CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-88041Apache Tomcat: HTTP/2 trailer header cross-contaminationApache Software Foundation Apache Tomcat
- CVE-2026-80353Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connectorApache Software Foundation Apache Tomcat
- CVE-2026-74049Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)Apache Software Foundation Apache Tomcat
- CVE-2026-74048Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-upApache Software Foundation Apache Tomcat
- CVE-2026-113394DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversalDrayTek Vigor2960
- CVE-2026-96406VIDEO class descriptor walk consumes device-controlled wTotalLength as its boundEclipse Foundation Eclipse ThreadX - USBX
- CVE-2026-113393DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted uploadDrayTek Vigor2960
- CVE-2026-96582Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor ParserEclipse Foundation Eclipse ThreadX - USBX
- CVE-2026-91041FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT imageEclipse Foundation Eclipse ThreadX - FileX
- CVE-2026-113392DrayTek Vigor2960 Apmupload mainfunction.cgi path traversalDrayTek Vigor2960
- CVE-2026-105941The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer…Red Hat streams for Apache Kafka
- CVE-2026-113401Denial-of-service in the PDF Viewer componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-113400Uninitialized memory in the Audio/Video: cubeb componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-113399Mozilla Firefox boundary check flaw in SVG componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-113470Cryptographic issue in the Security Block-lists, Allow-lists, and other State componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-113391DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injectionDrayTek Vigor2960
- CVE-2026-113620Eclipse ioFog operator WebSocket accepts an unverified JWTEclipse Foundation Eclipse ioFog
- CVE-2026-113390DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injectionDrayTek Vigor2960
- CVE-2026-113619Eclipse ioFog renders request templates before authenticationEclipse Foundation Eclipse ioFog
- CVE-2026-34485A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX)Nokia 1830 Global Express
- CVE-2026-34484A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX)Nokia 1830 Global Express
- CVE-2026-113389DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injectionDrayTek Vigor2960
- RUSTSEC-2026-0461rmcp memory exhaustion in Streamable HTTP server transportrmcp
- CVE-2026-113388opensource-socialnetwork Cache Settings dynamic.php input code injectionopensource-socialnetwork
- CVE-2026-113583Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.jscypht-org cypht
- CVE-2026-105949Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true)Cruise Control for Apache Kafka · Red Hat streams for Apach…
- CVE-2026-105312A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container imageRed Hat StreamsHub Console for Apache Kafka® · Red Hat stre…
- CVE-2026-105311Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputyRed Hat StreamsHub Console for Apache Kafka® · Red Hat stre…
- CVE-2026-18205XSS in Ticimax Informatics' Ticimax E-Commerce PlatformTicimax Informatics Technologies Ticimax E-Commerce Platform
- CVE-2026-113385LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application componentsLeeDrOiD Labs Shortcutter 2 App