CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-121578CVE-2026-121578Amidaware Tactical RMM
- CVE-2026-120756Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserializeThe HDF Group HDF5
- CVE-2026-121260Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injectionZiroom ZHOME A0101
- CVE-2026-120755Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip FilterThe HDF Group Szip Filter
- CVE-2026-118487Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParserEclipse Foundation Eclipse Vert.x
- CVE-2026-119741rsync < 3.5.2 Denial of Service via hash_search() Checksum CollisionsRsyncProject rsync
- CVE-2026-121564Silent loss of messages when merging overlapping chat exports in whatstklucasrodes whatstk
- CVE-2026-120754Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset FilterThe HDF Group Scale-Offset Filter
- CVE-2026-97350Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for WindowsSecurepoint SSL VPN Client
- CVE-2026-65108NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with…NVIDIA Slurm
- CVE-2026-65107NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write…NVIDIA Slurm
- CVE-2026-73328Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/volmarg personal-management-system
- CVE-2026-121562CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams EndpointCTFd
- CVE-2026-121561Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export DownloadsHumanSignal label-studio · HumanSignal label-studio-sdk
- CVE-2026-121560LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/postslogchimp
- CVE-2026-121559GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloningglpi-project GLPI
- CVE-2026-121558AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_idRicky-7-Yan intelligent-audit-system
- CVE-2026-121557WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwootwppconnect-server
- CVE-2026-121556FastBee through 2.1.0 IDOR via /iot/product By-ID Endpointsbeecue FastBee
- CVE-2026-121555Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumbDrizzleTime Foxel
- CVE-2026-121554cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirectssilkimen cordova-plugin-advanced-http
- CVE-2026-121553Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())cotonti
- CVE-2026-121552domain-admin before 1.6.79 Missing Authorization via getGroupUserListdromara domain-admin
- CVE-2026-121551PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Descriptionpostfixadmin
- CVE-2026-121550nnn through 5.3 Symlink-Following Write via NNN_FIFO Handlingjarun nnn
- CVE-2026-121549nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Pluginsjarun nnn
- CVE-2026-121548nnn through 5.3 OS Command Injection via togglex Pluginjarun nnn
- CVE-2026-121547dysk before 3.8.2 Terminal Escape Sequence Injection via Mount MetadataCanop dysk
- CVE-2026-121546ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink FollowingNovik ruTorrent
- CVE-2026-121545Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handlerrobiningelbrecht dreeve