CVEs from 2026

14,137 normalized CVEs published or assigned in this year.

Total

14,137

critical

critical 1,247

high

high 4,698

medium

medium 4,485

low

low 492

% Critical

8.8%

% with KEV

0.4%

% with exploit

0.7%

Top vendors

qualcomm 1,873
google 769
cisco 662
microsoft 334
adobe 333
apache 185
openclaw 173
mediatek 123

Top products

chrome 522
firepower_threat_defense_software 300
firepower_threat_defense 298
gcp 247
openclaw 172
commerce 104
netweaver_application_server_abap 102
commerce_b2b 89

Top packages

npm/openclaw 407
npm/parse-server 143
Packagist/wwbn/avideo 129
NPM/openclaw 129
Go/github.com/mattermost/mattermost-server 126
npm/n8n 120
Packagist/symfony/symfony 107
Go/github.com/mattermost/mattermost/server/v8 103

critical high medium low unknown

0

KEV Has exploit

CVE	Severity	CVSS	Risk	Flags	OS	Vendor	Published	Description
CVE-2026-1340	unknown	—	2.5				2mo ago	Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
CVE-2026-34197	unknown	—	2.5				2mo ago	Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
CVE-2026-3055	unknown	—	2.5				2mo ago	Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP lea…
CVE-2026-20127	unknown	—	2.5				3mo ago	Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, re…
CVE-2026-2441	unknown	—	2.5				4mo ago	Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple…
CVE-2026-1731	unknown	—	2.5				4mo ago	BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute oper…
CVE-2026-1281	unknown	—	2.5				4mo ago	Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
CVE-2026-24061	unknown	—	2.5				4mo ago	GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable.
CVE-2026-24486	unknown	—	1.0				4mo ago	Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_…