CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-66090XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File ReadApereo Foundation openEQUELLA
- CVE-2026-66089XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity ExpansionApereo Foundation openEQUELLA
- CVE-2026-66088Unrestricted Command Execution via system.executeApereo Foundation openEQUELLA
- CVE-2026-16889Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application OriginApereo Foundation openEQUELLA
- CVE-2026-21157Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.Samsung Mobile Bixby
- CVE-2026-113957An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a…Apple container · Apple containerization
- CVE-2026-118590nipy nibabel Header volumeutils.py array_from_file memory allocationnipy nibabel
- CVE-2026-107014Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another…
- CVE-2026-107015Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note dat
- CVE-2026-107016Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.
- CVE-2026-107017Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily…
- CVE-2026-107018Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files…
- CVE-2026-107019Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to…
- CVE-2026-107020An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim user
- CVE-2026-107021Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized…
- CVE-2026-107023Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another…
- CVE-2026-107024Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's…
- CVE-2026-107025Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's…
- CVE-2026-107026Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's cl
- CVE-2026-107027Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component…
- CVE-2026-107028Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component…
- CVE-2026-107029Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data…
- CVE-2026-107030Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard…
- CVE-2026-107032Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, l
- CVE-2026-107033Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to…
- CVE-2026-107034Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note…
- CVE-2026-107035Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers…
- CVE-2026-107036Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component…
- CVE-2026-107037Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in ano
- CVE-2026-107038Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component…