CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-105815Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210TP-Link Systems Tapo C210
- CVE-2026-105814Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210TP-Link Systems Tapo C210
- CVE-2026-112403Pillow: Heap buffer overflow in ImagingJpegDecodepython-pillow Pillow · pillow
- CVE-2026-112402Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformpython-pillow Pillow · pillow
- CVE-2026-112397Pillow: Out-of-bounds access in _imagingmorph on a zero-width imagepython-pillow Pillow · pillow
- CVE-2026-112392Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagespython-pillow Pillow · pillow
- CVE-2026-112401Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()python-pillow Pillow · pillow
- CVE-2026-112358TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgeryTiBillet Lespass
- CVE-2026-112400Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSpython-pillow Pillow · pillow
- CVE-2026-112399Pillow: APNG background disposal allocates full canvas before decompression bomb checkpython-pillow Pillow · pillow
- CVE-2026-112398Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionpython-pillow Pillow · pillow
- CVE-2026-53995MLflow < 3.18.0 Path Traversal via Trace ID APImlflow
- CVE-2026-112396Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferpython-pillow Pillow · pillow
- CVE-2026-112302kiwilan php-archive Extraction ArchiveZip.php extract path traversalkiwilan php-archive
- CVE-2026-112395Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)python-pillow Pillow · pillow
- CVE-2026-111946Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag headerPlack-Middleware-ETag
- CVE-2026-112394Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizepython-pillow Pillow · pillow
- CVE-2026-112393Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOpython-pillow Pillow · pillow
- CVE-2026-112301orbitale imagemagick-php Command.php font os command injectionorbitale imagemagick-php
- CVE-2026-112391Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()python-pillow Pillow · pillow
- CVE-2026-76788Stack out-of-bounds write in the OSDP Control Panel reply parserzephyrproject zephyr
- CVE-2026-76787NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sumzephyrproject zephyr
- CVE-2026-112390Pillow: Infinite loop in MIC n_frames when the embedded TIFFpython-pillow Pillow · pillow
- CVE-2026-112300DiffSK configobj init.py _sectionmarker redosDiffSK configobj
- CVE-2026-112299smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgerysmrealms smr
- CVE-2026-111766markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledmarkdown-it
- CVE-2026-112297ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgeryptbsare anx-calibre-manager
- CVE-2026-71169Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerabilityDell Application Store
- CVE-2026-82166Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerabilityDell Application Store
- CVE-2026-71170Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerabilityDell Application Store