CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-28329SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)SolarWinds Observability Self-Hosted
- CVE-2026-113651ApostropheCMS: Path traversal in uploadfsapostrophecms apostrophe · apostrophecms uploadfs +1
- CVE-2026-113650ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)apostrophecms apostrophe · apostrophecms sanitize-html +1
- CVE-2026-28328SolarWinds Observability Self-Hosted broken authorization schemaSolarWinds Observability Self-Hosted
- CVE-2026-113505aaPanel Download Endpoint v2.py send_file path traversalaaPanel
- CVE-2026-28331SolarWinds Patch Manager Sensitive Information Exposure VulnerabilitySolarWinds Patch Manager
- CVE-2026-113648ApostropheCMS: Missing Authentication in `cleanExport` Routeapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-112958ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serializationapostrophecms apostrophe · apostrophe
- CVE-2026-112957ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersapostrophecms apostrophe · apostrophe
- CVE-2026-112956ApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentapostrophecms apostrophe · @apostrophecms mport-export +1
- CVE-2026-113703SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofinggiuseppe99barchetta SuggestArr
- CVE-2026-112955ApostropheCMS: Import archives can exhaust server storage and deny serviceapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-112954ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APIapostrophecms apostrophe · apostrophe
- CVE-2026-112953ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-112952ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userapostrophecms apostrophe · apostrophe
- CVE-2026-107755Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLsApache Software Foundation Apache CouchDB
- CVE-2026-90800Apache CouchDB: Auth bypass in prefixed _users and _replicator databasesApache Software Foundation Apache CouchDB
- CVE-2026-113683VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filenamejcrodriguez-dis moodle-mod_vpl
- CVE-2026-113682Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Passwordnetworknt light-4j
- CVE-2026-113681OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds ReadAcademySoftwareFoundation OpenImageIO
- CVE-2026-113680HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoSharfbuzz
- CVE-2026-113679HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_stringharfbuzz
- CVE-2026-113678Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cronfroxlor
- CVE-2026-113677Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete APIfroxlor
- CVE-2026-113676Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get APIfroxlor
- CVE-2026-113613FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress pluginFlexGet
- CVE-2026-113612SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE EndpointCodeWithCJ SparkyFitness
- CVE-2026-113611Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptionsoutline
- CVE-2026-113610Xen Orchestra before 6.9.0 Authorization Bypass via user.set APIvatesfr xen-orchestra
- CVE-2026-113609Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell ScriptsBandisoft Bandizip