CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119286GraphQL-core: Denial of service via memory leak in aborted validationsgraphql-python graphql-core · graphql-core
- CVE-2026-115943Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmtSpreadsheet-XLSX
- CVE-2026-119285Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsgofiber fiber · github.com/gofiber/fiber/v2
- CVE-2026-119284joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionauthlib joserfc · joserfc
- CVE-2026-61719WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" FieldLabRedesCefetRJ WeGIA
- CVE-2026-61707SOCFortress CoPilot: Stored case-report template injection permits backend code executionsocfortress CoPilot
- CVE-2026-61673WeGIA: Stored DOM XSS in listar_despachos.php Allows Account TakeoverLabRedesCefetRJ WeGIA
- CVE-2026-61671WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle ClassesLabRedesCefetRJ WeGIA
- CVE-2026-61654Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API keylightdash
- CVE-2026-61645Docat has Arbitrary File Upload exists in Upload APIdocat-org docat
- CVE-2026-45049OpenAM Session Hijacking via CDSSOOpenIdentityPlatform OpenAM · org.openidentityplatform.open…
- CVE-2026-119317Incorrect AuthorizationTenable Plugin Feed
- CVE-2026-119283joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryptionauthlib joserfc · joserfc
- CVE-2026-119282Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradlenrwl nx · @nx maven +3
- CVE-2026-13303Boundary vulnerable to server-side request forgery in Vault credential storeHashiCorp Boundary
- CVE-2026-61576Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API keylightdash
- CVE-2026-119281MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingmariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…
- CVE-2026-119280MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengthsmariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…
- CVE-2026-119279MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsmariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…
- CVE-2026-119278MariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authenticationmariadb-corporation mariadb-connector-j
- CVE-2026-119277MariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengthsmariadb-corporation mariadb-connector-j
- CVE-2026-119276MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsmariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…
- CVE-2026-119210MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server…mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…
- CVE-2026-119209pypdf: Possible large memory usage when parsing cross-reference streamspy-pdf pypdf · pypdf
- CVE-2026-119208pypdf: Possible long runtimes/large memory usage for encrypted PDF filespy-pdf pypdf · pypdf
- CVE-2026-119207pypdf: Possible large memory usage for exceptions in strict modepy-pdf pypdf · pypdf
- CVE-2026-119206pypdf: Possible long runtimes when retrieving page labelspy-pdf pypdf · pypdf
- CVE-2026-119205pypdf: Possible infinite loop when cloning dictionariespy-pdf pypdf · pypdf
- CVE-2026-119325Bricks Theme Broken Access Control via load_popup_contentBricks Theme
- CVE-2026-119204pypdf: Possible large memory usage when parsing page treepy-pdf pypdf · pypdf