CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-110024@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults@fastify/jwt
- CVE-2026-111988dyad-sh dyad OAuth Callback cross-site request forgerydyad-sh dyad
- CVE-2026-111987AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scriptingAUTOMATIC1111 stable-diffusion-webui
- CVE-2026-111986AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injectionAUTOMATIC1111 stable-diffusion-webui
- CVE-2026-112063libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hilibstrophe
- CVE-2026-112062lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response HandlerlwIP
- CVE-2026-112061librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_DecodeRTMPDump librtmp
- CVE-2026-112060librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_DecodeRTMPDump librtmp
- CVE-2026-112059libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLRlibLAS
- CVE-2026-112058libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTTVideoLAN libdvdnav
- CVE-2026-112057libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chaptersVideoLAN libdvdnav
- CVE-2026-112056wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSHwvWare wv
- CVE-2026-112055wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKPwvWare wv
- CVE-2026-112054Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsingschroedinger
- CVE-2026-112053Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrixschroedinger
- CVE-2026-112052libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsinglibspatialite
- CVE-2026-112051Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registrationxorbitsai inference
- CVE-2026-112050Gitify before 7.10.0 Login CSRF via Missing OAuth State Validationgitify-app gitify
- CVE-2026-112049Vita3K before build 4187 Path Traversal via VPK Package InstallationVita3K
- CVE-2026-112048libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Countlibspatialite
- CVE-2026-112047OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actionsoneuptime
- CVE-2026-112046OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()OW2 ASM
- CVE-2026-111985AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resourcesAUTOMATIC1111 stable-diffusion-webui
- RUSTSEC-2026-0414Exponential event growth with ENABLE_WIKILINKSpulldown-cmark
- CVE-2026-111984AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scriptingAUTOMATIC1111 stable-diffusion-webui
- CVE-2026-112021snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()grunfink snac2
- CVE-2026-112020LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()lvandeve lodepng
- CVE-2026-112019cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()jkuhlmann cgltf
- CVE-2026-112018cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()jkuhlmann cgltf
- CVE-2026-112017JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline BypassJeecgBoot