CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-33520BUG-000185167 - ArcGIS Server has a security vulnerability.Esri ArcGIS Server
- CVE-2026-10757BUG-000187511 - ArcGIS Server has a security vulnerability.Esri ArcGIS Server
- CVE-2026-105626Consul vulnerable to a denial of service in HTTP APIsHashiCorp Consul
- CVE-2026-116463FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-boundsFastStone Image Viewer
- CVE-2026-115923Backstage catalog rules can be bypassed for URL locations using encoded path segmentsbackstage · @backstage/plugin-catalog-backend
- CVE-2026-105608Consul vulnerable to an authorization bypass in service mesh registrationHashiCorp Consul
- CVE-2026-70379Unauthorized Access to vSolution Matrix RTSPWolfVision Cynap Pro, Cynap Core Pro
- CVE-2026-116461Omega Solution Restro POS sale-invoice logic errorOmega Solution Restro POS
- CVE-2026-105765Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate APIHashiCorp Consul
- CVE-2026-115922ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIsonnx
- CVE-2026-116408WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityWP Chill Gallery PhotoBlocks
- CVE-2026-111404WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerabilityVillaTheme Photo Reviews for WooCommerce
- CVE-2026-115921ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attributeonnx
- CVE-2026-112839WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerabilityVillaTheme Customer Coupons for WooCommerce
- CVE-2026-115966WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins Typing Text – Give your texts many typing effects
- CVE-2026-116400WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilitybPlugins Button Block
- CVE-2026-116398WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins Content Slider Block
- CVE-2026-115920ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rankonnx
- CVE-2026-115919ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)onnx
- CVE-2026-115918vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargsvllm-project vllm · vllm
- CVE-2026-115917vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP servervllm-project vllm · vllm
- CVE-2026-81509nforwardauth: Unvalidated r parameter allows post-authentication open redirectnosduco nforwardauth
- CVE-2026-115916vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)vllm-project vllm · vllm
- CVE-2026-115915vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCEvllm-project vllm · vllm
- CVE-2026-116385Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scriptingBdtask Garage 24 Garage Management Software
- CVE-2026-102649Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unsetpadok-team burrito
- CVE-2026-115914vLLM DeepSeek-OCR image processing vulnerable to denial of servicevllm-project vllm · vllm
- CVE-2026-72758Routinator may exit on malformed rangesNLnet Labs Routinator
- CVE-2026-72757Routinator HTTP server becomes unavailable with many unclosed connectionsNLnet Labs Routinator
- CVE-2026-72756Routinator exits on malformed rsync URIsNLnet Labs Routinator