CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-72755Routinator stores TA certificate in cache without validationNLnet Labs Routinator
- CVE-2026-72754Routinator exits when parsing an incorrect or very large CRL fileNLnet Labs Routinator
- CVE-2026-72753Routinator incorrectly handles delta updatesNLnet Labs Routinator
- CVE-2026-72752Routinator exits when requesting the output repeatedlyNLnet Labs Routinator
- CVE-2026-116384Bdtask Garage 24 Garage Management Software Backend improper authorizationBdtask Garage 24 Garage Management Software
- CVE-2026-115913vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM enginevllm-project vllm · vllm
- CVE-2026-115912vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabledvllm-project vllm · vllm
- CVE-2026-116612A flaw was found in GStreamer Editing Services (gst-editing-services).GStreamer project gst-editing-services
- CVE-2026-115911vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread poolvllm-project vllm · vllm
- CVE-2026-116395WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins LightBox Block
- CVE-2013-10077OctoPrint API Key settings.py getSettings information disclosureOctoPrint
- CVE-2026-115598WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2026-115910Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the…python-social-auth social-core · social-auth-core
- CVE-2026-114710WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityWP Chill Gallery PhotoBlocks
- CVE-2026-115597WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2026-116388WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerabilityTMS Amelia
- CVE-2026-116396WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerabilityTMS Amelia
- CVE-2026-115418SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK)…aws-cdk/aws-redshift-alpha
- CVE-2026-115909zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extractionzip-rs zip2 · zip
- CVE-2026-116403WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerabilityAwesomemotive Easy Digital Downloads
- CVE-2026-115908zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)zip-rs zip2 · zip
- CVE-2026-115907zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizezip-rs zip2 · zip
- CVE-2026-115906zip: AES Entry HMAC Authentication Bypass on Premature EOFzip-rs zip2 · zip
- CVE-2026-116371Akuvox Akubela HyPanel PS51 login improper authenticationAkuvox Akubela HyPanel PS51
- CVE-2026-115905zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File…zip-rs zip2 · zip
- CVE-2026-71456Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.Johnson Controls Kantech Entrapass
- CVE-2026-71455Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded…Johnson Controls Kantech Entrapass
- CVE-2026-116596CVE-2026-116596Pyrus Sync
- CVE-2026-1163702K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion2K Games Sid Meier's Civilization VI
- CVE-2026-82390Cross-session AES key confusion in the Espressif ESP32 hardware crypto driverzephyrproject zephyr