CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116061SourceCodester Performance Indicator System edit_dealer.php sql injectionSourceCodester Performance Indicator System
- CVE-2026-115825HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-LengthPlack
- CVE-2026-115824Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodiesStarman
- CVE-2026-115823Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connectionsStarman
- CVE-2026-115822Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodiesStarman
- CVE-2026-115817Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headersStarman
- CVE-2026-116060SourceCodester Performance Indicator System adddealer.php sql injectionSourceCodester Performance Indicator System
- CVE-2026-116058Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injectionAlfresco Activiti
- CVE-2026-116057KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted uploadKodCloud KodExplorer
- CVE-2026-116056KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgeryKodCloud KodExplorer
- CVE-2026-116055SourceCodester Performance Indicator System deleteproduct.php sql injectionSourceCodester Performance Indicator System
- CVE-2026-116054SH3 Módulo de Gestão/Módulo de Arrecadação weak password hashSH3
- CVE-2026-116053dbcli mycli Whitelist source.py source_special_command_is_safe os command injectiondbcli mycli
- CVE-2026-116186OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetIdopenremote core
- CVE-2026-116185OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfosopenremote core
- CVE-2026-116184OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocketopenremote core
- CVE-2026-116211YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry createyeswiki
- CVE-2026-116208YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPostsyeswiki
- CVE-2026-116207YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search APIyeswiki
- CVE-2026-116206YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntaxyeswiki
- CVE-2026-116205YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntaxyeswiki
- CVE-2026-116204YesWiki before 4.7.0 CSRF via despam Admin Actionyeswiki
- CVE-2026-116203YesWiki before 4.7.0 Stored XSS via filtertags Action Parametersyeswiki
- CVE-2026-116202YesWiki before 4.7.0 Stored XSS via ImageField SVG Uploadyeswiki
- CVE-2026-116201Snipe-IT before 8.5.0 SAML Assertion Replay via Race Conditiongrokability snipe-it
- CVE-2026-116200Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()grokability snipe-it
- CVE-2026-116199Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callbackgrokability snipe-it
- CVE-2026-116198Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController storegrokability snipe-it
- CVE-2026-116197Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selectionedgelesssys contrast
- CVE-2026-116196Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-urlrclone