CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-64944Apache Answer: Stored XSS via unsanitized HTML in imported question contentApache Software Foundation Apache Answer
- CVE-2026-64943Apache Answer: API keys logged in plaintext during authenticationApache Software Foundation Apache Answer
- CVE-2026-112188MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name ResolutionMISP
- CVE-2026-108837Apache Kylin: Potential computed-column resource exhaustionApache Software Foundation Apache Kylin
- CVE-2026-108833Apache Kylin: default startup profile miss security settingsApache Software Foundation Apache Kylin
- CVE-2026-108823Apache Kylin: Potential unauthenticated job metadata replacementApache Software Foundation Apache Kylin
- CVE-2026-108780Apache Kylin: Potential JDBC source configuration validation issueApache Software Foundation Apache Kylin
- CVE-2026-108776Apache Kylin: tables/names SparkSQL injectionApache Software Foundation Apache Kylin
- CVE-2026-108771Apache Kylin: unauthenticated broadcast API and polymorphic deserializationApache Software Foundation Apache Kylin
- CVE-2026-108766Apache Kylin: missing JDBC-config authorizationApache Software Foundation Apache Kylin
- CVE-2026-112184MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form LabelsMISP
- CVE-2026-108764Apache Kylin: job-driver UI proxy SSRFApache Software Foundation Apache Kylin
- CVE-2026-108762Apache Kylin: delete metadata backup path-confinement bypassApache Software Foundation Apache Kylin
- CVE-2026-112183MISP CSS Injection via Remote Tag Colour in Event PreviewMISP
- CVE-2026-112100DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.init code injectionDeepPavlov
- CVE-2026-110887WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerabilityHivePress
- CVE-2026-111398WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerabilityPT Norther Lights Production MapSVG
- CVE-2026-110898WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2026-111407WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS
- CVE-2026-111408WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerabilityExpressTech Quiz And Survey Master
- CVE-2026-110379WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerabilityAys Pro Quiz Maker
- CVE-2026-111406WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerabilityPT Norther Lights Production MapSVG
- CVE-2026-112098DeepPavlov Config Reference Resolver params.py resolve code injectionDeepPavlov
- CVE-2026-112180MISP Incomplete Event Deletion Leaves Orphaned Sensitive RecordsMISP
- CVE-2026-112179MISP Event Synchronization Exposes Non-Exportable Tags on Remote InstancesMISP
- CVE-2026-112178MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access ControlMISP
- CVE-2026-112097SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scriptingSourceCodester Inventory System
- CVE-2026-13695SQL Injection in the Integratec ApplicationIntegratec
- CVE-2026-104679VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity referencesYamaha VOCALOID6 Editor
- CVE-2026-112096SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scriptingSourceCodester Inventory System