CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-54427Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF ParserApache Software Foundation Apache bRPC
- CVE-2026-54426Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply ParserApache Software Foundation Apache bRPC
- CVE-2026-54425Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update DecodingApache Software Foundation Apache bRPC
- CVE-2026-48830Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requestsApache Software Foundation Apache bRPC
- CVE-2026-59229Apache IoTDB: Legacy Pipe Privilege EscalationApache Software Foundation Apache IoTDB
- CVE-2026-59562Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPCApache Software Foundation Apache IoTDB
- CVE-2026-41114Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC DriverApache Software Foundation Apache IoTDB JDBC driver
- CVE-2026-58663Apache IoTDB: Auth Bypass in pipeTransfer() interfaceApache Software Foundation Apache IoTDB
- CVE-2026-87096Sensitive information disclosure and manipulation due to improper authorization checksAcronis Cyber Infrastructure
- CVE-2026-87095Sensitive information disclosure and manipulation due to improper authorization checksAcronis Cyber Infrastructure
- CVE-2026-105923Null-pointer dereference in QTriangulator reachable through VectorImageQt
- CVE-2026-110369GS Plugins WordPress Team Members PHP object injection in a CMS pluginWordPress Team Members – GS Plugins
- CVE-2026-110370WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerabilityGS Plugins GS Pins for Pinterest
- CVE-2026-110884WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilitygeekontheroad Live Summary for Gravity Forms
- CVE-2026-70387OnePlus OxygenOS exposed dangerous method vulnerabilityOnePlus OxygenOS
- CVE-2026-97206NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operationNLnet Labs Unbound
- CVE-2026-96405NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budgetNLnet Labs Unbound
- CVE-2026-50106When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably…NLnet Labs Unbound
- CVE-2026-35501When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably…NLnet Labs Unbound
- CVE-2026-109125Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'NLnet Labs Unbound
- CVE-2026-70386OnePlus OxygenOS improper neutralization of special elements vulnerabilityOnePlus OxygenOS
- CVE-2026-85683Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URLJane Menu
- CVE-2026-14556HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_refererHappyForms
- CVE-2026-107447Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter IdentityContest Gallery
- CVE-2026-105256LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' ParameterLatePoint
- CVE-2026-104642Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification BypassSimple Shopping Cart
- CVE-2026-104641Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN RecipientSimple Shopping Cart
- CVE-2026-103301Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant SecretPayment Gateway for Telcell
- CVE-2026-101138CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL WhitelistCMP – Coming Soon & Maintenance
- CVE-2026-114236Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layersRed Hat Confidential Compute Attestation · Red Hat DPU… +17