CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-111551Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocationApache Software Foundation org.apache.kafka:kafka-streams ·…
- CVE-2026-111496Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuationApache Software Foundation org.apache.kafka:kafka-streams
- CVE-2026-111115Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsingApache Software Foundation org.apache.kafka:kafka
- CVE-2026-111108Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersApache Software Foundation org.apache.kafka:kafka
- CVE-2026-111073Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of…Apache Software Foundation org.apache.kafka:kafka
- CVE-2026-106079Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG…Juniper Networks Session Smart Router · Juniper Networks Se…
- CVE-2026-110985Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredApache Software Foundation org.apache.kafka:kafka
- CVE-2026-103411Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsingJuniper Networks Session Smart Router
- CVE-2026-110952Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by defaultApache Software Foundation org.apache.kafka:kafka
- CVE-2026-83525Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller…Apache Software Foundation org.apache.kafka:kafka-raft
- CVE-2026-103410Session Smart Router: Integer overflow causes denial of service during TLS certificate inspectionJuniper Networks Session Smart Router
- CVE-2026-103409Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessedJuniper Networks Session Smart Router
- CVE-2026-103408Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP optionsJuniper Networks Session Smart Router
- CVE-2026-103407Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI…Juniper Networks Session Smart Router · Juniper Networks Se…
- CVE-2026-103406Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.Juniper Networks Session Smart Conductor
- CVE-2026-103405Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splittingJuniper Networks Session Smart Router · Juniper Networks Se…
- CVE-2026-103404Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentialsJuniper Networks Session Smart Conductor
- CVE-2026-103403Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting…Juniper Networks Session Smart Router · Juniper Networks Se…
- CVE-2026-103402Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and…Juniper Networks Session Smart Router · Juniper Networks Se…
- CVE-2026-103401Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as rootJuniper Networks Session Smart Router · Juniper Networks Se…
- CVE-2026-103400Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanupJuniper Networks Session Smart Router · Juniper Networks Se…
- CVE-2026-103394Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.Juniper Networks Session Smart Router
- CVE-2026-103393Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processingJuniper Networks Session Smart Router
- CVE-2026-103392Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabledJuniper Networks Session Smart Router
- CVE-2026-93536X.Org Server GestureBuildSprite Use-After-Freex.org xorg-x11-server · x.org xwayland
- CVE-2026-103391Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy featureJuniper Networks Session Smart Router
- CVE-2026-103390Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identificationJuniper Networks Session Smart Router · Juniper Networks Se…
- CVE-2026-93524X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Readx.org xorg-x11-server · x.org xwayland
- CVE-2026-93523X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Writex.org xorg-x11-server · x.org xwayland
- CVE-2026-118510Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDsLaravel MongoDB