CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-65119NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause…NVIDIA TensorRT-LLM
- CVE-2026-100164User Enumeration in Rolantis Information Technologies' AgentisRolantis Information Technologies Tourism Industry and Trad…
- RUSTSEC-2026-0486xattr functions mark unwritten bytes as initialized when given a zero-length bufferrustix
- CVE-2026-106087TRO600 contains an arbitrary file read vulnerability.Hitachi Energy TRO600 Series Firmware
- CVE-2026-10756TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended…Hitachi Energy TRO600 Series Firmware
- CVE-2026-115408ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secretsEclipse Foundation Eclipse KeyPont
- CVE-2026-13162An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system…Hitachi Energy CoreTec
- CVE-2026-113644iofogctl command injection via Controller provisioning responseEclipse Foundation Eclipse ioFog
- CVE-2026-90728Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reDell PowerProtect Data Domain
- CVE-2026-105323Reflected XSS in Kulga Software's Kulga News SoftwareKulga Software and Telecommunications Limited Company Kulga…
- CVE-2026-90729Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reDell PowerProtect Data Domain
- CVE-2026-115216Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentialsEclipse Foundation Eclipse ioFog
- CVE-2026-41022Eaton easySoft improperly validates TLS certificates presented by easyE4 devices.Eaton easySoft
- CVE-2026-10752Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Fieldhwk-fr Advanced Custom Fields: Extended
- CVE-2026-109995Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Contentwplakeorg Advanced Views – Display Framework – Gutenberg/El…
- CVE-2026-90730Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reDell PowerProtect Data Domain
- CVE-2026-112362@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets@fastify/express
- CVE-2026-90731Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 reDell PowerProtect Data Domain
- CVE-2026-41021Eaton easyE4 uses an insufficiently strong password policy.Eaton easyE4
- CVE-2026-90732Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS20Dell PowerProtect Data Domain
- CVE-2026-117499@fastify/session vulnerable to session revocation bypass via a logout race condition@fastify/session
- CVE-2026-56084Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025…Dell PowerProtect Data Domain
- CVE-2026-102800Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0dj-extensions.com DJ-HelpfulArticles extension for Joomla
- CVE-2026-41020Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured…Eaton easyE4
- CVE-2026-4337Unrestricted Upload of File in PuMuKIT applicationPuMuKIT
- CVE-2026-117541svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()darylldoyle svg-sanitizer
- CVE-2026-117540svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loopdarylldoyle svg-sanitizer
- CVE-2026-117539darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypassdarylldoyle svg-sanitizer
- CVE-2026-117538REDAXO before 5.21.0 Reflected XSS via Packages API function Parameterredaxo core · redaxo/source
- CVE-2026-117537REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameterredaxo core · redaxo/source