CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-112285Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later OrdersThelia
- CVE-2026-112284libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGRxqq libaribcaption
- CVE-2026-112283libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_pointsVideoLAN libbluray
- CVE-2026-112282VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_pointVideoLAN libbluray
- CVE-2026-112281libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csinkoriyama aribb24
- CVE-2026-112280libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_bodynkoriyama aribb24
- CVE-2026-112279rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2rdesktop
- CVE-2026-112278rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcacherdesktop
- CVE-2026-112277rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_planerdesktop
- CVE-2026-112276Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm ColormapNetpbm
- CVE-2026-112275Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_imageNetpbm
- CVE-2026-112274libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::initlibtins
- CVE-2026-112273libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_namelibtins
- CVE-2026-112272libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parseremersion libdisplay-info
- CVE-2026-112271libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parseremersion libdisplay-info
- CVE-2026-112270SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idxsgl-project sglang
- CVE-2026-112269SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrationssgl-project sglang
- CVE-2026-112268sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routessgl-project sglang-router
- CVE-2026-112267SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Workersgl-project sglang
- CVE-2026-112266SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matchingsgl-project sglang
- CVE-2026-112265LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verificationlangbot-app LangBot
- CVE-2026-112264BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env KeysBentoML
- CVE-2026-112263Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formattingalexpasmantier television
- CVE-2026-112262RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectorsrisingwavelabs risingwave
- CVE-2026-111939Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creationfrappe helpdesk
- CVE-2026-111938Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_logfrappe crm
- CVE-2026-111937Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Recordsfrappe crm
- CVE-2026-111936Sigma File Manager through 2.2.0 SSRF via Extension Download Commandsaleksey-hoffman Sigma File Manager
- CVE-2026-111935NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysiscodexu NoteGen
- CVE-2026-111925Mopidy before 4.0.5 Path Traversal via File Backend library.lookupMopidy