CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114607better-auth: OAuth state can be used as a Magic Link to sign in as another userbetter-auth
- CVE-2026-114606draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)jgraph drawio-desktop
- CVE-2026-97631Pre-boot RCE in EDK II PXE driverTianoCore EDK2
- CVE-2026-115502DataApp links without login expose job information to other user in KNIME Business HubKNIME Business Hub
- CVE-2026-104068JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup RestoreJetBackup
- CVE-2026-114605dnspython dns.name.from_wire_parser() excessive CPU userthalley dnspython · dnspython
- CVE-2026-75507GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rulegraphql-python graphql-core · graphql-core
- CVE-2026-75508GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitgraphql-python graphql-core · graphql-core
- CVE-2026-115496Workflow names may be leaked to unauthenticated users in KNIME Business HubKNIME Business Hub
- CVE-2026-114487Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a…Devolutions Server
- CVE-2026-115494CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business HubKNIME Business Hub
- CVE-2026-114486Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access…Devolutions Server
- CVE-2026-114485Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to…Devolutions Server
- CVE-2026-114603OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiopen-telemetry opentelemetry-python · opentelemetry-api
- CVE-2026-115454Large tables in data apps can bring down execution services in KNIME HubKNIME Business Hub
- CVE-2026-94482Next.js denial of service in App Router server actionsvercel next.js · next
- CVE-2026-115453Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queriesMarcosCamara01 Ecommerce Template
- CVE-2026-115450Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifierMarcosCamara01 Ecommerce Template
- CVE-2026-115482In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attacklitespeedtech lsquic
- CVE-2026-114515OCO-Server: Self-Service Portal uninstall-job authorization bypassschorschii OCO-Server
- CVE-2026-61791OCO-Server: Stored XSS through agent hostnames in command buttonsschorschii OCO-Server
- CVE-2026-16477Insecure Deserialization of .cleanshot Files in CleanShot XMTW CleanShot X
- CVE-2026-114510Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backendsstevereiner flexible-graphrag · flexible-graphrag
- CVE-2026-111181body-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodybody-parser
- CVE-2026-113872multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownmulter
- CVE-2026-89410Out-of-bounds read in Z-Wave NCP SPI HandlerSilicon Labs Z-Wave SDK
- CVE-2026-89409Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End NodesSilicon Labs Z-Wave SDK
- CVE-2026-85079Out-of-bounds write in Zigbee Simple_Desc_req handlingSilicon Labs EmberZNet
- CVE-2026-94502Out-of-bounds write in Zigbee Publish Price Matrix handlingSilicon Labs EmberZNet
- CVE-2026-115249subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validationsubhajitkhan online-clinic-management-system