CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-118589nschloe meshio VTK Reader _vtk_42.py memory allocationnschloe meshio
- CVE-2026-118586dfm feedfinder2 feedfinder2.py find_feeds server-side request forgerydfm feedfinder2
- CVE-2026-118585configuroweb inventariobasico Add Product addlist.php cross site scriptingconfiguroweb inventariobasico
- CVE-2026-86983A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its…Apple swift-crypto
- CVE-2026-118579D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoorD-Link DIR-505
- CVE-2026-118578maotoumao MusicFreeDesktop Request Forwarder information disclosuremaotoumao MusicFreeDesktop
- CVE-2026-82411Objects API: Cross-object-type authorization bypass on the object history-detail endpointmaykinmedia open-object
- CVE-2026-85749MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mailMailWatch
- CVE-2026-55561InvoicePlane: Guest user IDOR in quote approval and rejectionInvoicePlane
- CVE-2026-75520Domoticz: Missing authorization and path traversal in the udevices Lua parser handlerdomoticz
- CVE-2026-118577maotoumao MusicFreeDesktop Request Forwarder server-side request forgerymaotoumao MusicFreeDesktop
- CVE-2026-118538a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributesa2ui-project a2ui
- CVE-2026-61575AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titlesWWBN AVideo-Encoder
- CVE-2026-61569AVideo-Encoder: pre-authentication streamer-login SQL injectionWWBN AVideo-Encoder
- CVE-2026-54453OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)OpenCATS
- CVE-2026-61571AVideo-Encoder: missing authentication on control and status endpointsWWBN AVideo-Encoder
- CVE-2026-116641The DB Tools trust certificates issued by recoverable eMudhra intermediate CAsMongoDB Database Tools
- CVE-2026-61572AVideo-Encoder: unauthenticated full-response server-side request forgeryWWBN AVideo-Encoder
- CVE-2026-61573AVideo-Encoder: reflected cross-site scripting in the login interfaceWWBN AVideo-Encoder
- CVE-2026-118537a2ui Image Player/Video Player/Audio Player Image.js input validationa2ui
- CVE-2026-54455OpenCATS: Authenticated SQL injection in activity DataGrid date filtersOpenCATS
- CVE-2026-61567AVideo-Encoder: unauthenticated command execution through streamer login trustWWBN AVideo-Encoder
- CVE-2026-61564AVideo-Encoder: unauthenticated installer PHP code injectionWWBN AVideo-Encoder
- CVE-2026-57448Blombooru: administrator image-proxy server-side request forgerymrblomblo blombooru
- CVE-2026-93851Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted postMattermost
- CVE-2026-61546AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP toolsankimcp anki-mcp-server-addon
- CVE-2026-118804Bricks Broken Access Control via query_result EndpointBricks Builder
- CVE-2026-118803Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_resultBricks Theme
- CVE-2026-118757PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_feesPI Websolution PiWeb Disable payment method / Partial payme…
- CVE-2026-118756gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDirgopasspw gopass