CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-118760Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact readskubeflow pipelines
- GHSA-C33X-VCV4-VG3GCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergencecedar-policy · @cedar-policy/cedar-wasm
- CVE-2026-118759Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenantkubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2025-12523Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information…Centreon
- CVE-2026-62374SD JWT JS: Tampered disclosures silently dropped instead of rejectedopenwallet-foundation @sd-jwt/core · openwallet-foundati… +2
- CVE-2026-118758Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact sourcekubeflow pipelines
- CVE-2026-118673KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responseskeepassxreboot keepassxc
- CVE-2025-13050Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin usersCentreon
- CVE-2026-119145Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Uploadfrappe
- CVE-2026-119144Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fieldsfrappe
- CVE-2026-119143Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writesbytecodealliance wasmtime · wasmtime
- CVE-2026-119142Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Dropbytecodealliance wasmtime · wasmtime
- CVE-2026-119141Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via reallocbytecodealliance wasmtime
- CVE-2026-119140Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yieldbytecodealliance wasmtime · wasmtime
- CVE-2026-119139Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::callbytecodealliance wasmtime · wasmtime
- CVE-2026-119138Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trapbytecodealliance wasmtime · wasmtime
- CVE-2026-119137Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registrybytecodealliance wasmtime · wasmtime
- CVE-2026-119136Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypassbytecodealliance wasmtime · wasmtime
- CVE-2026-119135Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatchbytecodealliance wasmtime · wasmtime
- CVE-2026-119134Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handlesbytecodealliance wasmtime
- CVE-2026-119133Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tagsbytecodealliance wasmtime
- CVE-2026-119132Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapterbytecodealliance wasmtime · wasmtime
- CVE-2026-119131Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-httpbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-119130Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smugglingbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-119129ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approvalzitadel
- CVE-2026-119128ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookiezitadel
- CVE-2026-119127ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injectionzitadel
- CVE-2026-119126Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keysparse-community parse-server
- CVE-2026-119125Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fieldsparse-community parse-server
- CVE-2026-119124ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph OptionImageMagick