CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-112309@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methodsairjp73 @rvf/set-get
- CVE-2026-112308crewai-tools through 1.15.28 SSRF via SeleniumScrapingToolcrewAIInc crewai-tools
- CVE-2026-112307sqlparse through 0.6.0 PHP Code Injection via output_format='php'andialbrecht sqlparse
- CVE-2026-112306NocoBase plugin-collection-sql through 2.2.46 SQL Injection via sqlCollection:setFieldsnocobase
- CVE-2026-112305Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Overridesemaphoreui Semaphore UI
- CVE-2026-112304docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()Mindee docTR
- CVE-2026-112303GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLsGDevelop
- CVE-2026-112152vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injectionvraj404 Criminal-Management-System
- CVE-2026-109433Camunda Broken Access Control via CockpitCamunda
- CVE-2026-109432Camunda Expression Injection via orQueries RCECamunda
- CVE-2026-109431Camunda Missing Authorization in Task Sub-ResourcesCamunda
- CVE-2026-112151vraj404 Criminal Management System Submission Form home.php sql injectionvraj404 Criminal Management System
- CVE-2026-86375Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerabilityDell Application Installer,
- CVE-2026-112329Sensei LMS 4.26.4 Broken Access Control via save_new_messageAutomattic Sensei LMS
- CVE-2026-112150vraj404 Criminal-Management-System search.php sql injectionvraj404 Criminal-Management-System
- CVE-2026-112328Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAXAutomattic Sensei LMS
- CVE-2026-112149vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted uploadvraj404 Criminal-Management-System
- CVE-2026-112147ai-genius-automations octoally index.ts information disclosureai-genius-automations octoally
- CVE-2026-112146D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentialsD-Link E15 · D-Link M32 +2
- CVE-2026-112296FlyCms through commit edfdf724 Default Super Administrator Credentialssunkaifei FlyCms
- CVE-2026-112295FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_updatesunkaifei FlyCms
- CVE-2026-112294FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpointsunkaifei FlyCms
- CVE-2026-112293BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment APIBoxyHQ saas-starter-kit
- CVE-2026-112292CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rulesoperacle checkcle
- CVE-2026-112291Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task APIFlarum Extension Manager
- CVE-2026-112290MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-itemMI6 Intelligence Community UI Kit canary web components
- CVE-2026-112289Koalixcrm through 1.14.0 Stored XSS via Task Title in Django AdminKoalixSwitzerland koalixcrm
- CVE-2026-112288Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebindingkrayin laravel-crm
- CVE-2026-112287Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Modulekrayin laravel-crm
- CVE-2026-112286Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpointskrayin laravel-crm