CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119203pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer searchpy-pdf pypdf · pypdf
- CVE-2026-119202@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of servicehapijs content · @hapi/content +1
- CVE-2026-119201Nuxt dev server exposes generated appSecret through Vite file servingnuxt · @nuxt/vite-builder
- CVE-2026-119200Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesnuxt · @nuxt nitro-server +1
- CVE-2026-119199Nuxt dev server exposes private runtime config through the Nitro dev bundlenuxt · @nuxt/vite-builder
- CVE-2026-119198Nuxt dev server arbitrary file read through client error reportsnuxt · @nuxt/vite-builder
- CVE-2026-92092Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verificationRed Hat OpenShift Container Platform
- CVE-2026-119197pyasn1: Quadratic-complexity denial of service in binary REAL decodingpyasn1
- CVE-2026-119196pyasn1: Quadratic CPU consumption in constructed BIT STRING decodingpyasn1
- CVE-2026-119195pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decodingpyasn1
- CVE-2026-119194pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decodingpyasn1
- CVE-2026-119193PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handlingsebastianbergmann phpunit · phpunit/phpunit
- CVE-2026-119191Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDerdigitalbazaar forge · node-forge
- CVE-2026-119190Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13digitalbazaar forge · node-forge
- CVE-2026-119189Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsagedigitalbazaar forge · node-forge
- CVE-2026-119188Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messagedigitalbazaar forge · node-forge
- CVE-2026-119187Forge: Denial of service in TLS record processing via call stack exhaustiondigitalbazaar forge · node-forge
- CVE-2026-119186Forge: AES-GCM authentication bypass via unvalidated tagLength optiondigitalbazaar forge · node-forge
- CVE-2026-103093Sandbox Escape via Table Rotation in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2026-118782Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countdigitalbazaar forge · node-forge
- CVE-2026-6877Domain Separation Bypass in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2026-118781Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)digitalbazaar forge · node-forge
- CVE-2026-118780Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storedigitalbazaar forge · node-forge
- CVE-2026-118779Forge: Regular expression denial of service in PEM decoding (pem.decode)digitalbazaar forge · node-forge
- CVE-2026-118778Forge: TLS client crash when the server sends no certificatedigitalbazaar forge · node-forge
- CVE-2026-118777Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookiedigitalbazaar forge · node-forge
- CVE-2026-103094Cleartext Storage of OAuth Credentials in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2026-118776Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryptiondigitalbazaar forge · node-forge
- CVE-2026-118775Forge: ASN.1 OID first arc truncation in asn1.oidToDerdigitalbazaar forge · node-forge
- CVE-2026-118774Forge: Certificate signature verified with the issuer's RSA signature schemedigitalbazaar forge · node-forge