CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-112038diem-project diem Version Check Service dmAdminCtrl.js html cross site scriptingdiem-project diem
- CVE-2026-112037diem-project diem Google Analytics Client gapi.class.php certificate validationdiem-project diem
- CVE-2026-108984GV-ASManager Web Server Buffer Overflow VulnerabilityGeoVision GV-ASManager
- CVE-2026-108983GV-ASManager Web Server Command Injection VulnerabilityGeoVision GV-ASManager
- CVE-2026-112036Artifex MuPDF Signature Locking pdf-xref.c free_char_list double freeArtifex MuPDF
- CVE-2026-112035aircheng-org iWebShop-5 simple.php send_message_mobile password recoveryaircheng-org iWebShop-5
- CVE-2026-112034aircheng-org iWebShop-5 Login Redirect _userInfo.php redirectaircheng-org iWebShop-5
- CVE-2026-112033aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgeryaircheng-org iWebShop-5
- CVE-2025-52290NULL pointer dereference
- CVE-2025-55654A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial
- CVE-2025-55667GPAC MP4Box denial of service
- CVE-2025-60480Heap buffer overflow
- CVE-2025-60482Use-after-free
- CVE-2026-107081SQL injection
- CVE-2026-107082Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and
- CVE-2026-107083SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_
- CVE-2026-107084Cross-site request forgery (CSRF)
- CVE-2026-38671Cross-site scripting (XSS)
- CVE-2026-112032aircheng-org iWebShop-5 util.php search sql injectionaircheng-org iWebShop-5
- CVE-2026-112031Chamilo LMS Ticket TicketManager.php addProject cross site scriptingChamilo LMS
- CVE-2026-112030diem-project diem dmDataLoad.php default passworddiem-project diem
- CVE-2026-112112An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by…nic BIRD
- CVE-2026-112029diem-project diem SHA1 PluginDmUser.class.php weak password hashdiem-project diem
- CVE-2026-112028light0011 cms Vote VoteController.class.php logic errorlight0011 cms
- CVE-2026-112111The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcodeBootstrap Shortcodes project Bootstrap Shortcodes
- CVE-2026-112027light0011 cms Uploadify check-exists.php file_exists file information disclosurelight0011 cms
- CVE-2026-112026light0011 cms UserModel.class.php sha1 weak password hashlight0011 cms
- CVE-2026-112025light0011 cms Captcha Validation UserController.class.php access controllight0011 cms
- CVE-2026-97859Gitea API disclosure of private user social graph, keys and starsGitea
- CVE-2026-97204Gitea label deletion across repository and organization IDsGitea