CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119730Maxthon Browser for Android < 7.5.8.103 Fullscreen Address Bar SpoofingMaxthon Technology Limited Maxthon Browser for Android
- CVE-2026-78403Unauthenticated Stack Buffer Overflow in Sentinel Keys ServerThalesgroup Sentinel Keys Server
- CVE-2026-78402Stack Buffer Overflow in Sentinel Keys ServerThalesgroup Sentinel Keys Server
- CVE-2026-7005WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller OnboardingWIT SynApps Runtime
- CVE-2026-62331praktor: Telegram upload traversal permits persistent agent instruction injectionmtzanidakis praktor · github.com/mtzanidakis/praktor
- CVE-2026-7004WIT SynApps Runtime 1.4.11 Reflected XSS via LINK ParameterWIT SynApps Runtime
- CVE-2026-61586Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)copernik-eu copernik-xml-factory · eu.copernik:copernik-xml…
- CVE-2026-7003WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials DisclosureWIT SynApps Runtime
- CVE-2026-62303Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)pistacheio pistache
- CVE-2026-62298asn1c: ASAN crash with decode of open typesmouse07410 asn1c
- CVE-2026-59978AdminNeo: version-cache array injection causes persistent denial of serviceadminneo-org adminneo · adminneo-org/adminneo
- CVE-2026-120046Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service Historynezhahq nezha
- CVE-2026-120007NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uidNodeBB
- CVE-2026-119842Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace checkRed Hat Enterprise Linux
- CVE-2026-119727Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computationRed Hat Enterprise Linux
- CVE-2026-61848Crass: Non-ASCII characters cause superlinear CPU consumptionrgrove crass · crass
- CVE-2026-61847Crass: A large number of adjacent CSS comments can trigger a SystemStackErrorrgrove crass · crass
- CVE-2026-61846Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usagergrove crass · crass
- CVE-2026-61845Crass: Large numeric exponents cause CPU and memory denial of servicergrove crass
- CVE-2026-46560OpenAM Authentication Bypass via RADIUS SpoofingOpenIdentityPlatform OpenAM · org.openidentityplatform.open…
- CVE-2026-119729Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of serviceRed Hat Enterprise Linux
- CVE-2026-119728Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failureRed Hat Enterprise Linux
- CVE-2026-62264PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEYSylphxAI pdf-reader-mcp · @sylphx/pdf-reader-mcp
- CVE-2026-118090WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerabilityStylemix MasterStudy LMS
- CVE-2026-118089WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerabilityRexTheme Product Feed Manager
- CVE-2026-118086WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerabilityHakan Ozevin WP BASE Booking
- CVE-2026-116862WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerabilityAcato WP REST Cache
- CVE-2026-116861WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilitywpdesk Flexible Chat
- CVE-2026-116854WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerabilityAguila Technologies WP Customer Area
- CVE-2026-116853WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerabilityNexcess GiveWP