CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-8355IBM ContextForge MCP Gateway is affected by server-side request forgeryIBM ContextForge MCP Gateway
- CVE-2026-112373H3C Magic NX15 usrlist sub_416874 stack-based overflowH3C Magic NX15
- CVE-2025-36061TS4500 Tape Library Denial of ServiceIBM Storage TS4500 Library
- CVE-2025-36069TS4500 Tape Library Insufficient Session ExpirationIBM Storage TS4500 Library
- CVE-2025-36252TS4500 Tape Library Insufficient Session ExpirationIBM Storage TS4500 Library
- CVE-2026-19178TS4500 Tape Library Race ConditionIBM Storage TS4500 Library
- CVE-2026-77684Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of servicezephyrproject zephyr
- CVE-2026-19595Zephyr RTIO syscall verifier validates output parameters for read instead of write accesszephyrproject zephyr
- CVE-2026-112372H3C Magic NX15 upload importprofile path traversalH3C Magic NX15
- CVE-2026-112371H3C Magic NX15 RPC esps write code injectionH3C Magic NX15
- CVE-2026-112991MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()misp-modules
- CVE-2026-112370H3C Magic NX15 usrlist sub_416874 os command injectionH3C Magic NX15
- CVE-2026-112901Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutespython-pillow Pillow · pillow
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCEpython-pillow Pillow · pillow
- CVE-2026-112898Pillow: Image.quantize() with empty palette leaks uninitialized stack memorypython-pillow Pillow · pillow
- CVE-2026-112897Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripspython-pillow Pillow · pillow
- CVE-2026-112896Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readpython-pillow Pillow · pillow
- CVE-2026-112895Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)python-pillow Pillow · pillow
- CVE-2026-112894Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)python-pillow Pillow · pillow
- CVE-2026-112893Pillow: Invalid free in FreeType glyph rendering when a stroker is activepython-pillow Pillow · pillow
- CVE-2026-112361Dolibarr CSP document.php protection mechanismDolibarr
- CVE-2026-112261Gimp: gimp: use-after-free in xcf loader via prop_selected_pathRed Hat Enterprise Linux
- CVE-2026-112258Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channelsRed Hat Enterprise Linux
- CVE-2026-112257Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)Red Hat Enterprise Linux
- CVE-2026-112892Pillow: MSP RLE decoder expands a tiny file into unbounded memorypython-pillow Pillow · pillow
- CVE-2026-112891Pillow: Quadratic GIF comment copying during savepython-pillow Pillow · pillow
- CVE-2026-112406Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cyclepython-pillow Pillow · pillow
- CVE-2026-112360Netis EAP930 CGI Endpoint debug return200 backdoorNetis EAP930
- CVE-2026-112405Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0python-pillow Pillow · pillow
- CVE-2026-112404Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelspython-pillow Pillow · pillow