CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-61620HoneySQL unchecked entity names can lead to SQL injection resultsseancorfield honeysql
- CVE-2026-119331Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutationLadybirdBrowser ladybird
- CVE-2026-116252pgAdmin 4: Materialized view refresh redirects its connection through a crafted database namepgadmin.org pgAdmin
- CVE-2026-116251pgAdmin 4: A user's other sessions survive a change of their passwordpgadmin.org pgAdmin
- CVE-2026-116250pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment checkpgadmin.org pgAdmin
- CVE-2026-116249pgAdmin 4: Connection file paths and parameter keys escape the user's storage directorypgadmin.org pgAdmin
- CVE-2026-116248pgAdmin 4: Non-administrators can share a server with every userpgadmin.org pgAdmin
- CVE-2026-116247pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificatepgadmin.org pgAdmin
- CVE-2026-116246pgAdmin 4: Server passwords are left in pgAdmin's process environmentpgadmin.org pgAdmin
- CVE-2026-116245pgAdmin 4: Connection services are not restricted in server modepgadmin.org pgAdmin
- CVE-2026-116244pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentialspgadmin.org pgAdmin
- CVE-2026-116243pgAdmin 4: Utility binary path can point at a shared storage directorypgadmin.org pgAdmin
- CVE-2026-116242pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identitypgadmin.org pgAdmin
- CVE-2026-116241pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifierpgadmin.org pgAdmin
- CVE-2026-116240pgAdmin 4: File Manager and storage-path tools act on a different path from the one checkedpgadmin.org pgAdmin
- CVE-2026-116239pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernamepgadmin.org pgAdmin
- CVE-2026-116238pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checkspgadmin.org pgAdmin
- CVE-2026-61694go-xrpl: ParseMPTAmountBinary: positive MPT amount silently decoded as negative (int64 wrap)LeJamon go-xrpl
- CVE-2026-119330Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink APIimmich-app immich
- CVE-2026-119329Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markersimmich-app immich
- CVE-2026-119328Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning serviceimmich-app immich
- CVE-2026-115829Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute ForceDelinea Secret Server
- CVE-2026-115830Secret Server JWT issuance errorDelinea Secret Server
- CVE-2026-115828Secret Server device validation errorDelinea Secret Server
- CVE-2026-61850Kargo: Privilege escalation via Project RBAC management in the Kargo APIakuity kargo
- CVE-2026-55598PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)madeofpendletonwool PinePods
- CVE-2026-62302MyTube: Unauthenticated Media Access via Static Routes Bypassing Loginfranklioxygen MyTube
- CVE-2026-62301MyTube: Visitor Can Access Hidden Video Metadata and Contentfranklioxygen MyTube
- CVE-2026-55493HotCRP: comment-author search exposes anonymous commenter identitieskohler hotcrp
- CVE-2026-62284OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxyosac-project osac-operator · github.com/osac-project/osac-o…