CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116472ingress-nginx mirror-target self-DOSKubernetes ingress-nginx · SUSE Rancher Prime RKE2 ingress-…
- CVE-2026-63217SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data ExfiltrationSuiteCRM
- CVE-2026-94395Stack-based buffer overflow in SafeNet Authentication Client SIS token engineThalesgroup Safenet Authentication Client SIS token engine
- CVE-2026-63214SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest apiSuiteCRM
- CVE-2026-63218SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPageSuiteCRM
- CVE-2026-61651SuiteCRM: Authenticated SQL Injection in get_end_date function in Project ControllerSuiteCRM
- CVE-2026-63111SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cronSuiteCRM
- CVE-2026-115451Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15…tassos.gr Advanced Custom Fields extension for Joomla · tas…
- CVE-2026-118494Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9jreviews.com JReviews component for Joomla
- CVE-2026-107129Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0balbooa.com Gridbox extension for Joomla
- CVE-2026-107130Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0balbooa.com Gridbox extension for Joomla
- CVE-2026-107903Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0balbooa.com Gridbox extension for Joomla
- CVE-2026-105607Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0balbooa.com Gridbox extension for Joomla
- CVE-2026-115452Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9…tassos.gr Advanced Custom Fields extension for Joomla · tas…
- CVE-2026-121949Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypasssensiolabs symfony/html-sanitizer
- CVE-2026-123184Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository WritesAltium
- CVE-2026-107359Malformed Wi-Fi Beacon Causes Crash on WF200Silicon Labs WF200 FW
- CVE-2026-112110Privileged file deletion in SafeNet Authentication Client SACSrvThalesgroup Safenet Authentication Client Service
- CVE-2026-102927HedgeDoc: Missing validation of incoming permission values on changehedgedoc
- CVE-2026-54912WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatchbytecodealliance wasm-micro-runtime
- CVE-2026-54913WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guestbytecodealliance wasm-micro-runtime
- CVE-2026-54914WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Bufferbytecodealliance wasm-micro-runtime
- CVE-2026-77439Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpointsimmich-app immich
- CVE-2026-112109Local privilege escalation in SafeNet Authentication Client SACSrvThalesgroup Safenet Authentication Client Service
- CVE-2026-97847Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain…Red Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-97175Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeoverRed Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-97174Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokensRed Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-96453Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificatesRed Hat build of Keycloak · Red Hat AMQ Broker +4
- CVE-2026-93998Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuerRed Hat build of Keycloak · Red Hat AMQ Broker +4
- CVE-2026-92857Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed…Red Hat build of Keycloak · Red Hat Single Sign-On