CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-65629Weak PBKDF2 parameters for password-encrypted private-key export in josepotatosalad jose · jose
- CVE-2026-65628Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key typespotatosalad jose · jose
- CVE-2026-65627Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2potatosalad jose · jose
- CVE-2026-57184Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)asterisk · certified-asterisk
- CVE-2026-65626Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in josepotatosalad jose · jose
- CVE-2026-65625Attacker-controlled AES-GCM authentication tag length allows tag forgery in josepotatosalad jose · jose
- CVE-2026-70381Unauthorized Access to Internal Web ResourcesWolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cy… +2
- CVE-2026-57193Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)asterisk · certified-asterisk
- CVE-2026-70380Resource Exhaustion in MICE ServiceWolfVision Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap… +2
- CVE-2026-116479a2aproject a2a-java JSON-RPC Error getMessage information exposurea2aproject a2a-java
- CVE-2026-115533CVE-2026-115533Hugging Face LeRobot
- CVE-2026-115927Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunkstornadoweb tornado · tornado
- CVE-2026-57187Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processingasterisk · certified-asterisk
- CVE-2026-116478a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposurea2aproject a2a-go
- CVE-2026-57196Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pagesasterisk · certified-asterisk
- CVE-2026-115924Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphsdanielgatis rembg · rembg
- CVE-2026-116477a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposurea2aproject a2a-dotnet
- CVE-2014-125135OctoPrint Flask Secret Key hard-coded keyOctoPrint
- CVE-2026-116476a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race conditiona2aproject a2a-dotnet
- CVE-2026-110720Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rulesHashiCorp Tooling
- CVE-2026-116631External protocol handler (tel:) address bar spoofMozilla Firefox for iOS
- CVE-2026-116632Facetime protocol handler enabled spoofingMozilla Firefox for iOS
- CVE-2026-116471BKWLD Decoy Authorization Policy Policy.php privileges managementBKWLD Decoy
- CVE-2026-116467ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertionggml-org llama.cpp
- CVE-2026-115804Consul vulnerable to an authorization bypass in health check registrationHashiCorp Consul
- CVE-2026-116634OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokenscheaper-inference OmniRoute
- CVE-2026-50096BUG-000187164 - ArcGIS Server has a security vulnerability.Esri ArcGIS Server
- CVE-2026-50095BUG-000187165 - ArcGIS Server has a security vulnerability.Esri ArcGIS Server
- CVE-2026-33522BUG-000182936 - ArcGIS Server has a security vulnerability.Esri ArcGIS Server
- CVE-2026-33521BUG-000186514 - ArcGIS Server has a security vulnerability.Esri ArcGIS Server