CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-121544Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlerskoodo-reader
- CVE-2026-121543smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalationa466350665 smart-sso
- CVE-2026-121455DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/savedbgate
- CVE-2026-121454Padloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requestspadloc
- CVE-2026-121453SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpointdataease SQLBot
- CVE-2026-121452bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Servicemlogclub bbs-go
- CVE-2026-121451AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRFamir1376 ab-download-manager
- CVE-2026-121450CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUIDPAICNI CFNext
- CVE-2026-118488Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis clientEclipse Foundation Eclipse Vert.x
- CVE-2026-100493An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an…AMD Compressionator SDK
- CVE-2026-40652An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted…AMD Compressionator SDK
- CVE-2026-40661An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially…AMD Compressionator SDK
- CVE-2026-40660A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read…AMD Compressionator SDK
- CVE-2026-40659An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted…AMD Compressionator SDK
- CVE-2026-43603A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of service.AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +38
- CVE-2026-110265runZero search SQL injectionrunZero Platform
- CVE-2026-118489CachingWebClient shares user-specific HTTP responses across users via the shared cache tierEclipse Foundation Eclipse Vert.x
- CVE-2026-118527Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to…Ivanti Connect Secure
- CVE-2026-121449Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack WebhookFinsys dockhand
- CVE-2026-121448Dockhand before 1.0.54 Path Traversal via Stack Environment RoutesFinsys dockhand
- CVE-2026-121447svg-sanitizer before 1.1.0 XSS via animateTransform on Safaridarylldoyle svg-sanitizer
- CVE-2026-121446svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributesdarylldoyle svg-sanitizer
- CVE-2026-121445svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Strippingdarylldoyle svg-sanitizer
- CVE-2026-121444svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graphdarylldoyle svg-sanitizer
- CVE-2026-121443svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tagdarylldoyle svg-sanitizer
- CVE-2026-121442Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances APIfrappe hrms
- CVE-2026-121441Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smugglingbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-121440Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypassbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-121439Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-httpbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-121438Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsinglepture mistune