CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-62254LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsinglibredwg
- CVE-2026-62864Ring's nested-params middleware has inefficient regular expression complexityring-clojure ring
- CVE-2026-62863MoLing: unauthenticated SSE and wildcard CORS expose tool sessionsgojue moling
- CVE-2026-119343Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file readStirling-Tools Stirling-PDF
- CVE-2026-40573NovumOS: Nova Interpreter Privilege EscalationMinecAnton209 NovumOS
- CVE-2026-62849ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injectionmqttsnet thinglinks
- CVE-2026-119342Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypassStirling-Tools Stirling-PDF
- CVE-2026-62853ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinksmqttsnet thinglinks
- CVE-2026-117645Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1phoenixframework phoenix_html · phoenix_html
- CVE-2026-119341Tesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructortesseract-ocr tesseract
- CVE-2026-62847Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)Metalama · Metalama.Framework +1
- CVE-2026-119340Tesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensionstesseract-ocr tesseract
- CVE-2026-117666ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundarydeadtrickster ssl_verify_fun · ssl_verify_fun
- CVE-2026-62848Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code executionMetalama · Metalama.Framework
- CVE-2026-62300Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resourcesfilecoin-project filecoin-pin · filecoin-pin
- CVE-2026-119339Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT`…tesseract-ocr tesseract
- CVE-2026-58412Filecoin Pin: Fork bypass in the privileged GitHub Actions workflowfilecoin-project filecoin-pin
- CVE-2026-119338Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pagestesseract-ocr tesseract
- CVE-2026-119337RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorizationinfiniflow ragflow
- CVE-2026-55098Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735Basekick-Labs arc · github.com/basekick-labs/arc
- CVE-2026-62333OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory rootsopenvm-org openvm
- CVE-2026-62334OpenVM's OpenVmHalo2Verifier self-call can bypass proof verificationopenvm-org openvm
- CVE-2026-119336Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlinkpi-hole
- CVE-2026-119335Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypasspi-hole
- CVE-2026-62335OpenVM's OpenVmHalo2Verifier accepts non-canonical app commitmentsopenvm-org openvm
- CVE-2026-119334Pi-hole: file:// adlist read check and curl can resolve different filespi-hole
- CVE-2026-62337SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elementsaxiom-crypto snark-verifier
- CVE-2026-119333draw.io Desktop allows Windows executable search-path hijackingjgraph drawio-desktop
- CVE-2026-61618SNARK Verifier: noncanonical accumulator limb decodingaxiom-crypto snark-verifier
- CVE-2026-119332Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()LadybirdBrowser ladybird