CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119251A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop…Ubiquiti WiFiman Desktop for macOS
- CVE-2026-118773Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalisaacs node-glob · glob
- CVE-2026-119250A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in…Ubiquiti WiFiman Desktop
- CVE-2026-119249A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop…Ubiquiti WiFiman Desktop
- CVE-2026-41216An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6.vtk
- CVE-2026-42057An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6.vtk
- CVE-2026-8822A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1).vtk
- CVE-2026-8824A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1).vtk
- CVE-2026-9535A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1).vtk
- CVE-2026-9536A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1).vtk
- CVE-2026-118772joi: quadratic-time split in `string().email({ multiple: true })` allows denial of servicehapijs joi · @hapi joi +2
- CVE-2026-119168Nomad allocation data migration may allow host directory permission modification via symlink followingHashiCorp Nomad
- CVE-2026-107347Nomad dispatch payload writes can escape the allocation directory through symlinksHashiCorp Nomad
- CVE-2026-102260Nomad vulnerable to cross-namespace information disclosure in multiple endpointsHashiCorp Nomad
- CVE-2026-116566socket.getaddrinfo() accepts embedded null bytes in host and portPython Software Foundation CPython
- CVE-2026-118769Botan: Integer overflow when reporting block size in FFI can cause memory corruptionrandombit botan
- CVE-2026-118768Botan: CLI utility `ocsp_check` accepts unauthenticated responsesrandombit botan
- CVE-2026-118767Botan: Python binding bcrypt APIs truncate passwords containing embedded NULsrandombit botan
- CVE-2026-118766Botan: Online OCSP redirects enable blind requests to internal HTTP servicesrandombit botan
- CVE-2026-118765Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing staterandombit botan
- CVE-2026-118764minimatch: potential denial of service via globparts amplificationisaacs minimatch · minimatch
- CVE-2026-118763@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Locationsigstore-js · @sigstore/oci
- CVE-2026-118762Monkeytype: fork PR can execute code with elevated GITHUB_TOKENmonkeytypegame monkeytype
- CVE-2026-115805Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration PathRapid7 Insight Agent
- GHSA-VPP8-G58W-M8MPTwisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Resettwisted
- CVE-2026-11587Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0Centreon
- CVE-2023-7357FlexNet Publisher lmadmin Rogue Vendor Daemon VulnerabilityRevera FlexNet Publisher
- CVE-2026-118761Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memorykubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-119115Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetesaws-privateca-issuer
- GHSA-W9X9-J56R-H98R@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy@eeacms/volto-chatbot