CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-123023agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorizationagentscope-ai AgentScope
- CVE-2026-117691Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter namesRed Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-107912Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flawRed Hat Exploit Intelligence · Red Hat OpenShift Serverl… +8
- CVE-2026-123022agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injectionagentscope-ai AgentScope
- CVE-2026-105321SQL Injection in Kobikom Telecommunications' KobikomKobikom Telecommunications and Informatics Services Kobikom
- CVE-2026-123059Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEclipse Foundation Eclipse BaSyx Helm Charts
- CVE-2026-104720Path Traversal in Kobikom Telecommunications' KobikomKobikom Telecommunications and Informatics Services Kobikom
- CVE-2026-123119Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports…sensiolabs symfony/http-client
- CVE-2026-123020eosphoros-ai DB-GPT Jinja2 Template init.py FileBasedSkill.get_prompt special elements in template engineeosphoros-ai DB-GPT
- CVE-2026-103866Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smugglingApache Software Foundation Apache Sling Engine
- CVE-2026-103864Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralizationApache Software Foundation Apache Sling Engine
- CVE-2026-103863Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper pathsApache Software Foundation Apache Sling Engine
- CVE-2026-95652Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatterTÜBİTAK BİLGEM Software Technologies Research Institute par…
- CVE-2026-123047Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEclipse Foundation Eclipse BaSyx Helm Charts
- CVE-2026-123019eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphereeosphoros-ai DB-GPT
- RUSTSEC-2026-0449`ocipkg` is unmaintainedocipkg
- RUSTSEC-2026-0462Unbounded response body buffering in Streamable HTTP clientsrmcp
- CVE-2026-121489Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryApache Software Foundation org.apache.juneau:juneau-microse…
- CVE-2026-96677Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromeApache Software Foundation org.apache.juneau:juneau-marshall
- CVE-2026-73117Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataApache Software Foundation org.apache.juneau:juneau-rest-se…
- CVE-2026-73116Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirectsApache Software Foundation org.apache.juneau:juneau-rest-cl…
- CVE-2026-73101Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsApache Software Foundation org.apache.juneau:juneau-rest-se…
- CVE-2026-73100Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsApache Software Foundation org.apache.juneau:juneau-rest-se…
- CVE-2026-73099Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body overrideApache Software Foundation org.apache.juneau:juneau-rest-se…
- CVE-2026-73098Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingApache Software Foundation org.apache.juneau:juneau-marshall
- CVE-2026-73095Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingApache Software Foundation org.apache.juneau:juneau-marshal…
- CVE-2026-123018eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injectioneosphoros-ai DB-GPT
- CVE-2026-123036A flaw was found in ansible-core.Red Hat ansible-core
- CVE-2026-118869An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on…SHIRASAGI Project SHIRASAGI
- CVE-2026-117679A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a…SHIRASAGI Project SHIRASAGI