CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116728libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024libyal libfvde
- CVE-2026-116727gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.cmmitch gbsplay
- CVE-2026-116726gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Titlemmitch gbsplay
- CVE-2026-116725gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Indexmmitch gbsplay
- CVE-2026-116724FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflowfltk
- CVE-2026-116723FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Fieldfltk
- CVE-2026-116590snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWritexerial snappy-java · org.xerial.snappy:snappy-java
- CVE-2026-116514itsourcecode Airline Reservation System book_flight.php cross site scriptingitsourcecode Airline Reservation System
- CVE-2026-116508TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflowTOTOLINK A950RG
- CVE-2026-116589Datadog dd-trace-py: IAST instrumentation can lead to application DOSDataDog dd-trace-py · ddtrace
- CVE-2026-116588Datadog dd-trace-py: ReDOS in URL query string obfuscationDataDog dd-trace-py · ddtrace
- CVE-2026-116507TOTOLINK A950RG global.so getLanguageCfg information disclosureTOTOLINK A950RG
- CVE-2026-116587Go JOSE: DoS when parsing JWKs that contain RSA keysgo-jose · github.com/go-jose/go-jose/v4 +1
- CVE-2026-116586Go JOSE: Panics in JSON parsinggo-jose · github.com/go-jose/go-jose/v4 +1
- CVE-2026-116585Go JOSE: Panic during CBC-HMAC processinggo-jose · github.com/go-jose/go-jose/v4 +1
- CVE-2026-116506TOTOLINK A950RG firewall.so apmib_set command injectionTOTOLINK A950RG
- CVE-2026-116584Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthlxsmnsyc seroval · seroval
- CVE-2026-116583Seroval: Code injection through a typed array's own constructor propertylxsmnsyc seroval · seroval
- CVE-2026-116582Seroval: Script injection through RegExp sources in serialized outputlxsmnsyc seroval · seroval
- CVE-2026-116505TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injectionTOTOLINK A950RG
- CVE-2026-86925An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-84627A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-113945An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-65327A logic issue was addressed with improved checks.Apple macOS
- CVE-2026-112529An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-86972A buffer overflow was addressed with improved size validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-112483A path handling issue was addressed with improved validation.Apple macOS
- CVE-2026-113912An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-112495An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-86964A null pointer dereference was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3