Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
10 matching advisories · 10 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium6.3
CVE-2026-123600

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass

Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an NSEC3 record matching the hashed QNAME. On-path attackers or malicious authoritative servers can replay a validly signed non-apex NSEC3 with the zone's signed SOA to serve an authenticated (AD=1) denial of any apex RRtype for the negative-cache TTL.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
medium6.3
CVE-2026-123579

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion

DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker can combine an NSEC3 record matching the query name with a signed wildcard record into a bogus positive response that validation accepts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

hickory-dns · hickory-dns / hickory-dns · hickory-dns
high7.6
CVE-2026-123542

OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow

OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM
medium4.2
CVE-2026-108178

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · API Connect
medium6.5
CVE-2026-96303

Microsoft PowerShell Security Feature Bypass Vulnerability

Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · PowerShell 7.4 / Microsoft · PowerShell 7.5
high8.8
CVE-2026-70174

.NET Remote Code Execution Vulnerability

Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · .NET 10.0 runtime / Microsoft · .NET 11.0 runtime
medium6.5
CVE-2026-85805

Microsoft PowerShell Security Feature Bypass Vulnerability

Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
critical9.8
GHSA-6v38-4h7w-rj9hPackage fixes recorded

Authlib: empty signatures validation in JWS JSON deserialization

Authlib (prior to 1.9.0) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

Recorded fixes — authlib: 1.9.0. Check your release branch.

Exploitation not established

PyPI / authlib
high7.8
CVE-2026-49783

Secure Boot Security Feature Bypass Vulnerability

Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809