CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-110474Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre applicationCreditNirvana Agentic AI Call Centre
- CVE-2026-115720Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirectfrappe builder
- CVE-2026-116263HaschekSolutions PictShare File Upload core.php architect race conditionHaschekSolutions PictShare
- RUSTSEC-2026-0412Arbitrary code execution when rerunning tests from a portable recordingcargo-nextest
- RUSTSEC-2026-0413Use-after-free of caller-owned server name in client connection constructorsrustls-ffi
- CVE-2026-105947Arbitrary File Read in Innotim Software's Logsign SIEMInnotim Software, Telecommunications, and Consulting Co. Lo…
- CVE-2026-116262libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflowlibimobiledevice
- CVE-2026-115717Frappe Builder before 1.36.1 SSRF via convert_to_webpfrappe builder
- CVE-2026-115718Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_promptfrappe builder
- CVE-2026-96432Null pointer dereference vulnerability in QNetworkAccessManager impacts Qtqt
- CVE-2026-116261libimobiledevice AFC File afc.c afc_file_open out-of-boundslibimobiledevice
- CVE-2026-94380Host Header Injection in HAVELSAN's Liman MYSHAVELSAN Liman MYS
- CVE-2026-116260libimobiledevice AFC Service afc.c service_receive double freelibimobiledevice
- CVE-2026-116259libimobiledevice Device Info afc.c afc_get_device_info_key memory corruptionlibimobiledevice
- CVE-2026-116258libimobiledevice AFC afc.c heap-based overflowlibimobiledevice
- CVE-2026-89209A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All…Siemens Mendix SAML
- CVE-2026-114708WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetSmartFilters
- CVE-2026-115595WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerabilityContact Form by Supsystic
- CVE-2026-116469MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwardingmisp-guard
- CVE-2026-115959WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerabilityWPExperts APIExperts Square for WooCommerce
- CVE-2026-115960WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerabilityWPExperts APIExperts Square for WooCommerce
- CVE-2026-115955WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins Advanced Post Block - Post Grid for WordPress bloc…
- CVE-2026-115956WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilitybPlugins Panorama Viewer – 360 Degree Image + Video Viewer
- CVE-2026-115961WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilitybPlugins B Slider
- CVE-2026-116257BillaBear Installation InstallController.php processInstall missing authenticationBillaBear
- CVE-2026-114707WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetElements For Elementor
- CVE-2026-115594WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-115608WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerabilityCrocoblock JetEngine
- CVE-2026-115953WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerabilityDylan Kuhn Geo Mashup
- CVE-2026-115954WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerabilityDylan Kuhn Geo Mashup