CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-110372WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerabilityBrainstorm Force OttoKit
- CVE-2026-110382WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-108485WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerabilityThemeGrill eStore
- CVE-2026-110885WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerabilityHivePress
- CVE-2026-110365WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerabilityWPExperts Advanced File Manager
- CVE-2026-111942hrisikeshpal Blood_Bank_Management_System abs.php cross site scriptinghrisikeshpal Blood_Bank_Management_System
- CVE-2026-96534Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_exportModern Events Calendar Lite · Modern Event Calendar Pro
- CVE-2026-111041AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_mediaAI Engine
- CVE-2026-110981WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' ParameterWP Photo Album Plus
- CVE-2026-110976AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_mediaAI Engine
- CVE-2026-110070Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDORModern Events Calendar Lite
- CVE-2026-110069Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX ActionsModern Events Calendar Lite
- CVE-2026-110035Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST RouteSalon Booking System
- CVE-2026-110033Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'Salon Booking System
- CVE-2026-110032Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer EditorSalon Booking System
- CVE-2026-110031Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta KeySalon Booking System
- CVE-2026-110026Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and DeletionTasty Recipes Lite
- CVE-2026-109937Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout BlockOtter Blocks
- CVE-2026-87844Product Designer <= 1.0.40 - Unauthenticated Design Template Data InjectionPickPlugins Product Designer for WooCommerce
- CVE-2026-111877dext34-morgan Books4Cash search.php cross site scriptingdext34-morgan Books4Cash
- CVE-2026-111876alexpasmantier television entry.rs output command injectionalexpasmantier television
- CVE-2026-111875David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorizationDavid-Crty Databasement
- CVE-2026-111874OpenCATS Career Portal CareersUI.php processLogin excessive authenticationOpenCATS
- CVE-2026-111873itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injectionitsmeravitejak Online-Examination-System
- CVE-2026-111872itsmeravitejak Online-Examination-System database.php getreport sql injectionitsmeravitejak Online-Examination-System
- CVE-2026-111871itsmeravitejak Online-Examination-System subjectsdb.php sql injectionitsmeravitejak Online-Examination-System
- CVE-2026-111870itsmeravitejak Online-Examination-System admin.php isAdmin missing authenticationitsmeravitejak Online-Examination-System
- CVE-2026-111869makeplane API Endpoint reliance on untrusted inputs in a security decisionmakeplane plane
- CVE-2026-111868datastax pulsar-jms PulsarObjectMessage.java decode deserializationdatastax pulsar-jms
- CVE-2026-111997ip-address denial of servicebeaugunderson ip-address · ip-address