CVEs
Browse the synced catalog, newest first.
- CVE-2026-63644bird-lg-go: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') and Exposure of Sensitive Information to an…xddxdd bird-lg-go
- CVE-2026-123819Wagtail: Improper permission handling when copying snippetswagtail
- CVE-2026-123818LMDeploy URL parser disagreement permits SSRF filter bypassInternLM lmdeploy · lmdeploy
- CVE-2026-123817AIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny readsaio-libs aiohttp
- CVE-2026-115864Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memoryMonoceros
- CVE-2026-123816pyLoad: Authentication bypass in API key validation (check_apikey cache)pyload · pyload-ng
- CVE-2026-123815pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)pyload · pyload-ng
- CVE-2026-123814pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification hostpyload · pyload-ng
- CVE-2026-123813pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's sessionpyload · pyload-ng
- CVE-2026-124033Relative path traversal in the log export commands in AWS ParallelCluster CLIaws-parallelcluster
- CVE-2026-123812Dynatrace MCP Server: create_dynatrace_notebook missing the human-approval gatedynatrace-oss dynatrace-mcp · @dynatrace-oss/dynatrace-mcp-…
- CVE-2026-123811Dynatrace MCP Server: Unauthenticated HTTP MCP Tool Invocation in `@dynatrace-oss/dynatrace-mcp-server`dynatrace-oss dynatrace-mcp
- CVE-2026-63634pympp: Gas Draining with paddingtempoxyz pympp
- CVE-2026-123810Dynatrace MCP Server: DQL injection via parameters not documented as DQLdynatrace-oss dynatrace-mcp · @dynatrace-oss/dynatrace-mcp-…
- CVE-2026-63496augment-vir: Shell Command Injection in `grep()` via Unsanitized `searchPattern`electrovir augment-vir
- CVE-2026-123809Dynatrace MCP Server: Workflow template injection via create_workflow_for_notificationdynatrace-oss dynatrace-mcp · @dynatrace-oss/dynatrace-mcp-…
- CVE-2026-63497titra: residual mass assignment via customfields in timeentry/create and project/task/createtitraio titra
- CVE-2026-124994Turboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram_dequant out-of-boundsTurboderp-org ExLlamaV3
- CVE-2026-123808Nuxt UI: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydrationnuxt ui · @nuxt/ui
- CVE-2026-123807Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and…signalk-server · @signalk resources-provider +1
- CVE-2026-122056Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-serviceRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-124992nushell Data Conversion ser.rs escape_bytes control sequencenushell
- CVE-2026-119759TrailBase 0.28.2 < 0.35.10 IDOR via Record API File Columntrailbaseio trailbase
- CVE-2026-113971This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS
- CVE-2026-113970A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-113969A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-113968A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-113965This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-113964A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-113963An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple visionOS +1