CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114267SourceCodester Food Order Management System Admin Endpoint authorizationSourceCodester Food Order Management System
- CVE-2026-111816Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-outApache Software Foundation Apache Traffic Server
- CVE-2025-55702Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new requestApache Software Foundation Apache Traffic Server
- CVE-2026-110803Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8vaadin framework
- CVE-2026-107588Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Chartsvaadin · vaadin-charts-flow +2
- CVE-2025-31699Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smugglingApache Software Foundation Apache Traffic Server
- CVE-2026-111804Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDsApache Software Foundation Apache Traffic Server
- CVE-2026-111813Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationApache Software Foundation Apache Traffic Server
- CVE-2026-19947Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexerzephyrproject zephyr
- CVE-2026-79976NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controllerzephyrproject zephyr
- CVE-2026-78119Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet lengthzephyrproject zephyr
- CVE-2026-78118The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock…zephyrproject zephyr
- CVE-2026-78117Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the airzephyrproject zephyr
- CVE-2026-18748Out-of-bounds read in Bluetooth Classic A2DP codec information element handlingzephyrproject zephyr
- CVE-2026-78116Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error pathzephyrproject zephyr
- CVE-2026-19676PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user modezephyrproject zephyr
- CVE-2026-105945Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package StorageApache Software Foundation Apache Pulsar
- CVE-2026-105944Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of lifeApache Software Foundation Apache Pulsar Manager
- CVE-2026-114266ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injectionProjectWorlds Advanced Library Management System
- CVE-2026-105942Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalationApache Software Foundation Apache Pulsar
- CVE-2026-105938Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or…Apache Software Foundation Apache Pulsar
- CVE-2026-105937Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic dataApache Software Foundation Apache Pulsar
- CVE-2026-113461mk-oracle: Local privilege escalation via insecure Oracle Home library loadingCheckmk
- CVE-2026-105936Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpointApache Software Foundation Apache Pulsar
- CVE-2026-105935Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permissionApache Software Foundation Apache Pulsar
- CVE-2026-105934Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topicApache Software Foundation Apache Pulsar
- CVE-2026-105933Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initializationApache Software Foundation Apache Pulsar
- CVE-2026-105932Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpointsApache Software Foundation Apache Pulsar
- CVE-2026-113870Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON ParsingMongoDB Compass
- CVE-2026-111401WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerabilityTailored Media Tailored Tools