CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-79848Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79847Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79846Unauthenticated Command Injection Vulnerabilities in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79844Authentication Bypass Leading to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-115414OS command injection in the Terraform hook in AWS SAM CLIaws-sam-cli
- CVE-2026-114613MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failuremsgpack-python · msgpack
- CVE-2026-115519Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business HubKNIME Business Hub
- CVE-2026-115517Unrestricted network access between execution contexts in KNIME Business HubKNIME Business Hub
- CVE-2026-114612LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt KeyBerriAI litellm · litellm
- CVE-2026-113876SmileCDR HAPI FHIR unauthorized readSmileCDR HAPI FHIR
- CVE-2026-113875SmileCDR HAPI FHIR unauthorized read via subscriptionSmileCDR HAPI FHIR
- CVE-2026-113874SmileCDR HAPI FHIR trusted tenant partition overrideSmileCDR HAPI FHIR
- CVE-2026-113873SmileCDR HAPI FHIR improper data decompressionSmileCDR HAPI FHIR
- CVE-2026-97635Agent Zero Web UI XSSAgent Zero
- CVE-2026-77157ast-cli: Auto-update downloads are not verified against a checksum before executiongithub.com/checkmarx/ast-cli
- CVE-2026-77156ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directorygithub.com/checkmarx/ast-cli
- CVE-2026-108357PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServicePHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-13599ABB Ability Edgenius | Missing Authentication in Edgenius AuthDBABB Ability Edgenius
- CVE-2026-114611OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device managementschorschii OCO-Server
- CVE-2026-108359PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-93336Missing authorization in the unit resources download route in Juju controllersCanonical Juju
- CVE-2026-108358PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServicePHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-108360PhpSpreadsheet allowlist bypass via redirect in Drawing::setPathPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-54238Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorizationsupabase realtime
- CVE-2026-114610fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'py-pdf fpdf2 · fpdf2
- CVE-2026-114609fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled contentpy-pdf fpdf2 · fpdf2
- CVE-2026-54532CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theftCloudPirates-io helm-charts
- CVE-2026-115513OpenCATS before 0.12.0 Stored XSS via MRU Navigation PanelOpenCATS
- CVE-2026-115416Incorrect authorization checks in Amazon Athena engine version 3 query processingAWS Amazon Athena
- CVE-2026-114608Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOMEpylint-dev pylint · pylint