CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-54378VitaFit Cloud API Broken Access Control via S3 Token EndpointShenzhen Shine Industrial Co. VitaFit
- CVE-2026-54377VitaFit Cloud API IDOR via profile_id EndpointsShenzhen Shine Industrial Co. VitaFit
- CVE-2026-63655tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoStsparticles · @tsparticles mcp-server +1
- CVE-2026-54376VitaFit Android < 2.8.1.0 Custom URI Scheme Token HijackingShenzhen Shine Industrial Co. VitaFit
- CVE-2026-122020NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of serviceNST Labs Tech Nstbrowser
- CVE-2026-102280Sandboxie-Plus: Sandbox containment bypasssandboxie-plus Sandboxie
- CVE-2026-54375VitaFit Android < 2.8.1.0 Long-Lived Session Token ExposureShenzhen Shine Industrial Co. VitaFit
- CVE-2026-54374VitaFit Android < 2.8.1.0 Hardcoded Credentials DisclosureShenzhen Shine Industrial Co. VitaFit
- CVE-2026-54373VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security ConfigShenzhen Shine Industrial Co. VitaFit
- CVE-2026-54372VitaFit Android < 2.8.1.0 Insecure TLS Certificate ValidationShenzhen Shine Industrial Co. VitaFit
- CVE-2026-57562Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the callerreadest
- CVE-2026-57565Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)readest
- CVE-2026-1220196amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization6amTech 6valley
- CVE-2026-57566Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxyreadest
- CVE-2026-122266Improper isolation of shared resources in aws-network-policy-agent in Amazon EKSaws-network-policy-agent · AWS amazon-vpc-cni-k8s
- CVE-2026-57567Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webviewreadest
- CVE-2026-115473Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)cesanta mongoose
- CVE-2026-55367h2o: heap exhaustion using capsulesh2o
- CVE-2026-55368h2o: buffer overflow when using the %{error}x log directiveh2o
- CVE-2026-103002GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeovergpustack
- CVE-2026-121746nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can writenvm-sh nvm
- CVE-2026-58128Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivityAlan Health Alan: Health Insurance
- CVE-2026-121749nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local filesnvm-sh nvm
- CVE-2026-121747nvm prints the contents of any readable file through a symlinked .nvmrcnvm-sh nvm
- CVE-2026-122016yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges managementyangzongzhuan RuoYi-Vue
- CVE-2026-121748nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writablenvm-sh nvm
- CVE-2026-121750nvm install --offline installs a cached tarball that previously failed checksum verificationnvm-sh nvm
- CVE-2026-121745nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command linenvm-sh nvm
- CVE-2026-121751nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliasesnvm-sh nvm
- CVE-2026-102894GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeovergpustack