CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-115950WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityWP Smart Widgets Better Post & Filter Widgets for Elementor
- CVE-2026-115951WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerabilityKevin Weber Lazy Load for Videos
- CVE-2026-116256geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgerygeesondog RhaPHP
- CVE-2026-115948WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-114709WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityIgor Funa Ad Inserter
- CVE-2026-115949WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerabilityWP Smart Widgets Better Post & Filter Widgets for Elementor
- CVE-2026-115614WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerabilityMagepeople Booking and Rental Manager
- CVE-2026-97255WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerabilityWProyal Royal Elementor Addons
- CVE-2026-97254WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerabilityWProyal Royal Elementor Addons
- CVE-2026-97295WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-112865WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerabilityWProyal Royal Elementor Addons
- CVE-2026-116255PGYER codefever URI Sanitizer doc.php _detail path traversalPGYER codefever
- CVE-2026-110377WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerabilityVillaTheme Bopo – WooCommerce Product Bundle Builder
- CVE-2026-115602WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerabilityLiquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
- CVE-2026-115613WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins Image Gallery block – Create and display photo gal…
- CVE-2026-115958WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerabilityWP Discussion Board
- CVE-2026-4316Reflected Cross-Site Scripting in software IsMyGym by Zuinq StudioZuinq Studio IsMyGym
- CVE-2026-116254rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validationrathena FluxCP
- CVE-2026-112250Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log FilesBizerba SE & Co. KG BRAIN2
- CVE-2026-116253DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injectionDedeCMS
- CVE-2026-103377Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La ManchaVideo library of the Regional Parliament of Castile-La Manc…
- CVE-2026-116237Oray Pugongying X5 Pro Dnsmasq crlf injectionOray Pugongying X5 Pro
- CVE-2026-116236Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted uploadOray Pugongying X5 Pro
- CVE-2026-82947Multiple Out-of-Bounds Reads in Frame ProcessingRT-Labs AB SOEM
- CVE-2026-113438Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain confiImplem Pleasanter
- CVE-2026-82946Null Pointer Dereference in Mailbox Error HandlingRT-Labs AB SOEM
- CVE-2026-82945Memory Corruption via FMMU Configuration Table OverflowRT-Labs AB SOEM
- CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)Apache Software Foundation org.apache.camel:camel-docling
- CVE-2026-82944Buffer Overflow in CoE SDO Upload Multi-Segment Data TransfersRT-Labs AB SOEM
- CVE-2026-110376WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerabilityVillaTheme DEPART