Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
38 matching advisories · 30 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
low3.1
CVE-2026-126392

Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

parse-community · parse-server / parse-community · parse-server
low2.9
CVE-2026-58803

In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure.

In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Android
unknown
CVE-2026-86532

Apache TomEE: Username enumeration and timing side channel in JAAS login modules

The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache TomEE / Apache Software Foundation · Apache TomEE
low3.1
CVE-2026-124425

Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Response

Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

parse-community · parse-server / parse-community · parse-server
medium5.3
CVE-2026-103021

OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

openemr · openemr
medium5.3
CVE-2026-121130

Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.

Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
medium5.3
CVE-2026-121187

Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.

Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
medium4.3
CVE-2026-58945

In multiple locations, there is a possible side channel information leak due to improperly used crypto.

In multiple locations, there is a possible side channel information leak due to improperly used crypto. This could lead to paired device information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Android
medium5.3
CVE-2026-114199

Gitea contribution heatmap private activity disclosure to public-only tokens

GET /api/v1/users/{username}/heatmap computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Gitea · Gitea
high8.8
CVE-2026-118338

Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.

Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
critical9.6
CVE-2026-118312

Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML…

Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
medium5.9
EEF-CVE-2026-65626Package fixes recorded

Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a padding string of at least eight non-zero bytes, and a 0x00 separator) and returns a distinct error result otherwise, and rsaes_pkcs1_decrypt/2 additionally returns {error, {badsize, _}} when the length check fails. The implementation applies no implicit-rejection countermeasure (RFC 8017 §7.2.2): it does not substitute a deterministic pseudo-random plaintext on a padding failure, so a one-bit padding-conformance signal leaks to the caller. Because the underlying modular exponentiation in dp/2 is a raw, non-blinded crypto:mod_pow/3, the padding check also stays distinguishable by timing even when an application normalizes every failure to a single error value.

Recorded fixes — jose: 1.11.13. Check your release branch.

Exploitation not established

Hex / jose
medium5.9
CVE-2026-76406

Information Disclosure through REST API Authentication in Splunk SOAR

In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data. The vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises) in the Splunk documentation.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Splunk · Splunk SOAR
medium5.5
CVE-2026-114064

Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

grokability · snipe-it
high8.8
CVE-2026-113331

Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive…

Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
high8.8
CVE-2026-113314

Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page.

Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
critical9.6
CVE-2026-113300

Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive…

Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
critical9.6
CVE-2026-113056

Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
high8.8
CVE-2026-113203

Observable discrepancy in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page.

Observable discrepancy in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
high8.8
CVE-2026-113197

Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive…

Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
high8.8
CVE-2026-112995

Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page.

Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
critical9.6
CVE-2026-112992

Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
medium5.4
CVE-2026-113057

Observable discrepancy in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted…

Observable discrepancy in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
high7.5
CVE-2026-97788

Active Directory Federation Services (AD FS) Information Disclosure Vulnerability

Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft .NET Framework 3.5 / Microsoft · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
medium6.8
CVE-2026-97782

Microsoft Office SharePoint Tampering Vulnerability

Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft SharePoint Server Subscription Edition
medium5.3
CVE-2026-65314

Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

ElectricSQL · Electric Postgres Sync