CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-106715NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check.
- CVE-2026-106716ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView…
- CVE-2026-122051Edimax BR-6208AC mp command injectionEdimax BR-6208AC
- CVE-2026-122050Campcodes Complete Sales and Inventory System with Credit Management login.php sql injectionCampcodes Complete Sales and Inventory System with Credit M…
- CVE-2026-122049Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authenticationCampcodes Bitcoin Wallet System
- CVE-2026-122048Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injectionCampcodes Division Regional Athletic Meet Game Result Matri…
- CVE-2026-122299Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretationjelmer dulwich
- CVE-2026-102337Webmin: SSRF exploit in Upload and Download and File Manager moduleswebmin
- CVE-2026-77372VeraCrypt: Heap overflow and out-of-bounds read in Serializable deserialization (elevated Core service input path)VeraCrypt
- CVE-2026-97702Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforceopenedx-platform
- CVE-2026-62365Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XMLwazuh
- CVE-2026-122047Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted uploadCampcodes Complete Advance Loan Management System
- CVE-2026-115770Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofingpocket-id · github.com/pocket-id/pocket-id/backend
- CVE-2026-122038krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injectionkrupalshah EmployeeRecruitmentSystem
- CVE-2026-62662Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiencespocket-id · github.com/pocket-id/pocket-id/backend
- CVE-2026-108387radare2: Remote code execution when loading Pebble/SMD binaryradareorg radare2
- CVE-2026-53631GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feedsglpi-project glpi
- CVE-2026-47678GLPI: Blind Time based SQLI in dropdownsglpi-project glpi
- CVE-2026-54384VitaFit Cloud API Authentication Bypass via POST /front/login/sns/Shenzhen Shine Industrial Co. VitaFit
- CVE-2026-52848GLPI: MFA bypassglpi-project glpi
- CVE-2026-54383VitaFit Cloud API Excessive Data Exposure via relation/search EndpointShenzhen Shine Industrial Co. VitaFit
- CVE-2026-57152GLPI: Unallowed notifications sendingglpi-project glpi
- CVE-2026-54382VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 AccessShenzhen Shine Industrial Co. VitaFit
- CVE-2026-86041ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` headermayswind ezbookkeeping · github.com/mayswind/ezbookkeeping
- CVE-2026-122028NST Labs Tech Nstbrowser Local Agent API info information disclosureNST Labs Tech Nstbrowser
- CVE-2026-54381VitaFit Cloud API Storage Bucket Unauthenticated Access Information DisclosureShenzhen Shine Industrial Co. VitaFit
- CVE-2026-76892tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processtsparticles · @tsparticles mcp-server +1
- CVE-2026-76826tsParticles: Generated release notes can execute shell commands in the stable publish workflowtsparticles
- CVE-2026-54380VitaFit Cloud API Stored XSS via SVG File UploadShenzhen Shine Industrial Co. VitaFit
- CVE-2026-76893tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientstsparticles · @tsparticles mcp-server +1