Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
4 matching advisories · 4 shown
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high8.5
CVE-2026-125271

AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls to operations whose names contain consecutive capital letters.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

AWS · aws-api-mcp-server
high7.6
CVE-2026-114649

Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

MongoDB · C# Driver
medium6.8
CVE-2026-104048

Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Public exploit reference

Red Hat · Red Hat Enterprise Linux 10 / Red Hat · Red Hat Enterprise Linux 6
high8.2
CVE-2026-123592Package fixes recorded

DNSSEC validation cache could reuse an Insecure result for a different name

The DNSSEC validation cache used a 64-bit hash of the query as its key, and two keys with the same hash counted as equal. The Hash implementation of Name hashed the bytes of the labels but not where one label ends and the next begins, so names that differ only in the placement of dots (such as ab.c. and a.bc.) hashed to the same value.

Recorded fixes — hickory-net: 0.26.2. Check your release branch.

Exploitation not established