CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-110680Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hvCpanel-JSON-XS
- CVE-2026-110678Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parseCpanel-JSON-XS
- CVE-2026-110677Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hvCpanel-JSON-XS
- CVE-2026-110676Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignumCpanel-JSON-XS
- CVE-2026-110675Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hvCpanel-JSON-XS
- CVE-2026-110674Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hvCpanel-JSON-XS
- CVE-2026-110673Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tagCpanel-JSON-XS
- CVE-2026-110672Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hvCpanel-JSON-XS
- CVE-2026-112248grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversalgrandnode2
- CVE-2026-11319TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivityTickTick Limited TickTick for Android
- CVE-2026-55644Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that originelement-hq element-x-ios
- CVE-2026-105810Authenticated Local Stack Overflow in TP-Link Tapo C320WSTP-Link Systems Tapo C320WS
- CVE-2023-38375IBM Cloud Pak System Cross-Site ScriptingIBM Cloud Pak System
- CVE-2026-3161IBM Cloud Pak System Risky Cryptographic AlgorithmIBM Cloud Pak System
- CVE-2026-3295IBM Cloud Pak System Cross-Site ScriptingIBM Cloud Pak System
- CVE-2026-4418IBM Cloud Pak System HTML InjectionIBM Cloud Pak System
- CVE-2026-111759markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesmarkdown-it
- CVE-2026-111757Hono: serveStatic decodes the request path a second time, leading to bypass of middleware on static pathshonojs hono · hono
- CVE-2026-111755follow-redirects sensitiveHeaders regex escaping can expose credential headersfollow-redirects
- CVE-2026-112377CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay AttackCCC-Attestation attested-tls-poc
- CVE-2026-1501IBM Concert Software Improper Certificate ValidationIBM Concert
- CVE-2026-1510IBM Concert Software Improper Clearing of Heap MemoryIBM Concert
- CVE-2026-3303IBM Concert Software Permissive Cross-domain Security PolicyIBM Concert
- CVE-2026-3628IBM Concert Software Information DisclosureIBM Concert
- CVE-2026-4405IBM Concert Software Use of Web Browser Cache Containing Sensitive InformationIBM Concert
- CVE-2026-4413IBM Concert Software Cross-Site ScriptingIBM Concert
- CVE-2026-6719IBM Concert Software Use of Insufficiently Random ValuesIBM Concert
- CVE-2026-112247Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scriptingWuxi Wubang Security Software Five-in-One Safety Production…
- CVE-2026-6930IBM Concert Software Risky Cryptographic AlgorithmIBM Concert
- CVE-2026-15661IBM Concert Software Improper Output Neutralization for LogsIBM Concert