CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-118249Highcharts: series column construction writes to Object.prototypehighcharts
- CVE-2026-118248Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototypehighcharts · @highcharts dashboards
- CVE-2026-118247Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `proto` as an existing column.highcharts · @highcharts dashboards +3
- CVE-2026-118246Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributeshighcharts
- CVE-2026-118245Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespacehighcharts · @highcharts dashboards +1
- CVE-2026-118244Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during printhighcharts
- CVE-2026-116273MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustionMIME-tools
- CVE-2026-116272MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested commentMIME-tools
- CVE-2026-116271MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users…MIME-tools
- CVE-2026-116270MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewordsMIME-tools
- CVE-2026-118243Highcharts Dashboards: `proto` data table id writes sync listeners to `Object.prototype`highcharts · @highcharts/dashboards
- CVE-2026-116269MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended…MIME-tools
- CVE-2026-116268MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parametersMIME-tools
- CVE-2026-116267MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested messageMIME-tools
- CVE-2026-116266MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguousMIME-tools
- CVE-2026-116265MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuationsMIME-tools
- CVE-2026-110183PostgreSQL Anonymizer: statistics can expose some of the original data after statistic maskingDALIBO PostgreSQL Anonymizer
- CVE-2026-110182PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole dataDALIBO PostgreSQL Anonymizer
- CVE-2026-110181PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized dataDALIBO PostgreSQL Anonymizer
- CVE-2026-116264MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including…MIME-tools
- CVE-2026-105620PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-queryDALIBO PostgreSQL Anonymizer
- CVE-2026-105619PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker viewsDALIBO PostgreSQL Anonymizer
- CVE-2026-105618PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parentDALIBO PostgreSQL Anonymizer
- CVE-2026-105617PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking ruleDALIBO PostgreSQL Anonymizer
- CVE-2026-105616PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_settingDALIBO PostgreSQL Anonymizer
- CVE-2026-105615PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_statsDALIBO PostgreSQL Anonymizer
- CVE-2026-105614PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()DALIBO PostgreSQL Anonymizer
- CVE-2026-105613PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functionsDALIBO PostgreSQL Anonymizer
- CVE-2026-105612PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked rolesDALIBO PostgreSQL Anonymizer
- CVE-2026-118242Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`highcharts · @highcharts grid-lite +3