CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-92446GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loaderEclipse Foundation Eclipse ThreadX - GUIX
- CVE-2026-92449Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arenaEclipse Foundation Eclipse ThreadX - GUIX
- CVE-2026-112942launch-editor: fs.existsSync() existence check can be bypassed on Windowsvitejs launch-editor · vitejs vite +4
- CVE-2026-91186PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds writeEclipse Foundation Eclipse ThreadX - GUIX
- CVE-2026-113466MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded keyMinIO
- CVE-2026-112941filelock is a platform-independent file lock for Pythontox-dev filelock · filelock
- CVE-2026-112940filelock is a platform-independent file lock for Pythontox-dev filelock · filelock
- CVE-2026-92162Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstreamflatpak
- CVE-2026-112939filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markertox-dev filelock · filelock
- CVE-2026-112937filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock- link directory nametox-dev filelock · filelock
- CVE-2026-95111Module queue front-send validates a word count as a byte countEclipse Foundation Eclipse ThreadX
- CVE-2026-112936filelock symlink following in ReadWriteLock splits mutual exclusiontox-dev filelock · filelock
- CVE-2026-112935filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holderstox-dev filelock · filelock
- CVE-2026-96402USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle countEclipse Foundation Eclipse ThreadX - USBX
- CVE-2026-112934filelock is a platform-independent file lock for Pythontox-dev filelock · filelock
- CVE-2026-113411Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url schemeNerimity Desktop
- CVE-2026-112915filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeouttox-dev filelock · filelock
- CVE-2026-112914filelock is a platform-independent file lock for Pythontox-dev filelock · filelock
- CVE-2026-112912filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takertox-dev filelock · filelock
- CVE-2026-112911filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusiontox-dev filelock · filelock
- CVE-2026-112909filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathtox-dev filelock · filelock
- CVE-2026-113397DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injectionDrayTek Vigor2960
- CVE-2026-112906filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reusetox-dev filelock · filelock
- CVE-2026-97400In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file…Eclipse Foundation Eclipse OpenJ9
- CVE-2026-113396DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injectionDrayTek Vigor2960
- CVE-2026-103119Apache Tomcat: AJP response mix-upApache Software Foundation Apache Tomcat
- CVE-2026-101356Apache Tomcat: HTTP/2 request/response mix-up after error during async processingApache Software Foundation Apache Tomcat
- CVE-2026-101296Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanismsApache Software Foundation Apache Tomcat
- CVE-2026-113395DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversalDrayTek Vigor2960
- CVE-2026-93446Apache Tomcat: Possible TLS 1.3 connection failuresApache Software Foundation Apache Tomcat