CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-117601Electrum before 4.8.3 Missing Signature Verification of Mempool Transactionsspesmilo electrum · electrum
- CVE-2026-117573hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Toolsmasc-ucsc hagent
- CVE-2026-117570nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilitiesVorota-ai nmap-mcp
- CVE-2026-117569Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parametersalishahid74 kali-gpt
- CVE-2026-117568mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDirbitscorp-mcp mcp-ffmpeg
- CVE-2026-117567esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parametershorw esp-mcp
- CVE-2026-117566EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.phpicret EasyImages2.0
- CVE-2026-117565Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title FetchArtalkJS Artalk
- CVE-2026-117564nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secretbuqiyuan nest-admin
- CVE-2026-117563MrDoc through 1.1.1 Broken Access Control via manage_doc_sharezmister2016 MrDoc
- CVE-2026-117562rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpointanyant rssant
- CVE-2026-117561sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Valuescodefriar sf-mcp
- CVE-2026-117560ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Toolsatxp gemini-cli-extension
- CVE-2026-117559DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypasshyperb1iss droidmind
- CVE-2026-117558ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_statusai-sdlc-framework ai-sdlc
- CVE-2026-117557SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loaderlibsdl-org SDL_image
- CVE-2026-117556zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()zchunk
- CVE-2026-117555GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()GreycLab CImg
- CVE-2026-117554Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.phpadmidio
- CVE-2026-117553Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header PoisoningUmbraco-CMS
- CVE-2026-92546Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic AllyKeepnet Labs Agentic AI / Agentic Ally
- CVE-2026-116627Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions…Devolutions PowerShell Universal
- CVE-2026-15586OTP Brute-Force Account Takeover in Idvlabs Software's Ontimeİdvlabs Software and Consulting Services Ontime
- CVE-2026-114409Docker Desktop logs can expose stored third-party credentialsDocker Desktop
- CVE-2026-107590Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts QtQt
- CVE-2026-47486NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write.NVIDIA PhysX
- CVE-2026-65145NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue.NVIDIA NeMo Agent Toolkit
- CVE-2026-65151NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue.NVIDIA NeMo Agent Toolkit
- CVE-2026-65120NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.NVIDIA TensorRT-LLM
- CVE-2026-24269NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.NVIDIA TensorRT-LLM