CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-82389Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereferencezephyrproject zephyr
- CVE-2026-82388Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic hostzephyrproject zephyr
- CVE-2026-19742IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret keyzephyrproject zephyr
- CVE-2026-81038Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responseszephyrproject zephyr
- CVE-2026-81039Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identityzephyrproject zephyr
- CVE-2026-116369Sunwood-ai-labs github-kanban-mcp-server issue-handlers.ts handleListIssues os command injectionSunwood-ai-labs github-kanban-mcp-server
- CVE-2026-116394WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerabilityMagepeople WpEvently
- CVE-2026-93846Team admin can escalate a team member's permissions via the team member roles endpointMattermost
- CVE-2026-112344Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail EscapeSyncplify Server!
- CVE-2026-112343Syncplify Server! < 8.8.0 Permission Override Bypass via Path CasingSyncplify Server!
- CVE-2026-115680Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data RetransmissionKeil MDK-Middleware
- CVE-2026-115679Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX BufferKeil MDK-Middleware
- CVE-2026-116368DeepSeek Harness Browser Auth browser-auth.ts improper authorizationDeepSeek Harness
- CVE-2026-115678Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processingKeil MDK-Middleware
- CVE-2026-112346OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCEOpenHands Software Agent SDK
- CVE-2026-116367DeepSeek Harness sandbox.ts createContextDeepSeek Harness
- CVE-2026-115748Apache Vysper: Authorization bypassApache Software Foundation Apache Vysper
- CVE-2026-115721Apache Vysper: Unbounded allocationApache Software Foundation Apache Vysper
- CVE-2026-116544Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_outputopen5gs
- CVE-2026-116543Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parseropen5gs
- CVE-2026-116542Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decodingnetty-tcnative · netty-tcnative-boringssl-static
- CVE-2026-116541netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcountnetty-tcnative · netty-tcnative-boringssl-static
- CVE-2026-116540netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callbacknetty-tcnative
- CVE-2026-116539Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIOnetty-tcnative · netty-tcnative-boringssl-static
- CVE-2026-116538HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributesmganss HtmlSanitizer
- CVE-2026-116489Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classestimescale pgvectorscale
- CVE-2026-85297Bucket Squatting in Cloud Run MCP leads to Service Account TakeoverGoogle Cloud Cloud Run MCP
- CVE-2026-99099x86/CPU/AMD: Fix AMD TLBI Erratum #1718Linux
- CVE-2026-99098dm-integrity: fix buffer overflow in inline mode with large tag sizeLinux
- CVE-2026-99097tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()Linux