Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
17 matching advisories · 17 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high8.8
CVE-2026-128909

DJI AeroScope Mobile: Firmware updates are not signature-verified

Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to install modified firmware, which gives persistent code execution as root. The device accepts any image that matches an MD5 checksum supplied in the same request and does not verify a signature. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. Reproduced by running the unmodified device binaries in emulation; not tested on a physical device.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

DJI · AeroScope Mobile (TP703) / DJI · AeroScope Mobile (TP703) 1300 communications board firmware
high7.5
CVE-2026-125958

Root RCE via unsigned NSP upgrade package upload

Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

N-able · N-central
critical9.1
CVE-2026-121688

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism.

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

FrodoBots · FrodoBots EarthRover Mini+ firmware
medium6.3
CVE-2026-112170

Improper verification of downloaded upgrades

The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

GALENO SISTEMI · MAGISTRA
high7.2
CVE-2026-118791

Insecure software update mechanism

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

CompuGroup Medical · Wingesfar
critical9.2
CVE-2026-118462

AIS update mechanism executes unverified code

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

CompuGroup Medical · Infantia / CompuGroup Medical · Profim
low3.1
CVE-2026-123508

Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

go-vikunja · vikunja
high7.5
CVE-2026-104657

Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Progress Software · Fiddler Download & Setup Skill
low3.1
CVE-2026-121750

nvm install --offline installs a cached tarball that previously failed checksum verification

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, nvm_download_artifact downloads a release archive directly to its final path in $NVM_DIR/.cache and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later nvm install --offline of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its node and npm run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the SHASUMS256.txt beside it, if the victim runs nvm install --offline for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

nvm-sh · nvm
high8.6
CVE-2026-110022

Signed plug-in validation bypass

The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Phoenix Contact · PLCnext Engineer
high7.4
CVE-2026-92092

Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

A flaw was found in openshift-ansible. The installer container's run script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat OpenShift Container Platform 4.14 / Red Hat · Red Hat OpenShift Container Platform 4.15
medium5.6
CVE-2026-113957

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so…

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a mismatch. Tag pulls are exempt, because a tag is mutable by design. The fix also verifies the hash of manifests and blobs when they are fetched. This vulnerability is addressed in container version 1.6.0 and containerization version 0.52.1.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apple · container / Apple · containerization
critical9.6
CVE-2026-55981

Firmware verification vulnerability

A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Creative Labs · Creative Sound Blaster Katana V2, V2X, SE
medium5.1
CVE-2026-105137

Laradock Build Process Dockerfile code download

A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 20.5 is recommended to address this issue. The patch is identified as c3494f432668472056aa0a9134ff4e0d9d2e8cea. You should upgrade the affected component. The vendor confirms: "The fix replaces the reported plaintext Event and New Relic downloads with HTTPS-only downloads and checks pinned SHA-256 hashes before extracting the archives. We also fixed the Event download in the PHP-FPM Dockerfile, in addition to the locations you identified."

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

n/a · Laradock
high8.9
CVE-2026-32148

Lockfile checksums not verified in Hex allows dependency integrity bypass

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

hexpm · hex / hexpm · hex
critical9.8
CVE-2026-27180

MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode') (which reads directly from $_REQUEST) instead of the framework's $this->mode. An attacker can poison the system update URL via the auto_update_settings mode handler, then trigger the force_update handler to initiate the update chain. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it using exec('tar xzvf ...'), and copies all extracted files to the document root using copyTree(). This allows an attacker to deploy arbitrary PHP files, including webshells, to the webroot with two GET requests.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

sergejey · MajorDoMo
critical9.1
CVE-2025-14265

Improper server-side validation in ScreenConnect extension framework

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

ConnectWise · ScreenConnect