CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-50571WebSub: Reflected script execution through intent-verification challengesw3c websub
- CVE-2026-59158Nuxt Ollama: public runtime configuration discloses the configured cloud API keythoda-dev nuxt-ollama · nuxt-ollama
- CVE-2026-58257GRR vulnerable to Arbitrary File Read and DeletionJeromeDevome GRR
- CVE-2026-58256GRR vulnerable to Remote Code Execution Via PHP Code InjectionJeromeDevome GRR
- CVE-2026-58255Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401jhuckaby Cronicle
- CVE-2026-58205GRR has a Reflected XSS issueJeromeDevome GRR
- CVE-2026-22063CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp ProductsNetApp ONTAP · NetApp StorageGRID +1
- CVE-2026-58496ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory APIthorvg
- CVE-2026-118128a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race conditiona2aproject a2a-js
- CVE-2026-57199Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffersasterisk · certified-asterisk
- CVE-2026-57203Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper locationasterisk · certified-asterisk
- CVE-2026-57190Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Fieldasterisk · certified-asterisk
- CVE-2026-97045Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/netgolang.org/x/net/html · golang.org/x/net
- CVE-2026-78661Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/netgolang.org/x/net/html · golang.org/x/net
- CVE-2026-62765Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-57191Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsingasterisk · certified-asterisk
- CVE-2026-57192Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatchasterisk · certified-asterisk
- CVE-2026-57186Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parserasterisk · certified-asterisk
- CVE-2026-57200Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCEasterisk · certified-asterisk
- CVE-2026-57195Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authenticationasterisk · certified-asterisk
- CVE-2026-85898Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-83831Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-116775pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)Eugeny russh · pageant
- CVE-2026-116774russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)Eugeny russh · russh
- CVE-2026-116773russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsEugeny russh · russh
- CVE-2026-116696russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesEugeny russh · russh
- CVE-2026-116695Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassrgrove crass · crass
- CVE-2026-116694OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagationopen-telemetry opentelemetry-python · opentelemetry-propaga…
- CVE-2026-116693dd-trace: ReDOS in URL query string obfuscationDataDog dd-trace-js · dd-trace
- CVE-2026-116692MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact…mlflow