CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114552MailEnable parseObjectResponse XML External Entity Processing Information Disclosure VulnerabilityMailEnable
- CVE-2026-114551MailEnable Auth Cleartext Storage Information Disclosure VulnerabilityMailEnable
- CVE-2026-114550libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerabilitylibwebsockets
- CVE-2026-114549NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution VulnerabilityNoMachine
- CVE-2026-118628MLflow get-artifacts Server-Side Request Forgery Information Disclosure VulnerabilityMLflow
- CVE-2026-118627MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityMLflow
- CVE-2026-118626MLflow Tracking Server Issues Missing Authorization Privilege Escalation VulnerabilityMLflow
- CVE-2026-118625MLflow Tracking Server Missing Authorization Privilege Escalation VulnerabilityMLflow
- CVE-2026-118624MLflow Tracking Server Jobs Missing Authorization Information Disclosure VulnerabilityMLflow
- CVE-2026-118623MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityMLflow
- CVE-2026-121589spatie url-signer URL Validation AbstractUrlSigner.php validate type conversionspatie url-signer
- CVE-2026-120651CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is setCGI
- CVE-2026-120650CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limitsCGI
- CVE-2026-120648CGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentCGI
- CVE-2026-120647CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment…CGI
- CVE-2026-120646CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfoCGI
- CVE-2026-120645CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_listCGI
- CVE-2026-120644CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires valuesCGI
- CVE-2026-120643CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_urlCGI
- CVE-2026-120642CGI versions before 5.00 for Perl return request-derived values untainted under taint modeCGI
- CVE-2026-120641CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows pathsCGI
- CVE-2026-120640CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or…CGI
- CVE-2026-120639CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values…CGI
- CVE-2026-120638CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirectCGI
- CVE-2026-120637CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHODCGI
- CVE-2026-120636CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_formCGI
- CVE-2026-120635CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCsCGI
- CVE-2026-120634CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser bufferCGI
- CVE-2026-120633CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_portCGI
- CVE-2026-120632CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-TypeCGI