CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114651Cross-document data leak via malformed BSON array parsing in reused thread bufferMongoDB C# Driver
- CVE-2026-115390Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoSbytecodealliance wasmtime · wasmtime
- CVE-2026-115389Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val APIbytecodealliance wasmtime · wasmtime
- CVE-2026-114650Plaintext exposure of encrypted fields via ANSI code-page corruption of database nameMongoDB C# Driver · MongoDB.Libmongocrypt NuGet package
- CVE-2026-115388Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Writebytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-114649Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cacheMongoDB C# Driver
- CVE-2026-115387Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflowbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-114648NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keysMongoDB C# Driver
- CVE-2026-115386Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdirbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115385Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestampsbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-114647NoSQL operator injection via unvalidated replacement document in findOneAndReplaceMongoDB C# Driver
- CVE-2026-115384Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflowbytecodealliance wasmtime · wasmtime
- CVE-2026-114646NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wireMongoDB C# Driver
- CVE-2026-115383Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Importsbytecodealliance wasmtime · wasmtime
- CVE-2026-115382Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoSbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-114645Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrappingMongoDB C Driver
- CVE-2026-115381Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroesbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-114644Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserializationMongoDB C# Driver
- CVE-2026-115380Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoffbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-114643Duplicate geometry fields via unvalidated GeoJSON extra membersMongoDB C# Driver
- CVE-2026-115379Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_callbytecodealliance wasmtime · wasmtime
- CVE-2026-115378Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pulllxc incus
- CVE-2026-115377Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Streamlxc incus
- CVE-2026-115376Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copylxc incus
- CVE-2026-115375Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumeslxc incus
- CVE-2026-115374Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLslxc incus
- CVE-2026-115373Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}lxc incus
- CVE-2026-115372Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_optionslxc incus
- CVE-2026-115371LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpointslxc incus
- CVE-2026-115370Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refreshlxc incus