CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116195Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trimrclone
- CVE-2026-116194Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callbackrclone
- CVE-2026-116193Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requestsrclone
- CVE-2026-116192rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote rootsrclone
- CVE-2026-116191Rclone before 1.75.2 Path Traversal via serve webdav MKCOLrclone
- CVE-2026-116190rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirectrclone
- CVE-2026-116189rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMSrclone
- CVE-2026-116188rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflowrclone
- CVE-2026-116187Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploadsrclone
- CVE-2026-116183phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionIDthorsten phpMyFAQ
- CVE-2026-116182phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetchingthorsten phpMyFAQ
- CVE-2026-116181vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_idsvllm-project vllm
- CVE-2026-116180vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensorsvllm-project vllm
- CVE-2026-116179vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Overridevllm-project vllm
- CVE-2026-116178vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholdersvllm-project vllm · vllm
- CVE-2026-116177vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypassvllm-project vllm · vllm
- CVE-2026-116176vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnectorvllm-project vllm · vllm
- CVE-2026-116175vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completionsvllm-project vllm
- CVE-2026-116174vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generatevllm-project vllm
- CVE-2026-116173vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_idsvllm-project vllm · vllm
- CVE-2026-116172vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_nvllm-project vllm
- CVE-2026-116171SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefixsiyuan-note siyuan
- CVE-2026-116170SiYuan before v3.8.7 SQL Injection via History Search op and querysiyuan-note siyuan
- CVE-2026-116169SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blockssiyuan-note siyuan
- CVE-2026-116168SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Toolsiyuan-note siyuan
- CVE-2026-116167SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parametersiyuan-note siyuan
- CVE-2026-116166SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Settingsiyuan-note siyuan
- CVE-2026-116165Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDBparse-community parse-server
- CVE-2026-116164Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writesparse-community parse-server · parse
- CVE-2026-116163Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclassesparse-community parse-server