CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-95620Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qtqt
- CVE-2026-94263Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success MessageAdvanced Custom Fields: Extended
- CVE-2026-111965Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA BypassProfile Builder
- CVE-2026-105963Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto argumentselixir-plug plug · elixir-plug plug_crypto +2
- CVE-2026-16762Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qtqt
- CVE-2026-89320HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrityEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-25784bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysopHallo Welt! BlueSpice
- CVE-2026-89319JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the _thales_aad protected-header field and used it without any validationEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-25716BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking usersHallo Welt! BlueSpice
- CVE-2026-89318JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)Eclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89317JwtVerifierImpl.Verify does not enforce the JWS crit header (RFC 7515 §4.1.11)Eclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89316LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertionEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89315JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffixEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89314Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 sEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89313JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nilEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89312AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IVEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2025-58403Reflected Cross-Site Scripting (XSS) in CGM CLININETCGM CLININET
- CVE-2025-30054Local Privilege Escalation in CGM CLININETCGM CLININET
- CVE-2025-30053Missing Authentication in CGM CLININETCGM CLININET
- CVE-2025-30052Authentication Bypass via IP Spoofing in CGM CLININET rsyncdCGM CLININET
- CVE-2025-30051Insecure File Permissions in CGM CLININETCGM CLININET
- CVE-2025-30050Remote Code Execution in CGM CLININETCGM CLININET
- CVE-2025-30049Use of Unsalted MD5 Password Hashes in CGM CLININETCGM CLININET
- CVE-2025-30047Remote Code Execution via Java Deserialization in CGM CLININETCGM CLININET
- CVE-2025-30046Remote Code Execution in CGM CLININETCGM CLININET
- CVE-2025-30045Code Injection in CGM CLININETCGM CLININET
- CVE-2025-30043Missing Authentication in CGM CLININETCGM CLININET
- CVE-2026-115657KNIME Analytics Platform logs credentials of configured proxy when used as an executorKNIME Analytics Platform
- CVE-2026-112860WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerabilityxnau webdesign Participants Database
- CVE-2026-112862WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerabilityxnau webdesign Participants Database