CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-107188Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code ExecutionEptura Archibus
- CVE-2026-111862Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious CodeRankMath Rank Math SEO PRO
- CVE-2026-107187Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive TablesEptura Archibus
- CVE-2026-107186Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session ReuseEptura Archibus
- CVE-2026-111061russh agent server converts constraint records into unbounded never-rolled-back tasksEugeny russh · russh
- CVE-2026-112190Webkul Aureus ERP composer.json insertion of sensitive information into debugging codeWebkul Aureus ERP
- CVE-2025-7043Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource ConsumptionWSO2 API Manager · WSO2 Universal Gateway +2
- CVE-2025-6623Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and RedirectionWSO2 API Manager · WSO2 Universal Gateway +4
- CVE-2026-112159JumpServer Template Rendering os command injectionJumpServer
- CVE-2026-103038PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP hostStreamSoft PingTools Network Utilities
- CVE-2026-111059Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLmljar mercury · mercury
- CVE-2026-111058Mercury: Unauthenticated Remote Code Execution via /api/kernelsmljar mercury · mercury
- CVE-2026-111057Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassmljar mercury · mercury
- CVE-2026-111056FOSSBilling: Unauthenticated client account enumeration via guest signup endpointFOSSBilling
- CVE-2026-112158MikroTik RouterOS ipt_SAME.ko same_check integer overflowMikroTik RouterOS
- CVE-2026-111053FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_existsFOSSBilling
- CVE-2026-111046FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensionsFOSSBilling
- CVE-2026-112368Unbounded Recursion in phongo_bson_visit_document/visit_array:MongoDB PHP Driver
- CVE-2026-112157MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumptionMemTensor memmy-agent
- CVE-2026-111045CLI Bridge: High-severity sandbox escape via dangling symlinkanshupriyan cli-bridge
- CVE-2026-12254Netskope Client Captive Portal WebView Persistence allowing SWG bypass issueNetskope Client
- CVE-2026-107571Incorrect Default Permissions in hMailServerProgressive Robot hMailServer
- CVE-2026-107569Unchecked Input for Loop Condition in hMailServerProgressive Robot hMailServer
- CVE-2026-107566Missing Authorization in hMailServerProgressive Robot hMailServer
- CVE-2026-107568Missing Authorization in hMailServerProgressive Robot hMailServer
- CVE-2026-107567Use of Less Trusted Source in hMailServerProgressive Robot hMailServer
- CVE-2026-112153vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injectionvraj404 Criminal-Management-System
- CVE-2026-112366Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patternsmicromatch picomatch
- CVE-2026-112363Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfounclecode crawl4ai
- CVE-2026-112310docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRefdocling-project docling-core