CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-89286FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log FileFormFlow for GoHighLevel
- CVE-2026-91047ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' ParameterElementsReady Addons for Elementor
- CVE-2026-91046ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing AuthorizationElementsReady Addons for Elementor
- CVE-2026-106933Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG UploadBlaze Demo Importer
- CVE-2026-106028ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon CreationActiveTrail for WooCommerce
- CVE-2026-76739HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC file modificationHewlett Packard Enterprise HPE Compute Scale-up Server 3… +1
- CVE-2026-112083sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of servicesgl-project SGLang
- CVE-2026-112082sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of servicesgl-project SGLang
- CVE-2026-112081hankcs HanLP Model Config Loading reflection.py hanlp.load deserializationhankcs HanLP
- CVE-2026-108120path traversal inKoozali - SME Serverkoozali SME Server
- CVE-2026-108121Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of ServiceKoozali SME Server
- CVE-2026-112080LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injectionLlamaChinese Llama-Chinese
- CVE-2026-112079hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserializationhankcs HanLP
- CVE-2026-112078RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injectionRVC-Project Retrieval-based-Voice-Conversion-WebUI
- CVE-2026-112077radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanismradareorg radare2
- CVE-2026-112076A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28alexta69 MeTube
- CVE-2026-111440JDBC LogFactory 任意类加载/构造导致潜在 RCEopenGauss-server openGauss-connector-jdbc
- CVE-2026-112075unslothai unsloth sentence_transformer.py externally-controlled input to select classes or codeunslothai unsloth
- CVE-2026-112074Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflowTencent ncnn
- CVE-2026-112073Tencent ncnn MatMul matmul.cpp matmul_transb out-of-boundsTencent ncnn
- CVE-2026-112045donetick History Deletion model.go CanDeleteHistory improper authorizationdonetick
- CVE-2026-112044dotnet eShop Catalog API Extensions.cs AddApplicationServices improper authenticationdotnet eShop
- CVE-2026-111441HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写openGauss-server
- CVE-2026-112043calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorizationcalcom cal.com · calcom cal.diy
- CVE-2026-103091Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)Google SAM
- CVE-2026-102503Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)Google SAM
- CVE-2026-112042diem-project diem dmWidget dmBaseLinkTag.php text cross site scriptingdiem-project diem
- CVE-2026-112041diem-project diem dmString.php random weak prngdiem-project diem
- CVE-2026-112040diem-project diem Sign-In BasedmUserActions.class.php redirectdiem-project diem
- CVE-2026-112039diem-project diem Administrative Console actions.class.php append cross site scriptingdiem-project diem