CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-112016Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging FilesNetcore NR256CN
- CVE-2026-112015Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwdomnigent-ai omnigent
- CVE-2026-112014LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Exportnetease-youdao LobsterAI
- CVE-2026-112013libtta through 2.3 Divide by Zero via tta_decoder_init_get_infoTrue Audio libtta
- CVE-2026-112012libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel CountTrue Audio libtta
- CVE-2026-112011libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek TableTrue Audio libtta
- CVE-2026-112010smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cppicculus smpeg
- CVE-2026-112009smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffericculus smpeg
- CVE-2026-112008libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordrlibmng
- CVE-2026-112007Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loaderschismtracker Schism Tracker
- CVE-2026-112006OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validationopentelemetry-exporter-otlp-proto-http
- CVE-2026-112005WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editorclidey whodb
- CVE-2026-112004Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpointteableio teable
- CVE-2026-112003ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/DeleteProjectSend
- CVE-2026-112002ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/passwordProjectSend
- CVE-2026-112001ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token AbilitiesProjectSend
- CVE-2026-112000Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCsvanus-labs vanus
- CVE-2026-111999Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receivervanus-labs vanus
- CVE-2026-111998Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gatewayvanus-labs vanus
- CVE-2026-78497JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string evalJQ-Lite
- CVE-2026-110895WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerabilityDevItems Support Genix
- CVE-2026-107436WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerabilityWP Chill Strong Testimonials
- CVE-2026-110373WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerabilityHamid Alinia Login with phone number
- CVE-2026-110880WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerabilityKit
- CVE-2026-110886WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerabilityQuantumCloud Conversational Forms for ChatBot
- CVE-2026-109895WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerabilityArraytics Booktics
- CVE-2026-109894WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerabilityArraytics Booktics
- CVE-2026-110883WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerabilityVideoWhisper.com 2Way VideoCalls and Random Chat
- CVE-2026-110383WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerabilityWP E-Signature Electronic Signature Add-on for Fluent Forms
- CVE-2026-110897WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityIdeaBox Creations PowerPack Lite for Beaver Builder