 9, 2026 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revis... |
| CVE-2026-39856 | MEDIUM | 5.5 | 0.1% | Apr 9, 2026 | osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulne... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now