CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-117068An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker…
- CVE-2026-117069An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker…
- CVE-2026-117082An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU…
- CVE-2026-117127Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the action_serve…
- CVE-2026-120278WAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authenticationWAVLINK WN536AX6-A
- CVE-2026-120277WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injectionWAVLINK WN536AX6-A
- CVE-2026-120276WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injectionWAVLINK WN536AX6-A
- CVE-2026-120275Shanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injectionShanghai Xi Yu Ji Zhi Technology Minimax Code
- CVE-2026-111089Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-95863Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-87718Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegatesApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-84231Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-84177Apache Wicket: A component's markup is served as a package resource when its class name contains an underscoreApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-84172Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loaderApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-84170Apache Wicket: Configured upload limits are not enforced by the standalone file upload resourceApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-83594Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-83559Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-83539Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model dataApache Software Foundation org.apache.wicket:wicket-extensi…
- CVE-2026-82956Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-82898Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs inApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-82840Apache Wicket: The session id is renewed only on the first sign in, not on re-authenticationApache Software Foundation org.apache.wicket:wicket-auth-ro…
- CVE-2026-82705Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a componentApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-82704Apache Wicket: A listener is invoked on a page instance the request itself created and never configuredApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-82559Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationApache Software Foundation org.apache.wicket:wicket-native-…
- CVE-2026-82558Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invokeApache Software Foundation org.apache.wicket:wicket-native-…
- CVE-2026-82557Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submissionApache Software Foundation org.apache.wicket:wicket-core
- CVE-2026-82115Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResourceApache Software Foundation org.apache.wicket:wicket-native-…
- CVE-2026-120274beecue FastBee Groovy Script Executor script code injectionbeecue FastBee
- CVE-2026-120242Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scriptingRuijie RG-ES205GC · Ruijie RG-ES206GC-P +3
- CVE-2026-120241Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflowRuijie RG-ES205GC · Ruijie RG-ES206GC-P +3