CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-105931The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactionsApache Software Foundation Apache Pulsar
- CVE-2026-105930Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package DownloadApache Software Foundation Apache Pulsar
- CVE-2026-112868WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerabilityH5P
- CVE-2026-105927Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permissionApache Software Foundation Apache Pulsar
- CVE-2026-114265ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injectionProjectWorlds Advanced Library Management System
- CVE-2026-114176WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerabilityDigitalME eRoom
- CVE-2026-105926Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema CommandsApache Software Foundation Apache Pulsar
- CVE-2026-105869Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT)Apache Software Foundation Apache Pulsar
- CVE-2026-114493LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP RedirectsLocalAI
- CVE-2026-114492gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpointflipped-aurora gin-vue-admin
- CVE-2026-114491pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Imagesbpampuch pdfmake
- CVE-2026-110744A flaw was found in multicluster-global-hub-operator-bundleRed Hat Multicluster Global Hub
- CVE-2026-114133Nuxt server islands render useHeadSafe input without sanitisationnuxt
- CVE-2026-114132Nuxt: Server-side route rules (redirect, headers, proxy, ssr) are skipped for case-variant paths when routing is case-insensitivenuxt · @nuxt/nitro-server
- CVE-2026-114264ProjectWorlds Advanced Library Management System edit_member.php sql injectionProjectWorlds Advanced Library Management System
- CVE-2026-114131Nuxt is an open-source web development framework for Vue.jsnuxt
- CVE-2026-114130Nuxt is an open-source web development framework for Vue.jsnuxt
- CVE-2026-114129stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of serviceuhop stream-json · stream-json
- CVE-2026-114128Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingwithastro astro · astro
- CVE-2026-114263ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injectionProjectWorlds Advanced Library Management System
- CVE-2026-114127Astro: Arbitrary CSS injection in Astro View Transitionswithastro astro · astro
- CVE-2026-114126Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story filesstorybookjs storybook · storybook +5
- CVE-2026-92202Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution VulnerabilityLuxion KeyShot
- CVE-2026-92183GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-92207MindsDB OpenBBtable Code Injection Remote Code Execution VulnerabilityMindsDB
- CVE-2026-92206CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution VulnerabilityCrewAI
- CVE-2026-92205BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation VulnerabilityBusyBox
- CVE-2026-92204Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure VulnerabilityAirbyte
- CVE-2026-92203Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure VulnerabilityAirbyte
- CVE-2026-89035MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication BypassMikroTik RouterOS