CVE-2026-119722High 8.5
Research and translation in progress – available shortly.
CVE tracker
New vulnerabilities – clearly explained
Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA and the probability of exploitation (EPSS) – each one researched individually: what is affected, what helps, what to do.
3published today
3424in the last 7 days
248of them critical
9newly exploited (7 days)
3424 vulnerabilities
CVE-2026-119721Medium 6.9
Research and translation in progress – available shortly.
CVE-2026-119720Medium 6.8
Research and translation in progress – available shortly.
CVE-2026-119719High 8.5
Research and translation in progress – available shortly.
CVE-2026-119718High 8.5
Research and translation in progress – available shortly.
CVE-2026-119717Critical 9.2
Research and translation in progress – available shortly.
CVE-2026-119716Critical 9.2
Research and translation in progress – available shortly.
CVE-2026-119715Medium 5.3
Research and translation in progress – available shortly.
CVE-2026-119714Medium 6.9
Research and translation in progress – available shortly.
CVE-2026-119713High 8.7
Research and translation in progress – available shortly.
CVE-2026-119712Medium 5.3
Research and translation in progress – available shortly.
CVE-2026-119711Medium 6.9
Research and translation in progress – available shortly.
CVE-2026-119710High 7.1
Research and translation in progress – available shortly.
CVE-2026-119709Medium 6.9
Research and translation in progress – available shortly.
CVE-2026-119708High 7.1
Research and translation in progress – available shortly.
CVE-2026-119707High 7.1
Research and translation in progress – available shortly.
CVE-2026-119706Critical 9.3
InternLM LMDeploy: Unauthenticated remote code execution via pickle deserialization
InternLM LMDeploy versions 0.9.0 through 0.18.0 contain an unsafe deserialization flaw in the /update_weights endpoint of the api_server. An unauthenticated remote attacker can send a crafted, base64-encoded pickle in the serialized_named_tensors field, which is loaded without validation and executes operating system commands as the api_server process. The attack requires only network access to the API server, and the default api_server bind is reachable without authentication.
InternLM · LMDeploy
CVE-2026-119705Medium 6.9
Research and translation in progress – available shortly.
CVE-2026-119704Medium 5.3
Research and translation in progress – available shortly.
CVE-2026-119703Medium 6.3
Research and translation in progress – available shortly.
CVE-2026-119702Medium 6.9
Research and translation in progress – available shortly.
CVE-2026-119701Medium 6.9
Research and translation in progress – available shortly.
CVE-2026-119700Medium 6.9
Research and translation in progress – available shortly.
CVE-2026-119699Medium 6.9
Research and translation in progress – available shortly.
CVE-2026-119479Medium 5.3
Research and translation in progress – available shortly.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.