CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-86409stale SigV4 headers sent unintendedcurl
- CVE-2026-113725virtualenv bash activate runs commands from an environment name with a backslash before $pypa virtualenv · virtualenv
- CVE-2026-113724virtualenv: Deletion recovery can change a symlink target's modepypa virtualenv · virtualenv
- CVE-2026-113723virtualenv: Bash prompt values can change meaning under older compatibility modespypa virtualenv · virtualenv
- CVE-2026-107692War Thunder Account ImpersonationGaijin Entertainment War Thunder
- CVE-2026-113722virtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxpypa virtualenv · virtualenv
- CVE-2026-113721virtualenv: Generated files can follow existing destination linkspypa virtualenv · virtualenv
- CVE-2026-113720virtualenv: Seeded files retain permissions from an older cachepypa virtualenv · virtualenv
- CVE-2026-113715virtualenv: Venv configuration readback can reinterpret path boundariespypa virtualenv · virtualenv
- CVE-2026-113719virtualenv: Seed replacement does not contain metadata deletion pathspypa virtualenv · virtualenv
- CVE-2026-113718virtualenv: Xonsh activation literals depend on the script decoding codecpypa virtualenv · virtualenv
- CVE-2026-113717virtualenv: Pip seeding with download omits wheel digest verificationpypa virtualenv · virtualenv
- CVE-2026-113716virtualenv: Builtin creation follows linked environment directoriespypa virtualenv · virtualenv
- CVE-2026-113869Use-after-free in S/MIME decryption during a security device password promptMozilla Thunderbird
- CVE-2026-113868Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authenticationMozilla Thunderbird
- CVE-2026-113867Stanza injection in XMPP chatMozilla Thunderbird
- CVE-2026-113866Account password sent unencrypted during Exchange account setupMozilla Thunderbird
- CVE-2026-113712Cachet has Stored XSS in Incident Componentcachethq cachet · cachethq/cachet
- CVE-2026-113714virtualenv: Downloaded wheel selection and caching precede verificationpypa virtualenv · virtualenv
- CVE-2026-113713virtualenv: Temporary app-data can leave dangling seed package linkspypa virtualenv · virtualenv
- CVE-2026-111088Stored XSS in the VPN logs monitorStormshield Network Security
- CVE-2026-113810Stored XSS on SNS Enrollment PortalStormshield Network Security
- CVE-2026-111767MCP TypeScript SDK: Experimental tasks were not tied to the session that created themmodelcontextprotocol typescript-sdk · @modelcontextprotocol…
- CVE-2026-100134Acrobat for Edge | Out-of-bounds Write (CWE-787)Adobe Acrobat for Edge
- CVE-2026-100132Acrobat for Edge | Out-of-bounds Read (CWE-125)Adobe Acrobat for Edge
- CVE-2026-113808Stored XSS on SNS Enrollment PortalStormshield Network Security
- CVE-2026-113643EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorizationEspoCRM
- CVE-2026-97406Authentication Bypass via Bearer Tokens to Unauthorized Credential MintingXerj Console API
- CVE-2026-113709Argo CD: A Kustomize Helm config home can run commands in the repo-serverargoproj argo-cd
- CVE-2026-113708Argo CD: A Kustomize remote ref can run commands in the repo-serverargoproj argo-cd