CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116000Zylon PrivateGPT server-side request forgery in URI file loaderZylon PrivateGPT
- CVE-2026-115999mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injectionmansi-k Restaurant_IMS
- CVE-2026-115997pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injectionpig-mesh pig
- CVE-2026-115996Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validationUnitree Robotics Unitree Go2
- CVE-2026-115995Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injectionUnitree Robotics Unitree Go2
- CVE-2026-115982phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scriptingphpIPAM
- CVE-2026-115981phpIPAM index.php cross site scriptingphpIPAM
- CVE-2026-114820Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).Oracle Java SE · Oracle GraalVM for JDK +1
- CVE-2026-115973FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recoveryFaveoSuite Faveo Helpdesk
- CVE-2026-115972FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorizationFaveoSuite Faveo Helpdesk
- CVE-2026-115971Travisun Opptrix preParsing handler webhook Buffer.concat denial of serviceTravisun Opptrix
- CVE-2026-115970Travisun Opptrix Import Endpoint import code injectionTravisun Opptrix
- CVE-2026-115969Travisun Opptrix Schedule API setup command injectionTravisun Opptrix
- CVE-2026-115933Forged signed tokens let any registered user take over other users and organizationsGitroomHQ postiz-app
- CVE-2026-115557Distrust compromised intermediate certificates in ssl modulePython Software Foundation CPython · libpython +2
- CVE-2026-114191WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerabilityKnit Pay UPI QR Code Payment Gateway for WooCommerce
- CVE-2026-114704WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerabilityChristoph Vielgrader Relevanssi
- CVE-2026-114192WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerabilityMagepeople WpEvently
- CVE-2026-114629Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parametersWeb-Simple
- CVE-2026-115932Path traversal in post media lets any registered user read server filesGitroomHQ postiz-app
- RUSTSEC-2026-0408Aliasing violations in splice, mutable iteration and cursorsskiplist
- RUSTSEC-2026-0409Use-after-free from a comparator that answers inconsistentlyskiplist
- CVE-2026-116020BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft PagesBookStackApp BookStack
- CVE-2026-116019Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directivesgetgrav grav
- CVE-2026-116018ONEARMY community-platform before 2.165.2 IDOR via notification read endpointONEARMY community-platform
- CVE-2026-116017Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpointxinnan-tech xiaozhi-esp32-server
- CVE-2026-116016yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable HeaderYunaiV yudao-cloud
- CVE-2026-116015yudao-cloud through 2026.09 IDOR via after-sale-log list endpointYunaiV yudao-cloud
- CVE-2026-116014open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataTypeopen62541
- CVE-2026-116013OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsingopenresty lua-resty-dns