CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-113608Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_varjleyva moodle-block_configurablereports
- CVE-2026-113607Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_datajleyva moodle-block_configurablereports
- CVE-2026-113606Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing FoldersStirling-Tools Stirling-PDF
- CVE-2026-113605Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-databaseStirling-Tools Stirling-PDF
- CVE-2026-113604Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header CountsNationalSecurityAgency ghidra
- CVE-2026-113603x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resourcex402-foundation @x402/extensions · x402-foundation x402 +1
- CVE-2026-113602json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Characterjson-smart
- CVE-2026-113601Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivityusememos memos
- CVE-2026-113600Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroyfatfreecrm fat_free_crm
- CVE-2026-113599Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creationmodoboa
- CVE-2026-113598Modoboa before 2.8.0 IDOR via API v2 alarms bulk_deletemodoboa
- CVE-2026-113597Blinko through 1.8.8 IDOR via Tag tRPC Router Proceduresblinkospace blinko
- CVE-2026-113596Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIdswebstudio-is webstudio
- CVE-2026-113595Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Routesharkord
- CVE-2026-113594Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Routesharkord
- CVE-2026-113359Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values EndpointBaserow
- CVE-2025-71436Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Taglibrdf Raptor RDF Syntax Library
- CVE-2026-90799Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence valuesApache Software Foundation Apache CouchDB
- CVE-2026-90798Apache CouchDB: Replicator follows redirects indefinitelyApache Software Foundation Apache CouchDB
- CVE-2026-90797Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_sessionApache Software Foundation Apache CouchDB
- CVE-2026-86471Apache CouchDB: Admin credentials leading to code execution as operating system userApache Software Foundation Apache CouchDB
- CVE-2026-112951ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixapostrophecms apostrophe · apostrophe
- CVE-2026-93003NetX Duo Web HTTP server interprets request body content as HTTP header fieldsEclipse Foundation Eclipse ThreadX - NetX Duo
- CVE-2026-112950Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixvitest-dev vitest · @vitest mocker +1
- CVE-2026-95107Module object allocation size overflow corrupts the manager object poolEclipse Foundation Eclipse ThreadX
- CVE-2026-94202Module block-pool create validates two of the four parameter words it readsEclipse Foundation Eclipse ThreadX
- CVE-2026-95108Deleting a user-mode module thread leaks its privileged kernel stackEclipse Foundation Eclipse ThreadX
- CVE-2026-112949Vitest: Code injection via unauthenticated manual mock registrationvitest-dev vitest · @vitest mocker +1
- CVE-2026-94024Module Manager object lookup validates one byte of a module's search nameEclipse Foundation Eclipse ThreadX
- CVE-2026-94023Module delete dispatchers do not enforce kernel-object ownership before irreversible deletionEclipse Foundation Eclipse ThreadX