Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
11 matching advisories · 11 shown
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium5.9
CVE-2026-129127

SQLBot through 1.10.3 Weak Password Hashing via Unsalted MD5

SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

dataease · SQLBot
medium6.8
CVE-2026-128910

DJI AeroScope Mobile: Hard-coded root password on the serial console

Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

DJI · AeroScope Mobile (TP703) / DJI · AeroScope Mobile (TP703) 1300 communications board firmware
medium5.9
CVE-2026-19126

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · API Connect
high7.4
EEF-CVE-2026-65629Package fixes recorded

Weak PBKDF2 parameters for password-encrypted private-key export in jose

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.

Recorded fixes — jose: 1.11.13. Check your release branch.

Public exploit reference

low2.2
CVE-2026-116054

SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash

A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

n/a · SH3
high8.2
CVE-2026-116071

rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption

rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

rotki · rotki
high8.2
CVE-2025-30049

Use of Unsalted MD5 Password Hashes in CGM CLININET

The CGM CLININET application stores user passwords as unsalted MD5 hashes.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

CGM · CGM CLININET
high8.2
CVE-2026-25861

QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

QloApps · QloApps
high8.1
CVE-2024-3183

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key directly. For user principals, this key is a hash of a public per-principal randomly-generated salt and the user’s password.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

freeipa / Red Hat · Red Hat Enterprise Linux 7