CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114143toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()BinaryMuse toml-node · toml
- CVE-2026-114378itsourcecode Online Cake Ordering System deleteproduct.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2026-114142toml-node: Prototype pollution: parsing a TOML document can write to Object.prototypeBinaryMuse toml-node · toml
- CVE-2026-114141toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()BinaryMuse toml-node · toml
- CVE-2026-114140nbconvert remote code execution in notebook output extractionjupyter nbconvert · nbconvert
- CVE-2026-114377leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversalleomoon-studios wiki-go
- CVE-2026-114139Sentry-Javascript: Middleware Bypass when using Tunnel routegetsentry sentry-javascript · @sentry/nextjs
- CVE-2026-114138Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationencode django-rest-framework · djangorestframework
- CVE-2026-114137Django REST framework: TokenProxy.delete() reports success and revokes nothingencode django-rest-framework · djangorestframework
- CVE-2026-114136Django REST framework: JSONParser applies an attacker-named codec to the request streamencode django-rest-framework · djangorestframework
- CVE-2026-114376leomoon-studios wiki-go API editor.go SourceHandler path traversalleomoon-studios wiki-go
- CVE-2026-114135Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorizationjupyter-server jupyter_server · jupyter-server
- CVE-2026-114375leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversalleomoon-studios wiki-go
- CVE-2026-85518Openscap: openscap: arbitrary file write via path traversal in source datastream decompositionRed Hat Hardened Images · Red Hat Enterprise Linux
- CVE-2026-112408Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()AWS Amazon SageMaker Python SDK
- CVE-2026-114438Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action orderingRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-114374leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgeryleomoon-studios wiki-go
- CVE-2026-112381Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked responseApache Software Foundation Apache Traffic Server
- CVE-2026-111817Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeoutApache Software Foundation Apache Traffic Server
- CVE-2026-111812Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentialsApache Software Foundation Apache Traffic Server
- CVE-2026-111811Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authenticationApache Software Foundation Apache Traffic Server
- CVE-2026-111809Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smugglingApache Software Foundation Apache Traffic Server
- CVE-2026-114362HarnessRouter Targets Test Endpoint app.py server-side request forgeryHarnessRouter
- CVE-2026-111810Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of serviceApache Software Foundation Apache Traffic Server
- CVE-2026-111815Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcementApache Software Foundation Apache Traffic Server
- CVE-2026-111814Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the originApache Software Foundation Apache Traffic Server
- CVE-2026-111808Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustionApache Software Foundation Apache Traffic Server
- CVE-2026-111805Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustionApache Software Foundation Apache Traffic Server
- CVE-2026-114361HarnessRouter Identity Mode app.py improper authorizationHarnessRouter
- CVE-2026-114268Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflowTenda BE3L Pro