CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-111866nemoTyrant manong func.php arr2sql sql injectionnemoTyrant manong
- CVE-2026-111865THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injectionTHU-MIG yoloe
- CVE-2026-110882WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerabilityCozy Vision Technologies Pvt. SMS Alert Order Notifications
- CVE-2026-111934Coder before 2.34.7 IP Spoofing via X-Forwarded-For Headercoder
- CVE-2026-111933Coder before 2.34.2 User Enumeration via Login Placeholder Hashcoder · github.com/coder/coder/v2 +1
- CVE-2026-111932Coder before 2.34.2 Stored HTML Injection via Appearance Settingscoder · github.com/coder/coder/v2 +1
- CVE-2026-111931Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxycoder
- CVE-2026-111930Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpointcoder
- CVE-2026-111929Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPCcoder
- CVE-2026-111928Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policycoder
- CVE-2026-111927Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Matchcoder
- CVE-2026-111926Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifestcoder
- CVE-2026-111924Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompressionfleetdm fleet
- CVE-2026-111923Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsingfleetdm fleet
- CVE-2026-111922Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Originsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111921Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletiongo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111920Vikunja 2.6.0 Broken Access Control via Inherited Project Permissionsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111919Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooksgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111918Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111917Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111916Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feedadmidio
- CVE-2026-111914Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.phpadmidio
- CVE-2026-111913Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.phpadmidio
- CVE-2026-111912Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Updateadmidio
- CVE-2026-111911phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injectionthorsten phpMyFAQ
- CVE-2026-111910phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloadsthorsten phpMyFAQ
- CVE-2026-111909phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser APIthorsten phpMyFAQ
- CVE-2026-111908phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST APIthorsten phpMyFAQ
- CVE-2026-111907phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-databasethorsten phpMyFAQ
- CVE-2026-111906phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operationsthorsten phpMyFAQ