CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-113674GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing ModificationGeoDirectory
- CVE-2026-113673GeoDirectory < 2.8.194 - Admin+ RCE via DB Text ExportGeoDirectory
- CVE-2026-113493GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width AttributeGeoDirectory
- CVE-2026-113492GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX ActionGeoDirectory
- CVE-2026-113491GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path TraversalGeoDirectory
- CVE-2026-113490GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST EndpointGeoDirectory
- CVE-2026-113489GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDORGeoDirectory
- CVE-2026-112207Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download LinkDownload Monitor
- CVE-2026-110956asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA ValidationasVereinbase
- CVE-2026-105199Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container IDPixel Tag Manager for WooCommerce
- CVE-2026-97353News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_formNews Kit Addons For Elementor
- CVE-2026-97352News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importerNews Kit Addons For Elementor
- CVE-2026-107907MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlistMAS Videos
- CVE-2026-87835Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-AssignmentFront End Users
- CVE-2026-107887Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_themeAdvanced Twenty Seventeen
- CVE-2026-115806Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replacecodexonics Prime Mover – Backup and Migration
- CVE-2026-115807User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attributecozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2026-115929MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAsMongoDB Compass
- CVE-2026-115931Arbitrary file read and backend crash through unrestricted provider method callsGitroomHQ postiz-app
- CVE-2026-115938Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCEcraftcms cms
- GHSA-H4FR-CMH5-QR62Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project rootfallow · @fallow-cli/fallow-node +3
- GHSA-F2HQ-32VH-53CCpostal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded wordspostal-mime
- GHSA-8C8M-P3M8-CJG8Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientnodemailer
- GHSA-M943-M63M-W62WNodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientnodemailer
- CVE-2026-115937Unauthenticated payment reuse allows unpaid orders to be marked as paidcraftcms commerce-mollie
- CVE-2026-115801Kakao khaiii JSON Config File Linear.cpp open out-of-boundsKakao khaiii
- GHSA-XMJ3-9GF7-H52Wsetuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Descriptionsetuptools
- CVE-2026-115935Control panel only API response emulation replaces "securityKey" and reaches server RCEcraftcms cms
- CVE-2026-115897Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodyyahoo serialize-javascript · serialize-javascript
- CVE-2026-115895Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executioncapricorn86 happy-dom · happy-dom