NotCVE registry index — public records of vulnerabilities that shipped without a CVE
NotCVE Advisories ·
---------------------------------------------------------------------------- NotCVE Registry Index — 2026-07-16 ---------------------------------------------------------------------------- [-] About the NotCVE registry: NotCVE (https://notcve.org) assigns public identifiers to real, verifiable vulnerabilities that did not receive a CVE — typically because the affected vendor did not acknowledge the issue. Each record preserves the technical details, affected products and disclosure timeline, and is never deleted: if a CVE is assigned later, the entry keeps the original dates and cross- references it. A recent example: NotCVE-2026-0001 (Cloudflare Universal SSL CAA augmentation, published 2026-01-19 without a CVE) was assigned CVE-2026-14440 by the vendor 163 days later — which is exactly what this registry is for. The original disclosure timeline is preserved. Details: https://seclists.org/fulldisclosure/2026/Jul/22 [-] Current records: [2026] - Windows NTFS self-healing duplicate-name handling may allow delayed reparse point exposure from crafted file system images (CVSS 6.3) https://notcve.org/notcve/NotCVE-2026-0008 - Schlage/Allegion HandPunch Missing Authentication in TCP/3001 Management Protocol Allows Unauthenticated Remote Supervisor Enrollment and Data Disclosure (CVSS 9.8) https://notcve.org/notcve/NotCVE-2026-0007 - Hardcoded JWT Secret in ClawVet API Allows Session Token Forgery for Existing Users (CVSS 9.8) https://notcve.org/notcve/NotCVE-2026-0006 - Authenticated OS Command Injection via SSID in TP-Link TL-WR741ND V5 Web Management Interface (CVSS 8) https://notcve.org/notcve/NotCVE-2026-0005 - BestCrypt Volume Encryption improper signature-based sector bypass allows limited cleartext disclosure and plaintext injection (CVSS 5.7) https://notcve.org/notcve/NotCVE-2026-0004 - Deno @std/path isGlob quadratic runtime DoS prior to 1.1.2 (CVSS 5.9) https://notcve.org/notcve/NotCVE-2026-0003 - NetScaler ADC (VPX) before 14.1-60.52 missing SSH host key validation in HA/HA-INC synchronization can enable adversary-in-the-middle and root code execution (CVSS 7.5) https://notcve.org/notcve/NotCVE-2026-0002 - Cloudflare Universal SSL CAA augmentation may enable unauthorized DV certificate issuance by weakening RFC 8657 account binding (CVSS 8.7) https://notcve.org/notcve/NotCVE-2026-0001 [2025] - Use of Vulnerable Go os.RemoveAll Enables Arbitrary Volume Deletion in Kubernetes (CVSS 7.5) https://notcve.org/notcve/NotCVE-2025-0003 - Symlink Race in Go os.RemoveAll Allows Privileged File Deletion (CVSS 7.5) https://notcve.org/notcve/NotCVE-2025-0004 - IBM Instana /auth/SignIn returnUrl Parameter Open Redirect (CVSS 4.1) https://notcve.org/notcve/NotCVE-2025-0002 - Docker Bridge Insufficient Isolation Allows LAN Access to Unpublished Ports (CVSS 6.5) https://notcve.org/notcve/NotCVE-2025-0001 [2024] - Linux ASLR Weakness: Improper Bit-Mask Manipulation Reducing mmap Entropy by Half (CVSS 5.3) https://notcve.org/notcve/NotCVE-2024-0001 - AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5% (CVSS 5.3) https://notcve.org/notcve/NotCVE-2024-0002 [2023] - RSA signature verification bypass via Arbitrary Code Execution in Sansa Connect bootloader (CVSS 6.2) https://notcve.org/notcve/NotCVE-2023-0003 - Buffer overflow in NVD Tools (CVSS 7.5) https://notcve.org/notcve/NotCVE-2023-0002 - Secure Boot Bypass in MSM8916/APQ8016 Mobile SoC (CVSS 7.6) https://notcve.org/notcve/NotCVE-2023-0001 [-] What is next: Each record will also be published individually on this list as a full advisory (technical description, affected versions, timeline and references), and new NotCVE IDs will be announced here as they are assigned. [-] Requesting a NotCVE ID: If you found a real, verifiable vulnerability and could not obtain a CVE for it, you can request a NotCVE identifier at https://notcve.org/form/. Anonymous and pseudonymous submissions are accepted. Submissions are reviewed before publication, and researchers are credited in the NotCVE Hall of Fame: https://notcve.org/hall/ -- NotCVE Advisories advisories () notcve org · https://notcve.org _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/