CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-121437Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiterslepture mistune
- CVE-2026-121436Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.phpfroxlor
- CVE-2026-121435Froxlor before 2.3.15 Authorization Bypass via Mysqls.add APIfroxlor
- CVE-2026-121434Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update APIfroxlor
- CVE-2026-121433AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media ExportAzuraCast
- CVE-2026-121432AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS PlaylistAzuraCast
- CVE-2026-121431AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook ConnectorsAzuraCast
- CVE-2026-121430AzuraCast before 0.24.0 Missing Authorization via Station Waveform EndpointsAzuraCast
- CVE-2026-121429AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()AzuraCast
- CVE-2026-121428AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in TimezoneAzuraCast
- CVE-2026-121427AzuraCast through 0.23.8 Config Injection via frontend_config.custom_configAzuraCast
- CVE-2026-121426Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparsernodemailer
- CVE-2026-121425Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsingnodemailer
- CVE-2026-121424Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Commentsnodemailer
- CVE-2026-121423SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serializationsurrealdb
- CVE-2026-121422SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypasssurrealdb
- CVE-2026-121421SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypasssurrealdb
- CVE-2026-121420SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addressessurrealdb
- CVE-2026-121419SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collisionsurrealdb
- CVE-2026-121418SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Plannersurrealdb
- CVE-2026-121417SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backendssurrealdb
- CVE-2026-121416SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocationssurrealdb
- CVE-2026-121415Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Keyparse-community parse-server
- CVE-2026-121414Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Updateparse-community parse-server
- CVE-2026-121413Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSessionparse-community parse-server
- CVE-2026-121412FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC ReassemblyFreeRDP
- CVE-2026-121411FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output GeometryFreeRDP
- CVE-2026-121410FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2FreeRDP
- CVE-2026-121409FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing TokenFreeRDP
- CVE-2026-121408FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control ChannelFreeRDP