CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-95733Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code ExecutionHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95732Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code ExecutionHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95731Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized…Hewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2025-71452Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgpVembu Technologies BDRSuite
- CVE-2026-63395isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)isomorphic-git
- CVE-2025-71451Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgpVembu Technologies BDRSuite
- CVE-2026-63475isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)isomorphic-git
- CVE-2026-63476isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)isomorphic-git
- CVE-2026-105822Server-Side Request Forgery in Tapo Cloud MQTT ProxyTP-Link Systems Tapo Cloud Service
- CVE-2026-105821Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT ProxyTP-Link Systems Tapo Cloud Service
- CVE-2026-63478isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkoutisomorphic-git
- CVE-2026-63500Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive exportyeti-platform yeti
- CVE-2026-120567EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field referenceMongoDB Entity Framework Core Provider
- CVE-2026-63502Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and writeyeti-platform yeti
- CVE-2026-93325Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker BuildxDocker Buildx
- CVE-2026-63482Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Datayeti-platform yeti
- CVE-2026-63489Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parametersyeti-platform yeti
- CVE-2026-63501ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)Agamnentzar ag-psd · ag-psd
- CVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password changeteam-alembic ash_authentication · ash_authentication
- CVE-2026-63471fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decoratorkoxudaxi fastapi-code-generator · fastapi-code-generator
- CVE-2026-63469fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dictkoxudaxi fastapi-code-generator · fastapi-code-generator
- CVE-2026-63470fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstringkoxudaxi fastapi-code-generator · fastapi-code-generator
- CVE-2026-112917Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcallDocker Desktop
- CVE-2026-121501mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiationmathurvishal CloudClassroom-PHP-Project
- CVE-2026-120953Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handlerMongoDB Atlas SQL JDBC Driver
- CVE-2026-39379GeoNetwork: Reflected XSS through client-side template injectioncore-geonetwork
- CVE-2026-120954Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector viewsMongoDB C Driver
- CVE-2026-121382Netcore NBR100V2 auto_ac msg_aes_dec integer overflowNetcore NBR100V2
- CVE-2026-46487GeoNetwork: ACL bypass on Elasticsearch search when request body omits query fieldcore-geonetwork · org.geonetwork-opensource:geonetwork
- CVE-2026-120955MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS MetadataMongoDB C Driver