CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-112161Lack of integrity checks in Mobatek’s MobaXtermMobatek MobaXterm
- CVE-2026-112095SourceCodester Inventory System Product Management products_handler.php save cross site scriptingSourceCodester Inventory System
- CVE-2026-111438check_hba_replication 认证与访问控制绕过openGauss-server
- CVE-2026-112094michaelrsweet mxml mxml-file.c mxml_load_data use after freemichaelrsweet mxml
- CVE-2026-111439pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块openGauss-server
- CVE-2026-112093subhajitkhan online-clinic-management-system feedback.php cross site scriptingsubhajitkhan online-clinic-management-system
- CVE-2026-112092subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scriptingsubhajitkhan online-clinic-management-system
- CVE-2026-112091Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosureDav-ee dairy-management-system
- CVE-2026-112090Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injectionDav-ee dairy-management-system
- CVE-2026-94294App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.phpApp Builder
- CVE-2026-94272Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX ActionsSnap Finance
- CVE-2026-94231TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and ModificationTrueBooker
- CVE-2026-94230TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX ActionsTrueBooker
- CVE-2026-94229TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' ParameterTrueBooker
- CVE-2026-94228TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_dataTrueBooker
- CVE-2026-91831Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name SettingSubscribe to Comments
- CVE-2026-86791iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation ForgeryiPOSpays Payment Gateway for WooCommerce
- CVE-2026-74922Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature BypassDocument Gallery
- CVE-2026-74921Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode AttributesDocument Gallery
- CVE-2026-110034Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount CodeSalon Booking System
- CVE-2026-106010BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation ForgeryBDM Digital Payment Gateway
- CVE-2026-103311The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to…Coinbase Commerce Payment Gateway for WooCommerce
- CVE-2026-112089Dav-ee dairy-management-system delete.php mysqli_query sql injectionDav-ee dairy-management-system
- CVE-2026-16460Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalizationRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-112088Dav-ee dairy-management-system add.php mysqli_query sql injectionDav-ee dairy-management-system
- CVE-2026-76740HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerabilityHewlett Packard Enterprise HPE Compute Scale-up Server 3… +2
- CVE-2026-112087itsourcecode Online Cake Ordering System confirm.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2026-112086ESPnet Inference Model inference_model.py build_model deserializationESPnet
- CVE-2026-94273Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_paymentSnap Finance
- CVE-2026-106014Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback ForgeryGateway for Vantiv on WC