Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
11 matching advisories · 11 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
low3.7
CVE-2026-128087Package fixes recorded

russh kex_done: Shared-secret callback runs before server host-key verification

A malicious SSH server whose host key is rejected can still cause russh's client::Handler::kex_done() callback to execute with the raw key-exchange shared secret. Applications using the callback for its documented protocol-bridging purpose may derive keys, initialize a secondary data channel, or perform another externally visible action before russh calls check_server_key() and rejects the server.

Recorded fixes — russh: 0.65.1. Check your release branch.

Public exploit reference

crates.io / russh
high7.1
CVE-2026-124761

A DCP Set of the IP suite that is refused is still stored

P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

RT-Labs · P-Net
low3.8
CVE-2026-120490

Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms

On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

checkpoint · Scalable Platforms (ElasticXL, Maestro, Chassis)
medium6.5
CVE-2026-13721

Folder authorization bypass in the Git Sync provisioning files API

A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Grafana · Grafana Enterprise / Grafana · Grafana OSS
high8.3
CVE-2026-121291

Security Advisory 0222

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Arista Networks · EOS
medium5.3
CVE-2026-63027

Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of…

Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

n/a · Intel(R) TDX Migration Trust Domain (MigTD)
high8.7
CVE-2026-112186

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size.

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an OutOfMemoryError, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a StackOverflowError because of an unbound recursion in Service Listing V1.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Eclipse Foundation · Eclipse Kura
high7.4
CVE-2026-65219

Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

SMCI · MBD-X12SPI
medium4.6
CVE-2026-123612Package fixes recorded

rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

When a server rejects Encrypted Client Hello (ECH), the client completes the handshake using the outer ClientHello and authenticates the server against the ECH config's public_name. At the end of that handshake, rustls encrypted and queued any application data buffered via ClientConnection::writer() before queueing the ech_required alert.

Recorded fixes — rustls: 0.23.46 or 0.24.0-dev.2. Check your release branch.

Exploitation not established

crates.io / rustls
high8.2
CVE-2026-123584Package fixes recorded

Spoofed malformed UDP datagrams abort DNS lookups

While waiting for a reply on a UDP connection, the client parsed every datagram that arrived from the name server's address and port before checking its message ID. If parsing failed, the attempt ended with an error instead of dropping the datagram and waiting for the real reply. The receive loop also gave up after three datagrams.

Recorded fixes — hickory-net: 0.26.2. Check your release branch.

Exploitation not established

crates.io / hickory-net