CVE Security News

Recent CVE identifiers and vulnerability disclosures aggregated from security feeds: new IDs, published advisories, and the vendors and products they affect.

A CVE (Common Vulnerabilities and Exposures) entry is the standardized identifier assigned to a publicly disclosed security flaw, letting researchers, vendors and defenders reference the same vulnerability unambiguously. New CVE IDs show up here as soon as they are assigned, usually the first public signal that a product needs patching. Coverage ranges from obscure library bugs to critical remote-code-execution flaws in widely deployed software.

Recent CVE items

CVE-2026-91141 A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory allocations by sending a small TCP packet with a large, attac...
@cveNotify · Nov 12, 2026
CVE-2026-127211 MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to ac...
@cveNotify · Nov 12, 2026
CVE-2026-127209 Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExter...
@cveNotify · Nov 12, 2026
CVE-2026-126823 A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load withou...
@cveNotify · Nov 12, 2026
CVE-2026-126354 Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a pa...
@cveNotify · Nov 12, 2026
CVE-2026-126353 Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several expl...
@cveNotify · Nov 12, 2026
CVE-2026-126351 Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rew...
@cveNotify · Nov 12, 2026
CVE-2026-126350 Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modif...
@cveNotify · Nov 12, 2026
CVE-2026-126349 Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode...
@cveNotify · Nov 12, 2026
CVE-2026-126348 Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode imple...
@cveNotify · Nov 12, 2026
CVE-2026-126347 Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-...
@cveNotify · Nov 12, 2026
CVE-2026-126346 basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response han...
@cveNotify · Nov 12, 2026
CVE-2026-126345 basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-obj...
@cveNotify · Nov 12, 2026
CVE-2026-126344 /node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built...
@cveNotify · Nov 12, 2026
CVE-2026-126343 /node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or h...
@cveNotify · Nov 12, 2026
CVE-2026-126210 /node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to t...
@cveNotify · Nov 12, 2026
CVE-2026-126793 An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0....
@cveNotify · Nov 12, 2026
CVE-2026-126209 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.allowed_uri? st...
@cveNotify · Nov 12, 2026
CVE-2026-126208 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists...
@cveNotify · Nov 12, 2026
CVE-2026-126207 Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrub_css checks only th...
@cveNotify · Nov 12, 2026
CVE-2026-120139 Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tup...
@cveNotify · Nov 12, 2026
CVE-2026-116336 Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expre...
@cveNotify · Nov 12, 2026
CVE-2026-116335 Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking ope...
@cveNotify · Nov 12, 2026
CVE-2026-116333 Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE...
@cveNotify · Nov 12, 2026
CVE-2026-116332 Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during pla...
@cveNotify · Nov 12, 2026
CVE-2026-116331 Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined agg...
@cveNotify · Nov 12, 2026
CVE-2026-116322 Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it hold...
@cveNotify · Nov 12, 2026
CVE-2026-116321 Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero...
@cveNotify · Nov 12, 2026
CVE-2026-116320 Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl arr...
@cveNotify · Nov 12, 2026
CVE-2026-116319 Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls. Versions be...
@cveNotify · Nov 12, 2026

Other topics

Ransomware
Ransomware attacks, extortion group activity, victim disclosures and decryptor releases.
Phishing
Phishing campaigns, credential-harvesting kits, and social-engineering techniques used to compromise users and organizations.
Zero-Day
Zero-day vulnerabilities being actively exploited before a patch exists, and the fixes that follow.
Data Breach
Confirmed and reported data breaches: what was exposed, which organizations were affected, and how the incident came to light.
Exploit
Public exploit code, proof-of-concept releases, and technical exploitation write-ups for known vulnerabilities.
Patch
Vendor patches, security updates and fix releases for previously disclosed vulnerabilities.