CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-115221Ipa: freeipa: freeipa uses subject cn as proof of certificate ownershipRed Hat Enterprise Linux
- CVE-2026-115424Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destinationRed Hat OpenShift Container Platform
- CVE-2026-114615Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysauthlib
- CVE-2026-114614Authlib is a Python library which builds OAuth and OpenID Connect serversauthlib
- CVE-2026-114583tar filter allows writing outside destination via empty-named symlinkPython Software Foundation CPython · libpython +2
- CVE-2026-114625Arista Networks VeloCloud Orchestrator privilege escalation to operator in on-premises consoleArista Networks VeloCloud Orchestrator
- CVE-2026-115417Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqttaws-c-mqtt
- CVE-2026-115419Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerAWS strands-agents · AWS strands-agents/sdk +2
- CVE-2026-112332Motor.NET < 0.19.0 Denial of Service via JsonNet DeserializationGDATASoftwareAG motornet
- CVE-2026-112331Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent MappingGDATASoftwareAG motornet
- CVE-2026-112330Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents HeadersGDATASoftwareAG motornet
- CVE-2026-115509Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state APIjitsucom jitsu
- CVE-2026-115508Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fieldsunclecode crawl4ai
- CVE-2026-115507Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Headergo-vikunja vikunja
- CVE-2026-115506libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delaylibexpat
- CVE-2026-115505libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnumsahlberg libsmb2
- CVE-2026-115504CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.cHEASARC cfitsio
- CVE-2026-115503Ghidra before 12.2 Denial of Service via Compressed Extension ArchiveNationalSecurityAgency ghidra
- CVE-2026-115398Ghidra before 12.2 Denial of Service via TAR and ZIP File System MountNationalSecurityAgency ghidra
- CVE-2026-115397Ghidra before 12.2 Denial of Service via Extension Archive InstallNationalSecurityAgency ghidra
- CVE-2026-115396Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme ArchiveNationalSecurityAgency ghidra
- CVE-2026-115395Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()NationalSecurityAgency ghidra
- CVE-2026-114655KMS request injection via unsanitized key vault and provider values in libmongocryptMongoDB libmongocrypt
- CVE-2026-115394Ghidra through 12.2 Denial of Service via BinaryField Memory AllocationNationalSecurityAgency ghidra
- CVE-2026-114654BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guardsMongoDB C# Driver
- CVE-2026-115393Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusionbytecodealliance wasmtime · wasmtime
- CVE-2026-115392Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashesbytecodealliance wasmtime · wasmtime
- CVE-2026-114653Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builderMongoDB C# Driver
- CVE-2026-115391Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streamsbytecodealliance wasmtime · wasmtime
- CVE-2026-114652Update operator injection via single-element list rewriting in the update builderMongoDB C# Driver