CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-63121Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny ruleskubewarden policies
- CVE-2026-62277LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltrationhargata lubelog
- CVE-2026-63224OpenRemote has authenticated SQL injection in crosstab datapoint exportsopenremote · io.openremote:openremote-manager
- CVE-2026-63201netopeer2-server logging has format string vulnerability via subtree filterCESNET netopeer2
- CVE-2026-55614uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matchingopenwrt uhttpd
- CVE-2026-55612uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state resetopenwrt uhttpd
- CVE-2026-55613uhttpd: HTTP request smuggling via ubus POST body parse-error desyncopenwrt uhttpd
- CVE-2026-63184Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusionchristianhelle refitter
- CVE-2026-63182LightSAML: Signature reference wrapping permits unsigned assertion claimslitesaml lightsaml
- CVE-2026-62347Element Call exposes shared passwords in logselement-hq element-call
- CVE-2026-63115ActivityPub Undo handler can unfollow or remove reposts on behalf of other accountsTryGhost ActivityPub
- CVE-2026-55146LORIS has incorrect access checks in issue_trackeraces Loris
- CVE-2026-55147LORIS has incorrect access checks in API for Imaging Browseraces Loris
- CVE-2026-118938Fickling check_safety() bypass: dotted qualname in STACK_GLOBAL resolves a class-method attribute path that evades call analysistrailofbits fickling
- CVE-2026-111578PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note FieldsPDF Invoices & Packing Slips for WooCommerce
- CVE-2026-16760Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callablestrailofbits fickling
- CVE-2026-62991Shopper: customer detail IDOR exposes administrator and staff recordsshopperlabs shopper
- CVE-2026-62990Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creationshopperlabs shopper
- CVE-2026-62989Shopper: missing variant-delete authorization permits destructive single and bulk actionsshopperlabs shopper
- CVE-2026-59993Picotls has NULL pointer dereference during handshake, when running as a clienth2o picotls
- CVE-2026-62297ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)Agamnentzar ag-psd
- CVE-2026-62979jack: upstream error responses expose backend and peer credentialsroziscoding jack
- CVE-2026-62967ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUsersinamics ztnet
- CVE-2026-62966ESPAsyncWebServer multipart parser has null-pointer writeESP32Async ESPAsyncWebServer
- CVE-2026-62965SABnzbd: Orphan-job path traversal permits arbitrary file deletionsabnzbd
- CVE-2026-62958libriscv: Out of bounds read vuln in the ELF parser (Denial of service)libriscv
- CVE-2026-62968Dream Displays has command-line argument injection in yt-dlp invocationarsmotorin dreamdisplays
- CVE-2026-62860Picsou vulnerable to login timing attackZoeille picsou-finance
- CVE-2026-54610LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handlinglibredwg
- CVE-2026-62250LibreDWG: unbounded allocation in pre-R13 DWG entity decodinglibredwg