CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114717Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachmentRoundcube Webmail
- CVE-2026-114716Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image…Roundcube Webmail
- CVE-2026-114715Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password pluginRoundcube Webmail
- CVE-2026-114714Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy pluginRoundcube Webmail
- CVE-2026-114575TOTOLINK A950RG product.so UploadCustomModule command injectionTOTOLINK A950RG
- CVE-2026-110264GitLab remote code execution in regex compilationGitLab
- CVE-2025-65200localstack remote code execution in CloudFormation deploy endpoint
- CVE-2025-69723A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL
- CVE-2026-107079An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_auth.html component
- CVE-2026-51954An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri
- CVE-2026-78801An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch
- CVE-2026-78846Heap buffer overflow in SSDP location header parsing
- CVE-2026-114574massCodeIO massCode Local HTTP Service index.ts information disclosuremassCodeIO massCode
- CVE-2026-12664GitLab authorization bypass in GraphQL APIGitLab
- CVE-2026-13319GitLab authorization bypass in group milestones APIGitLab
- CVE-2026-14288GitLab approval policy bypass in merge request approvalsGitLab
- CVE-2026-15723GitLab account takeover via LDAP injection in OmniAuth linkingGitLab
- CVE-2026-16255GitLab authorization bypass in SAML and LDAP membership lockGitLab
- CVE-2026-103515GitLab authorization bypass in group Duo settingsGitLab
- CVE-2026-105711GitLab information disclosure in merge request fragment cacheGitLab
- CVE-2026-105777GitLab information disclosure in internal response headersGitLab
- CVE-2026-112378GitLab subscription bypass in AI feature eligibility checksGitLab
- CVE-2026-112212GitLab cache poisoning in OAuth/OIDC discovery responsesGitLab
- CVE-2026-112326GitLab unauthorized deletion of vulnerability recordsGitLab
- CVE-2026-100420Information disclosure vulnerability in the cloud-client daemon of Deco BE63TP-Link Systems Deco BE63
- CVE-2026-76531Files or Directories Accessible to External Parties in Splunk SOARSplunk SOAR
- CVE-2026-76530Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOARSplunk SOAR
- CVE-2026-76529Improper Protection of Alternate Path in Splunk SOARSplunk SOAR
- CVE-2026-76528Protection Mechanism Failure in Splunk SOARSplunk SOAR
- CVE-2026-76527Splunk SOAR security flaw in exception handlingSplunk SOAR