CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-111841WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerabilityAman FunnelKit Automations
- CVE-2026-112828WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerabilityMeow Apps AI Engine
- CVE-2026-116235Oray Pugongying X5 Pro L2TP Authentication crlf injectionOray Pugongying X5 Pro
- CVE-2026-95629Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary DirectoryApache Software Foundation org.apache.camel:camel-docling
- CVE-2026-95663Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by…Apache Software Foundation org.apache.camel:camel-keycloak
- CVE-2026-82943Out-of-Bounds Read via Unchecked Length ValuesRT-Labs AB SOEM
- CVE-2026-95664Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple ExpressionsApache Software Foundation Apache Camel
- CVE-2026-101259Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer ExceptionsApache Software Foundation org.apache.camel:camel-coap
- CVE-2026-116372MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rulesmisp-guard
- CVE-2026-70388Memory Corruption via Integer Underflow in Message Length ValidationRT-Labs AB SOEM
- CVE-2026-116234Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injectionOray Pugongying X5 Pro
- CVE-2026-116233Oray Pugongying X5 Pro Dnsmasq crlf injectionOray Pugongying X5 Pro
- CVE-2026-115425Multiple cross-site scripting (XSS) in OPNsenseOPNsense firewall
- CVE-2026-116232Oray Pugongying X5 Pro SNMP snmp_set crlf injectionOray Pugongying X5 Pro
- CVE-2026-116231Oray Pugongying X5 Pro Ser2net crlf injectionOray Pugongying X5 Pro
- CVE-2026-116230Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserializationNdemic Creations Plague Inc Evolved
- CVE-2026-96581An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's recordsash-project ash · ash
- CVE-2026-116229ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scriptingffxiv-teamcraft FFXIV Teamcraft
- CVE-2026-103300Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified CallbackEurobank WooCommerce Payment Gateway
- CVE-2026-111974GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via CurrencyGiveWP
- CVE-2026-116228777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication777genius agent-teams-ai
- CVE-2026-116227Edimax BR-6208AC Virtual Server cross site scriptingEdimax BR-6208AC
- CVE-2026-116224fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgeryfr0tt benotes
- CVE-2026-107900V-SFT provided by FUJI ELECTRIC CO., LTD.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-107899V-SFT provided by FUJI ELECTRIC CO., LTD.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-107898V-SFT provided by FUJI ELECTRIC CO., LTD.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-107897V-SFT provided by FUJI ELECTRIC CO., LTD.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-107896V-SFT provided by FUJI ELECTRIC CO., LTD.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-107895V-SFT provided by FUJI ELECTRIC CO., LTD.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2026-107894V-SFT provided by FUJI ELECTRIC CO., LTD.FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT