CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-118567Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280Drupal Bulk Update User Roles · drupal/bulk_update_user_rol…
- CVE-2026-118572OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284Drupal OAuth Login - OAuth OIDC SSO · drupal/oauth_login_oa…
- CVE-2026-118575Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285Drupal Signature pad widget · drupal/sign_widget
- CVE-2026-118576Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286Drupal Stage File Proxy · drupal/stage_file_proxy
- CVE-2026-118554OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287Drupal OpenID Connect Client · drupal/oidc
- CVE-2026-118583Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288Drupal Field Permissions · drupal/field_permissions
- CVE-2026-118584Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289Drupal Field Permissions · drupal/field_permissions
- CVE-2026-118573OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290Drupal OAuth2 Token Manager · drupal/oauth2_token_manager
- CVE-2026-118568Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291Drupal Content Sync · drupal/cms_content_sync
- CVE-2026-118571Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292Drupal Media Alias Display · drupal/media_alias_display
- CVE-2026-74915GPU DDK - OOB write in UntwiddlePOTSquare64bppImagination Technologies Graphics DDK
- CVE-2026-74912GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GBImagination Technologies Graphics DDK
- CVE-2026-19199GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSetImagination Technologies Graphics DDK
- CVE-2026-18629GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilationImagination Technologies Graphics DDK
- CVE-2026-65587GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL changeImagination Technologies Graphics DDK
- CVE-2026-65586GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKMImagination Technologies Graphics DDK
- CVE-2026-65584GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfoImagination Technologies Graphics DDK
- CVE-2026-118475Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunkRed Hat Enterprise Linux
- CVE-2026-112922Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shadingRed Hat Enterprise Linux
- CVE-2026-15466GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()Imagination Technologies Graphics DDK
- CVE-2026-91920Undertow: undertow: chunkreader message length permits chunk-size overflowRed Hat build of Apache Camel for Spring Boot · Red Hat… +3
- CVE-2026-112605This issue was addressed with improved handling of symlinks.Apple Xcode
- CVE-2026-112602An authorization issue was addressed with improved state management.Apple Xcode
- CVE-2026-110133Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollbackRed Hat Enterprise Linux
- CVE-2026-118959Keycloak-services: keycloak-services: required actions bypassed via kc_action parameterRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-118947Keycloak-services: keycloak-services: authorization bypass via uma resource registration idorRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-119272Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-119271Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process…Google Chrome
- CVE-2026-119270Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the…Google Chrome
- CVE-2026-119269Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a…Google Chrome