CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116012Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler ParserNationalSecurityAgency ghidra
- CVE-2026-116011Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()CrowCpp Crow
- CVE-2026-116010RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlersfrancoisjacquet RosarioSIS
- CVE-2026-116009Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Actionowen2345 camaleon-cms
- CVE-2026-116008DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssignBottelet DaybydayCRM
- CVE-2026-110018aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attributekodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…
- CVE-2026-114705WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerabilityquadlayers WP Social Feed Gallery
- CVE-2026-115998IDOR: User reads and modifies findings from other people's projectsCervantesSec cervantes
- CVE-2026-114194WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityIgor Funa Ad Inserter
- CVE-2026-115994BOLA Allows Cross-Project Target TamperingCervantesSec cervantes
- CVE-2026-115993Stored XSS in the “Notes” field of project checklistsCervantesSec cervantes
- CVE-2026-114196WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerabilitypaytiumsupport Paytium
- CVE-2026-114695WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerabilityInfomaniak Network VOD Infomaniak
- CVE-2026-114694WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerabilityPixelite Events Manager
- CVE-2026-114693WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerabilityPlugins360 Labs All-in-One Video Gallery
- CVE-2026-110892WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerabilityBrainstorm Force SureDash
- CVE-2026-114697WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerabilityQuarkA QA Analytics
- CVE-2026-114178WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerabilityBold Grid W3 Total Cache
- CVE-2026-114190WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerabilityHai Zheng / Lite Speed Cache LiteSpeed Cache
- CVE-2026-112866WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerabilityWPFactory Product Filter by WBW
- CVE-2026-94075WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerabilityTribulant Software Newsletters
- CVE-2026-112869WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilityNoah Hearle We’re Open!
- CVE-2026-111402WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerabilityTribulant Software Newsletters
- CVE-2026-112844WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerabilityArraytics WP Event Solution
- CVE-2026-114179WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilitywordplus BP Better Messages
- CVE-2026-115975Broken access control in JiraControllerCervantesSec cervantes
- CVE-2026-115803Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorizationScada-LTS
- CVE-2026-115802InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphereInternScience InternAgent
- CVE-2026-108013HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)HCL Software BigFix Platform
- CVE-2026-114429WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot ContentWPVR