CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-19741OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)zephyrproject zephyr
- CVE-2026-115796Tenda F6 Web Management cross-site request forgeryTenda F6
- CVE-2026-115586virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)pypa virtualenv · virtualenv
- CVE-2026-115585pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)py-pdf pypdf · pypdf
- CVE-2026-115580pypdf: Possible long runtimes for large xref table header limitspy-pdf pypdf · pypdf
- CVE-2026-115572pypdf: Possible long runtimes for repeated references to the same missing objectpy-pdf pypdf · pypdf
- CVE-2026-115845Incomplete validation in the run_script Python sandbox in AWS MCP ServerAWS MCP Server
- CVE-2026-91093HP One Agent Software – Security UpdateHP One Agent Software
- CVE-2026-112342Tandoor Recipes < 2.7.0 Cross-Space Permission Cache PoisoningTandoor Recipes
- CVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificateselectron
- CVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootfallow-rs fallow · @fallow-cli fallow-node +6
- CVE-2026-115863ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.ConnMan
- CVE-2026-115813Server-side request forgery in the model download path in Amazon Web Services Multi Model ServerAWS multi-model-server
- CVE-2026-115812Relative path traversal during model archive extraction in Amazon Web Services Multi Model ServerAWS multi-model-server
- CVE-2026-115567Tokio: Race condition in `tokio::time::Interval`tokio-rs tokio · tokio
- CVE-2026-110975Autotune: kruize/autotune: kruize/autotune: datasources credential disclosurekruize-autotune
- CVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the…nodejs node
- CVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent…nodejs node
- CVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and…nodejs node
- CVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and…nodejs node
- CVE-2026-106071A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or…nodejs node
- CVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client…nodejs node
- CVE-2026-87901Improper sanitization in the registration module allows reflected Cross-Site Scripting.phpBB
- CVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4…nodejs node
- CVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and…nodejs node
- CVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.nodejs node
- CVE-2026-115810Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URLTandoorRecipes recipes
- CVE-2026-57845Hugging Face Datasets < 5.2.0 Pickle Deserialization RCE via Pandas Builderhuggingface datasets
- CVE-2026-54668Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)kitodo-production
- CVE-2026-58497Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requestsolo-dot-io Uni-CLI · @zenalexa/unicli