CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-13284IBM MQ Managed File Transfer is vulnerable to XML external entity injectionIBM MQ
- CVE-2026-13289IBM MQ Managed File Transfer is vulnerable to XML external entity injectionIBM MQ
- CVE-2026-13292IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerabilityIBM MQ
- CVE-2026-14252IBM MQ is affected by a pasword disclosure vulnerability in the runmqccred utilityIBM MQ
- CVE-2026-18142IBM MQ is affected by a denial of service vulnerabilityIBM MQ
- CVE-2026-122220WPO365 LOGIN before 45.2 SAML Replay Protection BypassWPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION
- CVE-2026-113368Nexus Repository 3 - Group Repository Member Authorization BypassSonatype Nexus Repository
- CVE-2026-113369Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations TabSonatype Nexus Repository
- CVE-2026-113370Nexus Repository 3 - SQL Injection in Reindex Search by Pattern TaskSonatype Nexus Repository
- CVE-2026-113371Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing PassphraseSonatype Nexus Repository
- CVE-2026-113372Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing KeySonatype Nexus Repository
- CVE-2026-113373Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In AgainSonatype Nexus Repository
- CVE-2026-113374Nexus Repository 3 - Privilege Escalation via Rut Auth Capability CreationSonatype Nexus Repository
- CVE-2026-122192Guest access to Firecracker process memory after a failed memory discardAWS firecracker
- CVE-2026-76806Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oraclesolidtime-io solidtime
- CVE-2026-97705Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parsermoleculerjs moleculer · moleculer
- CVE-2026-121933Linksys E5350 Setup Wizard apply.cgi save_settings missing authenticationLinksys E5350
- CVE-2026-115474Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permissionzulip
- CVE-2026-115574Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channelszulip
- CVE-2026-97701Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requestszulip
- CVE-2026-63183OmniAuth: Host Header Injection Vulnerabilityomniauth
- CVE-2026-113780ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundaryespressif esp-idf
- CVE-2026-113783ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responsesespressif esp-idf
- CVE-2026-107846bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction listbitcoinjs-lib
- CVE-2026-121932Linksys E5350 apply.cgi system os command injectionLinksys E5350
- CVE-2026-102345Zammad: Stored XSS in ticket article rendering in the new Vue-based interfacezammad
- CVE-2026-113782ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsingespressif esp-idf
- CVE-2026-121931Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injectionLinksys WRT54GL
- CVE-2026-82033DeepSeek Harness Unauthenticated RPC Command Executiondeepseek-ai deepseek-harness
- CVE-2026-121930Linksys WRT54GL Ping Diagnostic apply.cgi system os command injectionLinksys WRT54GL