FreeNo loginMCPRSS

The few vulnerabilities a week that need action

Merged from the CVE List, GitHub Advisory Database, OSV, CISA KEV and EPSS. Summaries are written by a model and labeled as such.

updated 42m ago127 critical entries

01 CHECK YOUR STACK

Parsed in your browser; the file is never uploaded. The generated feed URL contains package names and versions.

02 CONNECT YOUR AGENT HERE

claude mcp add --transport http cve-now https://mcp.cve.now/mcp

03 VULNERABILITIES

Critical127

42m	CVE-2026-114219	NewType Infortech｜NT OneAPP - Hard-coded Credentials	New
42m	CVE-2026-114220	NewType Infortech｜NT OneAPP - Improper Certificate Validation	New
2h	CVE-2026-112005	WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor	New
2h	CVE-2026-114661	OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints	New
2h	CVE-2026-110264	Integer Overflow or Wraparound in GitLab	New
2h	CVE-2026-114575	TOTOLINK A950RG product.so UploadCustomModule command injection	New
2h	CVE-2026-76268	Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise	New
2h	CVE-2026-114509	Laravel TokenGuard authentication bypass through non-string API credentials	New

Latest

Everything, newest first

Every entry, deduplicated across sources.

42m	CVE-2026-114219	NewType Infortech｜NT OneAPP - Hard-coded Credentials	New
42m	CVE-2026-114220	NewType Infortech｜NT OneAPP - Improper Certificate Validation	New
42m	CVE-2026-114221	NewType Infortech｜NT OneAPP - Credential Disclosure	New
42m	CVE-2026-114223	NewType Infortech｜NT OneAPP - Exposure of Sensitive Information	New
42m	CVE-2026-114222	NewType Infortech｜NT OneAPP - Authentication Bypass	New
2h	CVE-2026-111056	FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint	New
2h	CVE-2026-112278	rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache	New
2h	CVE-2026-112150	vraj404 Criminal-Management-System search.php sql injection	New

01 /

One URL. Add filters to narrow it; combine them freely. RSS by default, or add format=atom or format=json.

/feed	Every entry, deduplicated across sources	RSS Atom JSON
/feed?filter=critical	KEV, CERT-rated critical, or CVSS 9+ in widely used software	RSS Atom JSON
/feed?filter=kev	New CISA Known Exploited Vulnerabilities	RSS Atom JSON
/feed?tech=nextjs	One technology (php, kubernetes, fortinet, ...)	RSS Atom JSON
/feed?ecosystem=npm	One package ecosystem (npm, pypi, go, maven, ...)	RSS Atom JSON