CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-120240WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injectionWAVLINK WN553X1-B
- CVE-2026-120239WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injectionWAVLINK WN553X1-B
- CVE-2026-120238WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injectionWAVLINK WN553X1-B
- CVE-2026-120237ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumptionag-ui-protocol ag-ui
- CVE-2026-120236ag-ui-protocol ag-ui Transport Decoder input validationag-ui-protocol ag-ui
- CVE-2026-74760Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login…Google-Auth
- CVE-2026-74759Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account…Google-Auth
- CVE-2026-120235ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumptionag-ui-protocol ag-ui
- CVE-2026-66570WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityNickboss WordPress File Upload
- CVE-2026-119480WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerabilityCrocoblock JetFormBuilder
- CVE-2026-62048WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerabilityLiquid Web / StellarWP BookIt
- CVE-2026-120234ag-ui-protocol ag-ui HTTP Transport e.text resource consumptionag-ui-protocol ag-ui
- CVE-2026-120338Prefab UI Pyodide sandbox escape to host RCEPrefectHQ prefab-ui
- CVE-2026-120233ag-ui-protocol ag-ui HttpAgent http.ts information disclosureag-ui-protocol ag-ui
- CVE-2026-120232Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruptionHorizon DataSys Reboot Restore Standard
- CVE-2026-120231WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injectionWAVLINK WN553X1-B
- CVE-2026-120230WAVLINK WN701AE ioos Web Backend del_vlan_group os command injectionWAVLINK WN701AE
- CVE-2026-120229WAVLINK WN553X1-B ioos sub_416B50 os command injectionWAVLINK WN553X1-B
- CVE-2026-120228WAVLINK WN553X1-B ioos Service sub_416D88 os command injectionWAVLINK WN553X1-B
- CVE-2026-117680jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and notlud jsv · jsv
- CVE-2026-120308Beta9 host filesystem exposure via volume path traversalbeam-cloud Beta9 gateway · beam-cloud Beta9 worker
- CVE-2026-120307Beta9 container escape via unvalidated sandbox file pathsbeam-cloud Beta9 worker
- CVE-2026-120306Beta9 build sandbox escape via chroot-only isolationbeam-cloud Beta9 worker
- CVE-2026-120227WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injectionWAVLINK WN701AE
- RUSTSEC-2026-0430Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)rio-vt
- RUSTSEC-2026-0431Unbounded memory allocation in `evtx` parsing a `.wevtcache` fileevtx
- CVE-2026-120226Hangzhou Xiongmai Technology P2PAPI.dll P2P SDK P2PAPI_Connect buffer overflowHangzhou Xiongmai Technology P2PAPI.dll
- CVE-2026-13575HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHIhttp-session
- CVE-2026-120225Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversalOray Pugongying X5 Pro
- CVE-2026-120224Oray Pugongying X5 Pro API Authorization run_async_task improper authorizationOray Pugongying X5 Pro