CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- GHSA-4MFG-R38W-W8FGmcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6mcp-sanitizer
- GHSA-7W82-6F9J-V9JPmcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Pathsmcp-sanitizer
- GHSA-473Q-M89C-GHF8MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificatMySqlConnector
- CVE-2026-61542Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP toolsdrhelius Gearboy
- CVE-2026-54162Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUIalexandre-daubois ember · github.com/alexandre-daubois/ember
- CVE-2026-61529Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)endatix
- CVE-2026-118653Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configurationlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBloblabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-115415Secret masking bypass in the environment tool in Strands Agents Toolsamazon strands-agents-tools
- CVE-2026-118651Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Defaultlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-63190FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSSfearlessgeekmedia FearlessCMS
- CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118266Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Methodlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-78674Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command ExecutionWSO2 Enterprise Integrator · WSO2 Business Process Server
- CVE-2026-6647Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle EventsWSO2 Identity Server · WSO2 Carbon OAuth
- CVE-2026-3583Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]WSO2 API Manager · WSO2 Traffic Manager +6
- CVE-2026-11854Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 ProductsWSO2 API Manager · WSO2 API Control Plane +1
- CVE-2025-14260Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External ResourcesWSO2 API Manager · WSO2 Identity Server as Key Manager +5
- CVE-2026-109411Samba: access control bypass via vfs_ceph_rgw case-insensitive openSamba · Red Hat Enterprise Linux +1
- CVE-2026-118265Echo: X-Real-IP extractor trusts the header value instead of the sending peerlabstack echo · github.com/labstack/echo/v5
- CVE-2026-118264Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlslabstack echo · github.com/labstack/echo/v4 +1
- CVE-2026-118263Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requestslabstack echo · github.com/labstack/echo/v5
- CVE-2026-118262Echo: WebSocket proxy can retain connections and handlers after client disconnectlabstack echo · github.com/labstack/echo/v4 +1
- CVE-2026-118688Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Renamebytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-118687Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authenticationcoder
- CVE-2026-118686EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regexespocrm
- CVE-2026-118685ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuardToolJet
- CVE-2026-118684MONAI before 1.6.1 Missing Integrity Verification via check_hash in DownloadsProject-MONAI MONAI
- CVE-2026-118683MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.confProject-MONAI MONAI
- CVE-2026-118681go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middlewarego-chi chi