CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-49442Cacti: User Enumeration via Error Messagescacti
- CVE-2026-39902Cacti: Authenticated RCE on Data Inputcacti
- CVE-2026-46531Cacti is an open source performance and fault management frameworkcacti
- CVE-2026-102786Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5phoca.cz Phoca Gallery extension for Joomla
- CVE-2026-55222Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrapilbers isar
- CVE-2026-53942Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKENconda infrastructure
- CVE-2026-55486Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSSintranda goobi-viewer-core
- CVE-2026-55465Goobi viewer: Solr injection via unvalidated region parameter in spatial searchintranda goobi-viewer-core
- CVE-2026-55463Goobi viewer: WebSocket endpoints lack server-side authentication and origin validationintranda goobi-viewer-core
- CVE-2026-112333GFI Archiver < 15.14 Stored XSS via MailInsights.aspxGFI Software GFI Archiver
- CVE-2026-55459Goobi viewer: OpenID JWT audience not enforced by the verifierintranda goobi-viewer-core
- CVE-2026-55457Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypassintranda goobi-viewer-core
- CVE-2026-55444Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parametersintranda goobi-viewer-core
- CVE-2026-46652Path traversal via HTTP Content-Disposition header in ExternalFilesDownloader enables remote code execution in Goobi viewerintranda goobi-viewer-core
- CVE-2026-46651Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerintranda goobi-viewer-core
- CVE-2026-46347Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Resetintranda goobi-viewer-core
- CVE-2026-46346Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Resetintranda goobi-viewer-core
- CVE-2026-55442Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injectionintranda goobi-viewer-core
- CVE-2026-115478obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-115477obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTPThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-115457baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Commentsbaserproject basercms
- CVE-2026-115786Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota ExhaustionZimbra Collaboration Suite
- CVE-2026-115785Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email AddressZimbra Collaboration Suite
- CVE-2026-114624baserCMS: PHP object injection via unguarded unserialize() in the widget-area entitybaserproject basercms
- CVE-2026-114623baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosurebaserproject basercms
- CVE-2026-114622baserCMS: Encoded path traversal bypass in the theme file APIbaserproject basercms
- CVE-2026-57207NetBox MCP Server: HTTP transport exposes all NetBox data without authenticationnetboxlabs netbox-mcp-server
- CVE-2026-114621baserCMS: SQL injection in the admin panel and admin APIbaserproject basercms
- CVE-2026-114357DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)DJI CrystalSky ZS600C
- CVE-2026-57208Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewindentireio cli · github.com/entireio/cli