CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-113672Argo CD: A Jsonnet import can read files from the repo-serverargoproj argo-cd
- CVE-2026-113802Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file HandlerWavlink WL-WN530BE1-A
- CVE-2026-111756follow-redirects array-form headers bypass cross-origin credential strippingfollow-redirects
- CVE-2026-105772Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionIdADK TypeScript
- CVE-2026-113711ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportapostrophecms apostrophe · @apostrophecms import-export +2
- CVE-2026-112861WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerabilityxnau webdesign Participants Database
- CVE-2026-113710ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessingapostrophecms apostrophe · apostrophe
- CVE-2026-113671ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFapostrophecms apostrophe · @apostrophecms ai-helper +1
- CVE-2026-113669ApostropheCMS: Cross-domain session token in URL confers session takeoverapostrophecms apostrophe · @apostrophecms passport-bridge +2
- CVE-2026-113667ApostropheCMS: CAPTCHA response token not URL-encodedapostrophecms apostrophe · @apostrophecms form +5
- CVE-2026-113668ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)apostrophecms apostrophe · apostrophe
- CVE-2026-113507aaPanel common.py GetClientIp access controlaaPanel
- CVE-2026-113666ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceapostrophecms apostrophe · @apostrophecms db-connect +2
- CVE-2026-113665ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpointsapostrophecms apostrophe · apostrophe
- CVE-2026-113506aaPanel File Manager common.py ExecShell os command injectionaaPanel
- CVE-2026-113664ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-113662ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentapostrophecms apostrophe · @apostrophecms import-export +1
- CVE-2026-113661ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsapostrophecms apostrophe · apostrophecms sanitize-html +1
- CVE-2026-113660ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiersapostrophecms apostrophe · apostrophe
- CVE-2026-113659ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersapostrophecms apostrophe · apostrophe
- CVE-2026-113658ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryapostrophecms apostrophe · apostrophe
- CVE-2026-92539Cross-organization user modification and deletion via the SCIM API in Grafana EnterpriseGrafana Enterprise
- CVE-2026-113657ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)apostrophecms apostrophe · apostrophecms sanitize-html +1
- CVE-2026-113656ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSapostrophecms apostrophe · @apostrophecms form +1
- CVE-2026-113649ApostropheCMS: Import API bypasses publication roles for protected contentapostrophecms apostrophe · @apostrophecms import-export +2
- CVE-2026-113655ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationapostrophecms apostrophe · apostrophe
- CVE-2026-113654ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderapostrophecms apostrophe · apostrophecms sanitize-html +1
- CVE-2026-113653ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)apostrophecms apostrophe · apostrophe
- CVE-2026-113652ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)apostrophecms apostrophe · apostrophecms uploadfs +1
- CVE-2026-28330SolarWinds Observability Self-Hosted Cross-Site Scripting VulnerabilitySolarWinds Observability Self-Hosted