CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116070Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/configdqzboy Docker-Proxy
- CVE-2026-116069NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain FieldAlbert-Weasker niubigeo
- CVE-2026-116068Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Routerdokploy
- CVE-2026-116067Paisa before 0.7.8 Path Traversal via Editor and Sheet APIananthakumaran paisa
- CVE-2026-116066Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright ServiceFirecrawl
- CVE-2026-116050krupalshah Employee Recruitment System Registration registerform3.php sql injectionkrupalshah Employee Recruitment System
- CVE-2026-116049krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injectionkrupalshah EmployeeRecruitmentSystem
- CVE-2026-116048krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injectionkrupalshah EmployeeRecruitmentSystem
- CVE-2026-116047Privoce Vocechat Query Parameter widget.html cross site scriptingPrivoce Vocechat
- CVE-2026-116046eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversaleventcatalog sdk
- CVE-2026-1160451999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal1999AZZAR designer-mcp
- CVE-2026-115251Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click UpgradeDuplicator
- CVE-2026-115214Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role HeadersDatawiza Proxy Auth Plugin
- CVE-2026-115183Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text WidgetQi Addons For Elementor
- CVE-2026-114743InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settingsInstaWP Connect
- CVE-2026-114742WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDORWPVR
- CVE-2026-114741WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDORWPVR
- CVE-2026-114740WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup WizardWPVR
- CVE-2026-111981GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addressesGiveWP
- CVE-2026-111980GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability GrantGiveWP
- CVE-2026-111979GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary ColorGiveWP
- CVE-2026-111978GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings ImportGiveWP
- CVE-2026-111976GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View RouteGiveWP
- CVE-2026-110285WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing SecretWP Stripe Checkout
- CVE-2025-15705Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSSContact Form by Supsystic
- CVE-2026-94295Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified SignatureChikkili- Google Pay India for Woocommerce
- CVE-2026-116044prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted uploadprasathmani TinyFileManager
- CVE-2026-116007YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authenticationYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-116006YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authenticationYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-116004onyx-dot-app Onyx PreviewTab.tsx cross site scriptingonyx-dot-app Onyx