CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-112254agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgeryagit8or1 clientst0r
- CVE-2026-112260Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsingRed Hat Enterprise Linux
- CVE-2026-112782Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Servicegetgrav grav
- CVE-2026-112781Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directivesgetgrav grav
- CVE-2026-112780Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@getgrav grav
- CVE-2026-112779Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypassgetgrav grav-plugin-api
- CVE-2026-112778Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotationstraefik
- CVE-2026-112777Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCEcraftcms cms
- CVE-2026-112776Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutationscraftcms cms
- CVE-2026-112775Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-passwordcraftcms cms
- CVE-2026-112774Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layoutcraftcms cms
- CVE-2026-112773Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injectioncraftcms cms
- CVE-2026-112772Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injectioncraftcms cms
- CVE-2026-112771Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filterscraftcms cms
- CVE-2026-112770Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callablecraftcms cms
- CVE-2026-112769Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypassparse-community parse-server
- CVE-2026-112768Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Updateparse-community parse-server
- CVE-2026-112252Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injectionWuxi Wubang Security Software Wubang Five-in-One Safety Pro…
- CVE-2026-112259Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette importRed Hat Enterprise Linux
- CVE-2026-112251antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirectantoinersx clawhost
- CVE-2026-109437Cognition < 0.13.0 Unauthenticated RCE via Local Shell BackendCognicellAI Cognition
- CVE-2026-112249grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scriptinggrandnode2
- CVE-2026-109434Sleipnir Browser < 3.9.0 Fullscreen Address Bar SpoofingFenrir Sleipnir Mobile for Android
- CVE-2026-110688Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parseCpanel-JSON-XS
- CVE-2026-110687Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmpCpanel-JSON-XS
- CVE-2026-110686Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hvCpanel-JSON-XS
- CVE-2026-110685Cpanel-JSON-XS memory leak in decode_tag enables denial of serviceCpanel-JSON-XS
- CVE-2026-110684Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its…Cpanel-JSON-XS
- CVE-2026-110682Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parseCpanel-JSON-XS
- CVE-2026-110681Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithreadCpanel-JSON-XS