CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-120492Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urlsChainlit
- CVE-2026-120491Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity PageWing FTP Software Wing FTP Server
- CVE-2026-120489Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached DraftOutline
- CVE-2026-120488LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block ContentLaraDashboard
- CVE-2026-120487LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core UpgradesLaraDashboard
- CVE-2026-120461Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batchdromara Jpom
- CVE-2026-120460Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllersdromara Jpom
- CVE-2026-120459python-jose through 3.5.0 Authentication Bypass via Empty HMAC Keympdavis python-jose
- CVE-2026-120458Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header ParserUltra Video Group Kvazaar
- CVE-2026-120457libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension DecoderDeutsches Klimarechenzentrum libaec
- CVE-2026-120456L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url BoxesL-SMASH
- CVE-2026-120455rapidyaml through 0.16.0 Out-of-Bounds Write via ParseEngine::_add_annotation()biojppm rapidyaml
- CVE-2026-120454The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN DecompressionThe Sleuth Kit
- CVE-2026-120453The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs HeaderThe Sleuth Kit
- CVE-2026-120452libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversionlibgphoto2
- CVE-2026-120451libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driverlibgphoto2
- CVE-2026-120450LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email ToolLaraDashboard
- CVE-2026-120449Outline before 1.12.0 Improper Access Control via Public Document SharesOutline
- CVE-2026-120448DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpointdoramart DoraCMS
- CVE-2026-120447HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Codebufanyun HotGo
- CVE-2026-120446madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management APImadong-code madong-admin-saas
- CVE-2026-120445madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddlewaremadong-code madong-admin-saas
- CVE-2026-120444GoFound through 1.4.1 Path Traversal via database parameter in /api/db/dropsea-team GoFound
- CVE-2026-120443GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Resultssea-team GoFound
- CVE-2026-120442ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypassxianhc ape-volo-admin
- CVE-2026-120441OwnTone Server through 29.3 SQL Injection via MPD sticker find CommandOwnTone Server
- CVE-2026-120440QuickJS-NG before 0.16.0 Memory Leak via Atomics.storeQuickJS-NG
- CVE-2026-120439QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sortQuickJS-NG
- CVE-2026-120438QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys EnumerationQuickJS-NG
- CVE-2026-120437Netpbm before 10.86.51, 11.02.30, and 11.15.08 Out-of-Bounds Read via tgatoppmNetpbm