CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-95109Cortex-A7 module data validation checks only the first address of a caller-supplied rangeEclipse Foundation Eclipse ThreadX
- CVE-2026-94192Module object deallocation can free a live ThreadX kernel objectEclipse Foundation Eclipse ThreadX
- CVE-2026-112948Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token filevitest-dev vitest · @vitest browser +5
- CVE-2026-112823WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerabilityWP User Manager
- CVE-2026-112824WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerabilityMagepeople Bus Ticket Booking with Seat Reservation
- CVE-2026-92843Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX SecureEclipse Foundation Eclipse ThreadX - NetX Duo
- CVE-2026-111843WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityCozyThemes Rootblox
- CVE-2026-112829WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerabilityArraytics Booktics
- CVE-2026-112840WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force SureCart
- CVE-2026-111765A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixa2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-http-…
- CVE-2026-112947Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instancevitejs vite · vitejs vite-plus +2
- CVE-2026-112836WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerabilitye4jvikwp VikRentCar
- CVE-2026-92853Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX SecureEclipse Foundation Eclipse ThreadX - NetX Duo
- CVE-2026-94018NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow pathEclipse Foundation Eclipse ThreadX - NetX Duo
- CVE-2026-109700WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerabilityeLightUp Meta Box – WordPress Custom Fields Framework
- CVE-2026-111764A2A Java SDK has a fail-open default task authorizationa2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-serve…
- CVE-2026-93475Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509Eclipse Foundation Eclipse ThreadX - NetX Duo
- CVE-2026-112946Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machinevitejs vite · vitejs vite-plus +2
- CVE-2026-111763A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirecta2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-parent
- CVE-2026-91057Out-of-bounds read when a multi-line text view string ends with a carriage returnEclipse Foundation Eclipse ThreadX - GUIX
- CVE-2026-112945Vite: Cross origin script execution through Vite custom middlewarevitejs vite · vitejs vite-plus +2
- CVE-2026-92454JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decodeEclipse Foundation Eclipse ThreadX - GUIX
- CVE-2026-112944launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsvitejs launch-editor · vitejs vite +4
- CVE-2026-111762A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failurea2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-trans…
- CVE-2026-111761A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification deliverya2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-serve…
- CVE-2026-91059JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation sizeEclipse Foundation Eclipse ThreadX - GUIX
- CVE-2026-112834WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerabilityCastos Seriously Simple Podcasting
- CVE-2026-91189The GUIX binary resource loader never checks that a font page's glyph range is well formed. gx_page_header_first_glyph and gx_page_header_last_glyph are read verbatim from the file and only the…Eclipse Foundation Eclipse ThreadX - GUIX
- CVE-2026-112943launch-editor: escapeCmdArgs() omits % escaping on Windowsvitejs launch-editor · vitejs vite +4
- CVE-2026-112833WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerabilityCastos Seriously Simple Podcasting