CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116101itsourcecode Online Cake Ordering System deletetransac.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2026-116100gougucms User Level Level.php add cross site scriptinggougucms
- CVE-2026-104591libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c.
- CVE-2026-104592libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c.
- CVE-2026-104593osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c.
- CVE-2026-104594libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c.
- CVE-2026-104596libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c.
- CVE-2026-104597libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c.
- CVE-2026-104598libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c.
- CVE-2026-106676qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart…
- CVE-2026-106677Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl.
- CVE-2026-106781An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate…
- CVE-2026-107080OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in…
- CVE-2026-107090An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego…
- CVE-2026-107091An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver i
- CVE-2026-107092NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
- CVE-2026-116638The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including…
- CVE-2026-31158SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Lo
- CVE-2026-36698Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in…
- CVE-2026-116099Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds writeFusion Creators Studio SCP Containment Breach Multiplayer
- CVE-2026-116098SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserializationSteelRaven7 Ravenfield
- CVE-2026-116097CloudClassroom-PHP-Project addnewstudent.php cross site scriptingCloudClassroom-PHP-Project
- CVE-2026-116096ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds writeggml-org llama.cpp
- CVE-2026-116095smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocationsmg-project smg
- CVE-2026-116094EyouCMS function.php remote_file_to_local server-side request forgeryEyouCMS
- CVE-2026-115627AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rowsash-project ash_postgres · ash_postgres
- CVE-2026-115635AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is setash-project ash_postgres · ash_postgres
- CVE-2026-114214Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination recordsash-project ash · ash
- CVE-2026-116063DedeCMS update_guide.php require_once code injectionDedeCMS
- CVE-2026-116062SourceCodester Performance Indicator System save_profile.php sql injectionSourceCodester Performance Indicator System