CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-122329SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoderlibsdl-org SDL_mixer
- CVE-2026-122328SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoderlibsdl-org SDL_mixer
- CVE-2026-122327Meelo through 3.13.1 Missing Authorization on Song, Track and Video EndpointsArthi-chaud Meelo
- CVE-2026-122326Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contentsChevereto
- CVE-2026-122325eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation APIfossasia eventyay-exhibition
- CVE-2026-122324SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetailsoss-apps SplitPro
- CVE-2026-122317SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Queryoss-apps SplitPro
- CVE-2026-115738SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL…Trellix DLP on-prem extensions
- CVE-2026-119744Cendio ThinLinc Improper Authentication via Web AccessCendio ThinLinc
- CVE-2026-123032OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authenticationOpenBMB Internet of Agents
- CVE-2026-66903Apache OFBiz: Authenticated Path Traversal in Catalog Image ManagementApache Software Foundation Apache OFBiz
- CVE-2026-71901Apache OFBiz: Dispatch arbitrary internal services on SFA componentApache Software Foundation Apache OFBiz
- CVE-2026-68524Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition LoadingApache Software Foundation Apache OFBiz
- CVE-2026-64860espressif/mdns has Uncontrolled Recursion in mDNS Name Decompressionespressif esp-protocols
- CVE-2026-73577Apache OFBiz: Unauthenticated path-suffix view authorization bypassApache Software Foundation Apache OFBiz
- CVE-2026-73578Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impactApache Software Foundation Apache OFBiz
- CVE-2026-73580Apache OFBiz: Unauthenticated HR organization and employee disclosureApache Software Foundation Apache OFBiz
- CVE-2026-74841Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant modeApache Software Foundation Apache OFBiz
- CVE-2026-76150Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImageApache Software Foundation Apache OFBiz
- CVE-2026-81734Apache OFBiz: Missing authorization - catalog quick-admin product writesApache Software Foundation Apache OFBiz
- CVE-2026-76152Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate servicesApache Software Foundation Apache OFBiz
- CVE-2026-81744Apache OFBiz: Authorization bypass - self-grant content OWNERApache Software Foundation Apache OFBiz
- CVE-2026-81808Apache OFBiz: Missing authorization - search-result bulk catalog mutationApache Software Foundation Apache OFBiz
- CVE-2026-81815Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDBApache Software Foundation Apache OFBiz
- CVE-2026-81816Apache OFBiz: XML external entity injection (XXE)Apache Software Foundation Apache OFBiz
- CVE-2026-81828Apache OFBiz: Server-side request forgery in SurveyWrapperApache Software Foundation Apache OFBiz
- CVE-2026-82894Apache OFBiz: Content renderer runs a service name stored on the rowApache Software Foundation Apache OFBiz
- CVE-2026-82902Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafileApache Software Foundation Apache OFBiz
- CVE-2026-82904Apache OFBiz: Unbounded multi-form row count from a parameter nameApache Software Foundation Apache OFBiz
- CVE-2026-82907Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundApache Software Foundation Apache OFBiz