Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
10 matching advisories · 10 shown
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium6.9
CVE-2026-126993

SiteServer SSCMS captcha inadequate encryption

A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

SiteServer · SSCMS
low3.7
CVE-2026-91892

Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability that may permit the use of deprecated cryptographic protocols…

Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability  that may permit the use of deprecated cryptographic protocols during secure communications. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Dell · Terraform Provider for PowerFlex
high8.1
CVE-2026-102219

Windows Modern Device Management (MDM) Remote Code Execution Vulnerability

Inadequate encryption strength in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1809 / Microsoft · Windows 10 Version 21H2
high8.1
CVE-2026-121109

Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted…

Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Google · Chrome
high7.1
CVE-2026-63286

Database backups are vulnerable to offline attacks.

Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the credentials stored in AXIS Camera Station Pro.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Axis Communications AB · AXIS Camera Station Pro / Axis Communications AB · AXIS Camera Station 5
low2.2
CVE-2026-116054

SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash

A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

n/a · SH3
medium5.6
CVE-2026-83885

Windows Virtualization-Based Security (VBS) Enclave Spoofing Vulnerability

Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to perform spoofing locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 11 Version 24H2 / Microsoft · Windows 11 Version 25H2
medium5.3
CVE-2026-65777

Active Directory Security Feature Bypass Vulnerability

Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 11 version 23H2 / Microsoft · Windows 11 Version 23H2
medium5.1
CVE-2025-22446

Inadequate encryption strength for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable…

Inadequate encryption strength for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escalation of privilege via adjacent access.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

n/a · Edge Orchestrator software for Intel(R) Tiber™ Edge Platform