Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
63 matching advisories · 30 shown
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high8.3
CVE-2026-127082

Huginn before 2026.11.09 Information Exposure via JqAgent jq env Builtin

Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

huginn · huginn
medium6.9
CVE-2026-124011

Dixell/Copeland XWEB EVO Information Disclosure via sysinfo.lua

XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

Copeland · XWEB EVO
medium4.7
CVE-2026-119942

HTTP.sys Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.3
CVE-2026-119882

Windows Remote Desktop Services Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.5
CVE-2026-119856

Win32k Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft Office 365 for Mac / Microsoft · Microsoft Office for Android
high7.0
CVE-2026-119822

Windows Overlay Filter Elevation of Privilege Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.5
CVE-2026-118140

Server for NFS Information Disclosure Vulnerability

Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows Server 2016 / Microsoft · Windows Server 2016 (Server Core installation)
medium5.9
CVE-2026-105557

Windows DHCP Server Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows Server 2016 / Microsoft · Windows Server 2016 (Server Core installation)
medium5.5
CVE-2026-112965

Windows Management Instrumentation Information Disclosure Vulnerability

Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium6.5
CVE-2026-112808

Windows Print Spooler Components Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium6.0
CVE-2026-112757

Windows Secure Kernel Mode Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.5
CVE-2026-96137

Windows Graphics Kernel Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 11 Version 24H2 / Microsoft · Windows 11 Version 25H2
medium5.5
CVE-2026-96001

Windows Bluetooth Service Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.5
CVE-2026-108409

Windows Overlay Filter Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.5
CVE-2026-102868

Windows Shell Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 11 version 23H2 / Microsoft · Windows 11 Version 23H2
high7.5
CVE-2026-123465

WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

myCred · myCred
medium6.5
CVE-2026-113504

Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext

Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium5.3
CVE-2026-121779

WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a through 4.22.0.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

YITH · YITH WooCommerce Subscription
medium6.3
CVE-2026-108018

BigFix Mobile is affected by sensitive information disclosure

The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.  A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

HCLSoftware · BigFix MCM & Mobile
medium6.9
CVE-2026-110390

FlexNet Beacon Missing Authentication Vulnerability

Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Flexera · FlexNet Beacon / Flexera · FlexNet Manager Suite
low2.3
CVE-2026-109823Package fixes recorded

Host filesystem path disclosure via DNS rebinding

An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.

Recorded fixes — tidewave: 0.9.2. Check your release branch.

Exploitation not established

high7.4
CVE-2026-111079

Goose: goose: shell history and environment leak via terminal integration

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Red Hat · Red Hat Enterprise Linux 10 / Red Hat · Red Hat Enterprise Linux 9
medium5.5
CVE-2026-96948

Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium4.7
CVE-2026-85866

Windows ALPC Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1809 / Microsoft · Windows 10 Version 21H2
medium5.5
CVE-2026-70261

Microsoft Trace Data Helper Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.5
CVE-2026-70260

Microsoft Trace Data Helper Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium4.7
CVE-2026-83925

Windows Kernel Information Disclosure Vulnerability

Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium5.5
CVE-2026-83907

Windows Hello Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 21H2 / Microsoft · Windows 10 Version 22H2
medium4.7
CVE-2026-83905

Windows Shell Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809