CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119641Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownershipApache Software Foundation org.apache.oozie:oozie-main
- CVE-2026-119724Apache JClouds: XML External Entity (XXE) in provider-response parsingApache Software Foundation org.apache.jclouds:jclouds-core
- CVE-2026-89293Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tamperingEclipse Foundation Eclipse Mnestix
- CVE-2026-77777Improper access control vulnerabilityZohocorp ManageEngine Key Manager Plus
- CVE-2026-89292Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured InfrastructuresEclipse Foundation Eclipse Mnestix
- CVE-2026-118448Uninitialized output buffer returned after nd_to_text failure in pybddisasmBitdefender pybddisasm
- CVE-2026-118447Uninitialized INSTRUX contents returned after decoding failure in pybddisasmBitdefender pybddisasm
- CVE-2026-118446Use-after-free in INSTRUX array members in pybddisasmBitdefender pybddisasm
- CVE-2026-118445Use-after-free in INSTRUX structure members in pybddisasmBitdefender pybddisasm
- CVE-2026-118444Out-of-bounds reads during instruction decoding in pybddisasmBitdefender pybddisasm
- CVE-2026-109161Buffer Overflow in Digital I/OWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-105982Command Injection in IPsec VPNWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-105981Command Injection in Digital I/OWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-105980Command Injection in WireGuard VPNWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-105979Command Injection in ZeroTier VPNWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-105978Command Injection in Management Control FunctionsWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-121024Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNetAxxonSoft AxxonNet
- CVE-2026-121023LDAP Bind Password Exposure in AxxonNet ARP Agent LogsAxxonSoft AxxonNet ARP Agent
- CVE-2026-121022Default Administrator Password Change Not Enforced in Axxon One Web ClientAxxonSoft Axxon One
- CVE-2026-121021Plaintext Storage of LDAP Password in Axxon One Shared ConfigurationAxxonSoft Axxon One
- CVE-2026-92610Improper limitation of paths in py-aspect-model-loaderEclipse Foundation Eclipse Semantic Modeling Framework
- CVE-2026-121020User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration APIAxxonSoft Axxon One
- CVE-2026-113421ThreadX Modules invokes trace-full callbacks after module unloadEclipse Foundation Eclipse ThreadX
- CVE-2026-115231User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilegeEclipse Foundation Eclipse ThreadX
- CVE-2026-91075Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation BypassEupago Gateway For Woocommerce
- CVE-2026-103327CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook SecretCryptoCloud
- CVE-2026-4052Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)WSO2 API Manager · WSO2 API Control Plane +1
- CVE-2026-74846Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the…Catalyst-Plugin-Authentication
- CVE-2026-16900Authentication BypassZohocorp Log360 · Zohocorp EventLog Analyzer
- CVE-2026-103653Out-of-bounds read vulnerability in CoAP message parsing impacts Qt CoAPQt