CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-111464WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Responseemrevona WP Fastest Cache – WordPress Cache Plugin
- CVE-2026-120831Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of serviceRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-76955A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based…Zyxel NWA110AX firmware
- CVE-2026-107441An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an…Zyxel GS1900-24E firmware · Zyxel GS1900-8 firmware +8
- CVE-2026-105770Octo STS discloses trust policy contents to unauthorized callers via Exchange error messagesgithub.com/octo-sts/app
- CVE-2026-120833labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-DispatchNIST labbench
- CVE-2026-120830Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosureRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-106991hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control.
- CVE-2026-38595An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted…
- CVE-2026-38600A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via…
- CVE-2026-38601A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect…
- CVE-2026-71450Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows…Johnson Controls EasyIO Neo EC and CW Edge Controller
- CVE-2026-120597Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scriptingWelcart e-Commerce Plugin
- CVE-2026-120752PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() CalloutPyMuPDF
- CVE-2026-120740Hivex: hivex: denial of service via out-of-bounds read in big-data block processingRed Hat Enterprise Linux
- CVE-2026-115215NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams…Eclipse Foundation Eclipse ThreadX
- CVE-2026-115403NULL pointer dereference in the BSD raw IPv6 send path when the destination table is fullEclipse Foundation Eclipse ThreadX
- CVE-2026-116635Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Serveraws-serverless-mcp-server
- CVE-2026-86596s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameterclavaque s2Member – Excellent for All Kinds of Memberships,…
- CVE-2026-120091Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the…Temporal Technologies go.temporal.io/server
- CVE-2026-105476Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate…WebPros cPanel
- CVE-2026-105475Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.WebPros cPanel
- CVE-2026-116958Konflux-ci: unquoted variable expansion in shell command executionkonflux-ci
- CVE-2026-58873In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check.Google Android XR
- CVE-2026-120503EchoHS GeekezBrowser Public API status information disclosureEchoHS GeekezBrowser
- CVE-2026-116768Missing length validation in Absolute Secure AccessAbsolute Software Secure Access
- CVE-2026-58977In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check.Google Android
- CVE-2026-29508ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF ParserReadyMedia
- CVE-2026-116767Improper input handling in Secure Access serversAbsolute Software Secure Access
- CVE-2026-58930An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a…Google Android