New CVEs this week, the last 7 days, newest first
Filter
The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday
- 7.8CVE-2026-123039KEVEPSS 1.3%
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as…
- 6.5CVE-2026-124194KEVEPSS 1.6%
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- 8.8CVE-2026-125350KEVEPSS 1.0%
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.6CVE-2026-114713KEVEPSS 0.3%
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server comman…
- 9.8CVE-2026-123218KEVEPSS 0.5%
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.