CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-113744Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflowTenda AC19
- CVE-2026-113743Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversalTenstorrent tt-metal
- CVE-2026-105044OS Command Injection in Qingteng Host Adaptive Security Platform Security ToolboxQingteng Host Adaptive Security Platform
- CVE-2026-113741itsourcecode Online Cake Ordering System 404.php cross site scriptingitsourcecode Online Cake Ordering System
- CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509Go standard library crypto/x509 · stdlib +3
- CVE-2026-113740itsourcecode Online Cake Ordering System deletecustomer.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2026-114198Deserialization of untrusted data in flossMandiant FLARE floss
- CVE-2026-114197Deserialization of untrusted data in capaMandiant FLARE capa
- CVE-2026-114119Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative CredentialBest Practice Software Bp Premier
- CVE-2026-114118Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparoundvyperlang vyper
- CVE-2026-114117Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branchesvyperlang vyper
- CVE-2026-114116Vyper through 0.5.0b1 Literal Value Manipulation via Line Separatorsvyperlang vyper
- CVE-2026-114115Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selectionvyperlang vyper
- CVE-2026-114114Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Charactersvyperlang vyper
- CVE-2026-114113Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoderslovell sharp · sharp
- CVE-2026-114112Sharp before 0.35.4 RCE via bundled libheif AVIF decodinglovell sharp · sharp
- CVE-2026-114111Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerabilitylovell sharp · sharp
- CVE-2026-114110Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entriesastral-sh uv · uv
- CVE-2026-114109uv before 0.11.15 Arbitrary File Write via Entry Point Namesastral-sh uv · uv
- CVE-2026-114108HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCEHKUDS Vibe-Trading · vibe-trading-ai
- CVE-2026-114107HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunToolHKUDS Vibe-Trading · vibe-trading-ai
- CVE-2026-114106HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_pathHKUDS Vibe-Trading · vibe-trading-ai
- CVE-2026-114105Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bitscthackers adm-zip
- CVE-2026-114104adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypasscthackers adm-zip · adm-zip
- CVE-2026-114103adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()cthackers adm-zip · adm-zip
- CVE-2026-114102adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Eventcthackers adm-zip · adm-zip
- CVE-2026-114101Coraza before 3.8.1 Multipart filename Charset Handling FILES Rule Bypasscorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-114100Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Typecorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-114099Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collisioncorazawaf coraza · github.com/corazawaf/coraza/v3 +2
- CVE-2026-114098Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinksjelmer dulwich · dulwich