CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-28854The issue was addressed with additional app bundle integrity checksApple macOS
- CVE-2026-28853The issue was addressed with improved checksApple macOS
- CVE-2026-28850An authorization issue was addressed with improved state managementApple macOS · Apple visionOS
- CVE-2026-105298Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypasshttps://github.com/cloudflare/pingora · pingora-core
- CVE-2026-77938Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritanceletta-ai letta
- CVE-2026-77937Letta through 0.16.8 Cross-Tenant Impersonation via user_id Headerletta-ai letta
- CVE-2026-77936Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Accessletta-ai letta
- CVE-2026-77935Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlerscoze-dev coze-studio
- CVE-2026-77934Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runnercoze-dev coze-studio
- CVE-2026-77933DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deploymenteosphoros-ai DB-GPT
- CVE-2026-77932DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agenteosphoros-ai DB-GPT
- CVE-2026-77930EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-AgentsEvoScientist
- CVE-2026-77926Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Toolapconw Aix-DB
- CVE-2026-75128Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpointchatchat-space Langchain-Chatchat
- CVE-2026-109444OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt InjectionTracer-Cloud opensre
- CVE-2026-109443JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shelljd-opensource JoySafeter
- CVE-2026-109442piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shellcas-bigdatalab piflow
- CVE-2026-109441LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridgeginlix-ai LangAlpha
- CVE-2026-109440LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCodeginlix-ai LangAlpha
- CVE-2026-109395Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoderning compress-lzf
- CVE-2026-105297Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limitshttps://github.com/cloudflare/pingora · pingora-core
- GO-2026-6651XTLS Xray Core man-in-the-middle attacks via certificate pinning flawgithub.com/xtls/xray-core
- CVE-2025-60475A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input
- CVE-2025-60494A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a…
- CVE-2025-60496A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a…
- CVE-2026-95168An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py
- CVE-2026-105453IBM Sterling Connect:Direct for Unix Improper Privilege ManagementIBM Sterling Connect Direct for Unix
- CVE-2026-107366Langflow OSS Authorization Bypass Through User-Controlled KeyIBM Langflow OSS
- CVE-2026-107400Security Vulnerability identified in IBM TRIRIGA - GWT Mock AuthenticationIBM TRIRIGA Application Platform
- CVE-2026-109126IBM Verify Identity Access and IBM Security Verify Access Hard-coded CredentialsIBM Verify Identity Access · IBM Security Verify Access