CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-121604wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.cwlroots
- CVE-2026-121603Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handlersolanum-ircd solanum
- CVE-2026-121602Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOINsolanum-ircd solanum
- CVE-2026-121588TeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon Importtexlyre
- CVE-2026-121587Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpointscoollabsio coolify
- CVE-2026-109593An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files…SonicWall Global Management System
- CVE-2026-28336SolarWinds Dameware Command Injection VulnerabilitySolarWinds Dameware
- CVE-2026-28335SolarWinds Dameware Buffer Overflow VulnerabilitySolarWinds Dameware
- CVE-2026-119674mongorestore may restore encoded collection names into an unintended collectionMongoDB Database Tools
- CVE-2026-28327SolarWinds Dameware DLL Hijacking VulnerabilitySolarWinds Dameware
- CVE-2026-103916Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directoryDocker Sandboxes
- CVE-2026-119673mongofiles may write outside the working directory through a symlinkMongoDB Database Tools
- CVE-2026-119672mongofiles may disclose GridFS content to standard output through a stored filenameMongoDB Database Tools
- CVE-2026-119675mongorestore may bypass collection guards through a system.buckets prefixMongoDB Database Tools
- CVE-2026-118505AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceteam-alembic ash_authentication · ash_authentication
- CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountteam-alembic ash_authentication · ash_authentication
- CVE-2026-114582Server-side request forgery via SpatialReference string inputdjangoproject django
- CVE-2026-113733Password hash disclosure to "view only" admin users with custom user modelsdjangoproject django
- CVE-2026-113593Potential exposure of private data via empty and missing Vary headersdjangoproject django
- CVE-2026-111362Server-side request forgery via crs member of GeoJSON geometriesdjangoproject django
- CVE-2026-111211Potential log injection via unescaped geometry form valuesdjangoproject django
- CVE-2026-108147Potential memory exhaustion in MultiPartParser via base64-encoded file uploaddjangoproject django
- CVE-2026-120758NULL Pointer Dereference in H5HL_unprotect via Corrupted FileThe HDF Group HDF5
- CVE-2026-65168NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.NVIDIA Slurm
- CVE-2026-65165NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary…NVIDIA Slurm
- CVE-2026-65140NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained…NVIDIA Slurm
- CVE-2026-65139NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.NVIDIA Slurm
- CVE-2026-120757Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverseThe HDF Group HDF5
- CVE-2026-65138NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate…NVIDIA Slurm
- CVE-2026-65109NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside…NVIDIA Slurm