2026 CVE Vulnerabilities
52,659 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-5588 | HIGH | 7.5 | 0.6% | Apr 15, 2026 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all... |
| CVE-2026-3505 | HIGH | 7.5 | 0.8% | Apr 15, 2026 | Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the B... |
| CVE-2026-5694 | HIGH | 7.2 | 0.3% | Apr 15, 2026 | The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'l... |
| CVE-2026-5617 | HIGH | 8.8 | 0.4% | Apr 15, 2026 | The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3... |
| CVE-2026-3643 | HIGH | 7.2 | 0.4% | Apr 15, 2026 | The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to,... |
| CVE-2026-5088 | HIGH | 7.5 | 0.6% | Apr 15, 2026 | Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The _make_salt and... |
| CVE-2026-40719 | HIGH | 7.5 | 0.4% | Apr 15, 2026 | Deadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone whose authoritative nameserver addr... |
| CVE-2026-5397 | HIGH | 7.8 | 0.1% | Apr 15, 2026 | It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management applic... |
| CVE-2026-6328 | HIGH | 8.3 | 0.2% | Apr 15, 2026 | Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic o... |
| CVE-2026-40499 | HIGH | 7.8 | 1.2% | Apr 15, 2026 | radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function tha... |
| CVE-2026-40104 | HIGH | 8.2 | 0.4% | Apr 15, 2026 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc... |
| CVE-2026-40090 | HIGH | 7.1 | 0.3% | Apr 15, 2026 | Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write... |
| CVE-2026-39971 | HIGH | 7.2 | 0.3% | Apr 15, 2026 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/... |
| CVE-2026-39884 | HIGH | 8.1 | 0.3% | Apr 15, 2026 | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior con... |
| CVE-2026-33806 | HIGH | 7.5 | 0.4% | Apr 15, 2026 | Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypasse... |
| CVE-2026-2834 | HIGH | 7.2 | 0.3% | Apr 15, 2026 | The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site S... |
| CVE-2026-40688 | HIGH | 7.2 | 6.4% | Apr 14, 2026 | An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 th... |
| CVE-2026-39387 | HIGH | 7.2 | 0.7% | Apr 14, 2026 | BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. V... |
| CVE-2026-35032 | HIGH | 8.1 | 0.3% | Apr 14, 2026 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the Live... |
| CVE-2026-35031 | HIGH | 8.8 | 0.8% | Apr 14, 2026 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subt... |
| CVE-2026-33414 | HIGH | 7.8 | 0.6% | Apr 14, 2026 | Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerab... |
| CVE-2026-33023 | HIGH | 7.8 | 0.3% | Apr 14, 2026 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. In versions 1.8.7 and prior, when built w... |
| CVE-2026-33021 | HIGH | 7.3 | 0.2% | Apr 14, 2026 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-af... |
| CVE-2026-27298 | HIGH | 7.8 | 0.2% | Apr 14, 2026 | Adobe Framemaker versions 2022.8 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confus... |
| CVE-2026-27297 | HIGH | 7.8 | 0.2% | Apr 14, 2026 | Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability tha... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now