CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-115369OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANsopenbao
- CVE-2026-115366OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIsopenbao
- CVE-2026-115365OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversalopenbao
- CVE-2026-115364OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpointsopenbao
- CVE-2026-115363OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configurationopenbao
- CVE-2026-115362OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypassopenbao
- CVE-2026-115361OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denialopenbao
- CVE-2026-115360OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UIopenbao
- CVE-2026-115359OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsingopenbao
- CVE-2026-115358OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parametersopenbao
- CVE-2026-115357OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responsesopenbao
- CVE-2026-115356OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocationopenbao
- CVE-2026-115355Mistune before 3.3.0 Path Traversal and XSS via Include Directivelepture mistune · mistune
- CVE-2026-114519Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accountsRoskus Prospero Flow CRM
- CVE-2026-115354Mistune before 3.3.0 Arbitrary Local File Read via Include Directivelepture mistune
- CVE-2026-115353Mistune before 3.3.0 Path Traversal via include Directivelepture mistune
- CVE-2026-115352Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parserlepture mistune
- CVE-2026-115351Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Optionlepture mistune
- CVE-2026-115350Mistune before 3.3.0 Stored XSS via Include Directive HTML Fileslepture mistune
- CVE-2026-115349Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsinglepture mistune
- CVE-2026-115348Mistune before 3.3.0 Quadratic-Time DoS via parse_link_textlepture mistune
- CVE-2026-115347Mistune before 3.3.0 Quadratic Denial of Service via parse_link_textlepture mistune
- CVE-2022-51026Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Loginbytebase · github.com/bytebase/bytebase
- CVE-2026-95721Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95720Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95719Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95718Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95717Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95716Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration ChangesHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95715Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line InterfaceHewlett Packard Enterprise (HPE) ArubaOS