CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-121652Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingAWS maplibre-gl-js-amplify
- CVE-2026-120956remote abort and memory disclosure from a malformed cursor.nsMongoDB C Driver
- CVE-2026-120684MongoDB C Driver GridFS gap lets a shared writer recover a protected client's passwordMongoDB C Driver
- CVE-2026-120678MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)MongoDB C Driver
- CVE-2026-63198traQ: Privilege escalation by OAuth prompt=none requesttraPtitech traQ · github.com/traPtitech/traQ
- CVE-2026-82976Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster…Red Hat OpenShift Container Platform
- CVE-2026-120673Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the commandMongoDB Rust Driver
- CVE-2026-63197traQ: XSS in the User Uploaded File Retrieval APItraPtitech traQ · github.com/traPtitech/traQ
- CVE-2026-63417Logging Redactor: PII data in str/repr of non primitive objects was not being redactedarmurox loggingredactor · loggingredactor
- CVE-2026-57154OPNsense: Configuration line injection via multiple GUI text fieldsopnsense core
- CVE-2026-119922Babelfish for PostgreSQL Privilege EscalationAWS babelfish-for-postgresql · Amazon Aurora PostgreSQL wit…
- CVE-2026-63418Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binarymonitoring-plugins
- CVE-2026-63499zt-zip: ZipUtil.unpack can change file permissions of output directoryzeroturnaround zt-zip · org.zeroturnaround:zt-zip
- CVE-2026-63436zt-zip: Path traversal in fluent API unpackzeroturnaround zt-zip · org.zeroturnaround:zt-zip
- CVE-2026-44267Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitterenspirit elo · @enspirit/elo
- CVE-2026-44266Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsenspirit elo · @enspirit/elo
- CVE-2026-116845NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateViewnetbox-community netbox
- CVE-2026-44265Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fieldsenspirit elo · @enspirit/elo
- GHSA-P3JP-9V83-76W9Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write VulnerabilityMicrosoft.DotNet.ILCompiler · Microsoft.NETCore.App.Run… +75
- CVE-2026-121263phpMyAdmin MoTranslator Loader.php getTranslator path traversalphpMyAdmin MoTranslator
- CVE-2026-121628Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accountingbagisto
- CVE-2026-121627buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URLjarun buku
- CVE-2026-121626GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handlerwillamowius gnugk
- CVE-2026-121625GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsingwillamowius gnugk
- CVE-2026-121624Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate ValidationNanosystems Supremo
- CVE-2026-121631Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpointslightdash
- CVE-2026-119509WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerabilityeranfl ClickCease Click Fraud Protection
- CVE-2026-97072WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred
- CVE-2026-114187WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerabilityWPVibes AnyWhere Elementor
- CVE-2026-121262phpMyAdmin SQL-Parser ExplainStatement.php parse type conversionphpMyAdmin SQL-Parser