CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-97313Specific RPZ configurations and query patterns may result in an unexpected exitISC BIND
- CVE-2026-96888Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimizationISC BIND
- CVE-2026-94300Concurrent GSS-TSIG messages corrupt memoryISC BIND
- CVE-2026-114245dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorizationdhikshitha29 Insurance-Management-System
- CVE-2026-19630Amplified resource exhaustion in inbound message processingISC BIND
- CVE-2026-114404PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and DescriptionsPHPOffice PHPPresentation
- CVE-2026-114403PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::loadPHPOffice PHPPresentation
- CVE-2026-114402Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Uploadpolonel trudesk
- CVE-2026-114401Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/loginpolonel trudesk
- CVE-2026-114400Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploadspolonel trudesk
- CVE-2026-114399Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore APIpolonel trudesk
- CVE-2026-114398Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogopolonel trudesk
- CVE-2026-114397Trudesk through 1.2.11 Missing Authentication on Debug Routespolonel trudesk
- CVE-2026-114396Trudesk through 1.2.11 MongoDB $where Injection via tickets search APIpolonel trudesk
- CVE-2026-114395Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/sendpolonel trudesk
- CVE-2026-114394Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIspolonel trudesk
- CVE-2026-114393Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpointspolonel trudesk
- CVE-2026-114392Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uidpolonel trudesk
- CVE-2026-114391ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methodseasysoft zentaopms
- CVE-2026-114390Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlerschamilo-lms
- CVE-2026-114389Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGradechamilo-lms
- CVE-2026-114388Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookControllerchamilo-lms
- CVE-2026-114387Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Componentsshopperlabs shopper
- CVE-2026-114386Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_codepydantic-ai-harness
- CVE-2026-114120SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX ActionWPDeveloper SchedulePress
- CVE-2026-114405Denial of Service via Malformed VATP Packet in Velneo vServerVelneo vServer
- CVE-2026-90484Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crashApache Software Foundation Apache bRPC
- CVE-2026-87849Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsingApache Software Foundation Apache bRPC
- CVE-2026-86249Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.authApache Software Foundation Apache bRPC
- CVE-2026-86147Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprofApache Software Foundation Apache bRPC