2026 CVE Vulnerabilities
51,076 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-3609 | HIGH | 7.8 | 0.2% | May 11, 2026 | Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vuln... |
| CVE-2026-38568 | HIGH | 8.1 | 0.2% | May 11, 2026 | HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on ... |
| CVE-2026-38566 | HIGH | 8.1 | 0.2% | May 11, 2026 | HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms (password change a... |
| CVE-2026-36983 | HIGH | 7.3 | 1.2% | May 11, 2026 | D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd. The man... |
| CVE-2026-36962 | HIGH | 7.3 | 0.4% | May 11, 2026 | SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve... |
| CVE-2026-30635 | HIGH | 8.1 | 1.0% | May 11, 2026 | Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via ... |
| CVE-2026-2393 | HIGH | 7.1 | 0.3% | May 11, 2026 | A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` fun... |
| CVE-2026-2291 | HIGH | 7.3 | 0.8% | May 11, 2026 | dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS... |
| CVE-2026-44738 | HIGH | 7.7 | 0.3% | May 11, 2026 | Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.page... |
| CVE-2026-42845 | HIGH | 7.7 | 0.6% | May 11, 2026 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unauthenticated page-con... |
| CVE-2026-42843 | HIGH | 8.8 | 0.4% | May 11, 2026 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configur... |
| CVE-2026-42603 | HIGH | 8.8 | 0.3% | May 11, 2026 | OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and m... |
| CVE-2026-42349 | HIGH | 8.1 | 0.2% | May 11, 2026 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related auth... |
| CVE-2026-33362 | HIGH | 8.6 | 0.2% | May 11, 2026 | In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps ... |
| CVE-2026-33361 | HIGH | 7.5 | 0.2% | May 11, 2026 | In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), a... |
| CVE-2026-33359 | HIGH | 7.5 | 0.3% | May 11, 2026 | In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion s... |
| CVE-2026-33357 | HIGH | 7.5 | 0.2% | May 11, 2026 | In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and... |
| CVE-2026-33356 | HIGH | 7.7 | 0.3% | May 11, 2026 | In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to gl... |
| CVE-2026-31254 | HIGH | 7.3 | 0.2% | May 11, 2026 | The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection ... |
| CVE-2026-31253 | HIGH | 7.3 | 0.2% | May 11, 2026 | The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an ins... |
| CVE-2026-31251 | HIGH | 7.3 | 0.2% | May 11, 2026 | CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera... |
| CVE-2026-31250 | HIGH | 7.3 | 0.2% | May 11, 2026 | CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera... |
| CVE-2026-31249 | HIGH | 7.3 | 0.2% | May 11, 2026 | CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera... |
| CVE-2026-31248 | HIGH | 7.5 | 0.3% | May 11, 2026 | Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and val... |
| CVE-2026-7819 | HIGH | 8.1 | 0.4% | May 11, 2026 | Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now