CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-111915Yank Note before 3.93.1 Path Traversal via /api/help Endpointpurocean Yank Note
- CVE-2026-111899KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl FetchTomBursch kitchenowl
- CVE-2026-111883Locust through 2.46.7 CSRF via Web UI /stop and /stats/resetlocustio locust
- CVE-2026-112145A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3speaches-ai speaches
- CVE-2026-112144satya-vinay Events-Management-System project.sql file accesssatya-vinay Events-Management-System
- CVE-2026-111828WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerabilityMamunur Rashid Classified Listing
- CVE-2026-112222Surfer broken access control in WordPress SEO pluginSurfer
- CVE-2026-111829WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerabilityWP Mailster
- CVE-2026-110902WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerabilityLiquid Web / StellarWP Event Tickets
- CVE-2026-110008@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback@fastify/oauth2
- CVE-2026-112143satya-vinay Events-Management-System missing authenticationsatya-vinay Events-Management-System
- CVE-2026-8168Denial-of-service vulnerability in the SVG parser and renderer impacts Qtqt
- CVE-2026-112142satya-vinay Events-Management-System Registration-Delete dodelete.php sql injectionsatya-vinay Events-Management-System
- CVE-2026-111845WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerabilityYITH WooCommerce Product Bundles
- CVE-2026-112141satya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injectionsatya-vinay Events-Management-System
- CVE-2026-111831WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerabilityWP ManageNinja FluentForm
- CVE-2026-110363WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2026-111836WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerabilityWP ManageNinja FluentCommunity
- CVE-2026-111414WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetElements For Elementor
- CVE-2026-111410WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerabilityE2Pdf.com e2pdf
- CVE-2026-112214Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parserRed Hat Enterprise Linux
- CVE-2026-103314Stackrox: stackrox: saml response replay allows multiple central authentication tokensRed Hat Advanced Cluster Security for Kubernetes
- CVE-2026-111839WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerabilityVideoWhisper.com Broadcast Live Video
- CVE-2026-112199WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerabilityYITH WooCommerce Wishlist
- CVE-2026-112140llSourcell Doctor-Dignity chat_module.py _get_lib_module code injectionllSourcell Doctor-Dignity
- RUSTSEC-2026-0453SurrealDB memory corruption in KV storage backendssurrealdb
- RUSTSEC-2026-0534libp2p-gossipsub remote memory exhaustion via unbounded PRUNE backoff statelibp2p-gossipsub
- CVE-2026-112139subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injectionsubhajitkhan online-clinic-management-system
- CVE-2026-112210Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.serviceRed Hat Enterprise Linux
- CVE-2026-112138diem-project diem dmCodeEditor actions.class.php join path traversaldiem-project diem