Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
17 matching advisories · 17 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
unknown
CVE-2026-90436

Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Axis 1.x (EOL) / Apache Software Foundation · Apache Axis 1.x (EOL)
unknown
CVE-2026-82894

Apache OFBiz: Content renderer runs a service name stored on the row

Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side request forgery, by requesting the public showHelpPublic view against a Content row whose serviceName field an account holding only CONTENTMGR_CREATE or CONTENTMGR_UPDATE has set to an attacker-chosen service, causing ContentWorker.renderContentAsText to resolve the service to invoke from that persisted, client-writable field and build its parameters directly from the live HTTP request map with no allow-list, no ownership check, and no requirement that the caller be authenticated. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache OFBiz
critical9.2
CVE-2026-119084

Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters

Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

AWS · amazon-redshift-jdbc-driver
critical9.8
CVE-2026-16306

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd.

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command and argument parameters.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

INFINITT Healthcare · System Manager
high8.5
CVE-2026-119578

MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a target name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

Project-MONAI · MONAI
critical9.2
CVE-2026-119050

Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

agno-agi · agno
critical9.8
GHSA-26p8-2jq9-3vq9Package fixes recorded

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlled class, and instantiates it synchronously.

Recorded fixes — mlflow: 3.17.0. Check your release branch.

Exploitation not established

PyPI / mlflow
critical9.9
CVE-2026-115931

Arbitrary file read and backend crash through unrestricted provider method calls

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

GitroomHQ · postiz-app
medium6.5
GHSA-2wqp-q3c6-ccj5Package fixes recorded

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke with no authentication, and the handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens + trulens-providers-litellm packages installed, an unauthenticated attacker can force the server to make an outbound HTTP request to an arbitrary host of their choosing, carrying attacker-controlled headers (SSRF).

Recorded fixes — mlflow: 3.17.0. Check your release branch.

Public exploit reference

PyPI / mlflow
high7.0
CVE-2026-114660

Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleting protected pages neither account may delete.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

getgrav · grav
high8.8
CVE-2026-92206

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

CrewAI · CrewAI
high8.5
CVE-2026-55543

TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

helge17 · tuxguitar
medium6.5
CVE-2026-96740

Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · StreamsHub Console for Apache Kafka® / Red Hat · streams for Apache Kafka 2
high8.2
CVE-2026-101292

Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat JBoss Enterprise Application Platform 7.4.25 / Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7