CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-111905phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/datathorsten phpMyFAQ
- CVE-2026-111904phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions APIthorsten phpMyFAQ
- CVE-2026-111903phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypassthorsten phpMyFAQ
- CVE-2026-111902phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments APIthorsten phpMyFAQ
- CVE-2026-111901phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Paginationthorsten phpMyFAQ
- CVE-2026-111900phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.phpthorsten phpMyFAQ
- CVE-2026-111898phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linkingthorsten phpMyFAQ
- CVE-2026-111897phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpointsthorsten phpMyFAQ
- CVE-2026-111896phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypassthorsten phpMyFAQ
- CVE-2026-111895phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_usernamethorsten phpMyFAQ
- CVE-2026-111894phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URIthorsten phpMyFAQ
- CVE-2026-111893phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions APIthorsten phpMyFAQ
- CVE-2026-111892phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpointsthorsten phpMyFAQ
- CVE-2026-111891phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions APIthorsten phpMyFAQ
- CVE-2026-111890phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRightsthorsten phpMyFAQ
- CVE-2026-111889phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboardthorsten phpMyFAQ
- CVE-2026-111888phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update APIthorsten phpMyFAQ
- CVE-2026-111887phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpointthorsten phpMyFAQ
- CVE-2026-111886phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpointthorsten phpMyFAQ
- CVE-2026-111885phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup APIthorsten phpMyFAQ
- CVE-2026-111884phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeoverthorsten phpMyFAQ
- CVE-2026-111882phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacksthorsten phpMyFAQ
- CVE-2026-111881FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via ClipboardFreeRDP
- CVE-2026-111880FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC OffsetFreeRDP
- CVE-2025-71435Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Tokencoder · github.com/coder/coder/v2 +1
- CVE-2024-58398Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parametercoder · github.com/coder/coder/v2 +1
- CVE-2026-109701WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerabilityPAYCOMET for WooCommerce
- CVE-2026-110889WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerabilityGantry 5 Framework
- CVE-2026-110253weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameterboldgrid weForms – Easy Drag & Drop Contact Form Builder Fo…
- CVE-2026-100316European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Headerdavidanderson European VAT Compliance Assistant for WooComm…