CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114439oretnom23 php-travel-agency-system Session session.php missing authenticationoretnom23 php-travel-agency-system
- CVE-2026-114384itsourcecode Online Cake Ordering System transactionsave.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2026-114509framework authentication bypass in TokenGuardlaravel framework · laravel/framework
- CVE-2026-114508Laravel relationship inclusion can trigger unauthorized data destructionlaravel framework · laravel/framework
- CVE-2026-114383TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflowTOTOLINK EX200
- CVE-2026-112921Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous requestRobots-Validate
- CVE-2026-114382TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflowTOTOLINK EX200
- CVE-2026-91403Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)Oracle Java SE · Oracle GraalVM for JDK +1
- CVE-2026-94423Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts. connect reports success as soon as ssh_connect returns…Net-LibSSH
- CVE-2026-94140Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=noRex
- CVE-2026-114501Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1python-pillow Pillow · pillow
- CVE-2026-114381itsourcecode Online Cake Ordering System orderdetail.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2026-96639Pillow multi-frame loaders can reuse stale native image storage after mode transitionspython-pillow Pillow · pillow
- CVE-2026-96636Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)python-pillow Pillow · pillow
- CVE-2026-29001TastyIgniter 4.4.5 PHP Object Injection via Settings DeserializationTastyIgniter
- CVE-2026-96640Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionpython-pillow Pillow · pillow
- CVE-2026-96637Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSpython-pillow Pillow · pillow
- CVE-2026-114380itsourcecode Online Cake Ordering System inserttrans.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2026-113811Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in searchAlgorithm-UrataniTakeda
- CVE-2026-96778Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferpython-pillow Pillow · pillow
- CVE-2026-114406Ca-certificates: distrust emudhra intermediate ca certificates due to security concernsRed Hat Enterprise Linux · Red Hat OpenShift Container… +17
- CVE-2026-96643Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timepython-pillow Pillow · pillow
- CVE-2026-96644Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)python-pillow Pillow · pillow
- CVE-2026-96641Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromisepython-pillow Pillow · pillow
- CVE-2026-96642Pillow: TarIO negative size field causes infinite CPU-spin looppython-pillow Pillow · pillow
- CVE-2026-82987CVE-2026-82987Viewsonic vCast
- CVE-2026-96638Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modepython-pillow Pillow · pillow
- CVE-2026-114379EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusionEKKOLearnAI ekko-studio
- CVE-2026-114145GitPython validates a submodule's ".git" path only after cloning into it (RCE)gitpython-developers GitPython · gitpython
- CVE-2026-114144toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()BinaryMuse toml-node · toml