CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-120416AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgeryAndyFactory newspaper4k
- CVE-2026-111048FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notesFOSSBilling
- CVE-2026-119085Template injection in the publishing component of awslabs Virtual Engineering WorkbenchAWS virtual-engineering-workbench
- CVE-2026-120630CVE-2026-120630CrewAI
- CVE-2024-12139Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering AttacksWSO2 API Manager · WSO2 Identity Server
- CVE-2026-120627CVE-2026-120627Private Internet Access Firefox extension
- CVE-2026-120596CVE-2026-120596Ethernut / egnite Nut/Net TCP/IP Stack
- CVE-2026-65059Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responsesFurl
- CVE-2026-105769kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostschainguard kaniko · github.com/chainguard-dev/kaniko
- CVE-2026-88811Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxySUSE Rancher
- CVE-2026-119301Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandasaws-sdk-pandas
- CVE-2026-88810Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRulesSUSE Rancher
- CVE-2026-99242ntfs: fix race between fallocate and mmap readsLinux
- CVE-2026-99241ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()Linux
- CVE-2026-99240mm/damon/core: error damos_commit_quota_goal() for zero target_valueLinux
- CVE-2026-99239Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has connLinux
- CVE-2026-99238tracing: Hold trace_types_lock when updating modules in persistent instancesLinux
- CVE-2026-99237tracing: Hold trace_types_lock when resetting last boot data from readersLinux
- CVE-2026-99236tracing: Reject incomplete event filter expressionsLinux
- CVE-2026-99235tracing: Save the event file instead of the compatible histogramLinux
- CVE-2026-99234tracing: Unregister field variable histograms when the command failsLinux
- CVE-2026-99233tracing/histograms: Verify event_call identity when updating synth_event refcountLinux
- CVE-2026-99232tracing/syscalls: Use copy_from_user for the faultable syscall bufferLinux
- CVE-2026-99231io_uring/waitid: own the request before clearing ->headLinux
- CVE-2026-99230io_uring/cmd: don't leave list poison in ->hash_nodeLinux
- CVE-2026-99229io_uring/wait: don't spin on a stuck overflow listLinux
- CVE-2026-99228io_uring/io-wq: don't lose the signal that ends workLinux
- CVE-2026-99227io_uring/waitid: prevent cancel reference wrapLinux
- CVE-2026-99226keys: Avoid the owner account dereference in named keyring lookupLinux
- CVE-2026-99225keys: Check the authorization payload in process keyring searchesLinux