CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-118755Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder PathVolmarg personal-management-system
- CVE-2026-118754Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.phpDolibarr ERP/CRM
- CVE-2026-118753FreeImage through 3.18.0 and danoli3 fork before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositingdanoli3 FreeImage · FreeImage
- CVE-2026-118752FreeImage through 3.18.0 and danoli3 fork before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoderdanoli3 FreeImage · FreeImage
- CVE-2026-118694python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinationstrentm python-markdown2
- CVE-2026-118693CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Pathgiuspen cherrytree
- CVE-2026-118692CherryTree through 1.7.2 OS Command Injection via Custom Web Link Actiongiuspen cherrytree
- CVE-2026-118691xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-messageGuDong2003 xianyu-auto-reply-fix
- CVE-2026-118690Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogssignalk-server
- CVE-2026-118689OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_lengthOvenMediaLabs OvenMediaEngine
- CVE-2026-118682ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITMKaringX clashmi
- CVE-2026-118669OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientoauthlib
- CVE-2026-118668LangGraph JavaScript custom authentication may permit cross-user Store accesslangchain-ai langgraph-api · langgraph-api
- CVE-2026-118667LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestslangchain-ai langgraph · langchain-ai langgraph-sdk +2
- CVE-2026-118666GraphQL Tools: Shared legacy executor routes one subscription's results to a different callerardatan graphql-tools · @graphql-tools executor-legacy-ws +1
- CVE-2026-118665GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsardatan graphql-tools · @graphql-tools executor-legacy-ws +1
- CVE-2026-118664decode-uri-component: Denial of service via quadratic replacement of percent-encoded runsSamVerschueren decode-uri-component · decode-uri-component
- CVE-2026-118663@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathshonojs node-server · @hono/node-server
- CVE-2026-118662Vite: `server.fs.deny` bypassed with queriesvitejs vite · vite
- CVE-2026-118661Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiescapricorn86 happy-dom · happy-dom
- CVE-2026-118660Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLcapricorn86 happy-dom · happy-dom
- CVE-2026-118659@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxycapricorn86 happy-dom
- CVE-2026-118658Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Protolabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118657Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headerslabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-118656Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURIlabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-76418Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of…Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2026-118655Echo: Static Middleware Double-Unescape Path Traversallabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-117574Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no…Red Hat OpenShift AI
- CVE-2026-118654Echo static file middleware route protection bypass via encoded dot-dot traversallabstack echo · github.com/labstack/echo/v5 +1
- CVE-2026-13451Kserve: kserve: server-side request forgery via malicious storageuriRed Hat OpenShift AI