CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-59106Unauthenticated RCE Vulnerability in WolfProt interface implementationWolfVision Cynap Pure (Next Gen), Cynap Bridge · WolfVis… +2
- CVE-2026-116488NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class DriversNXP mcuxsdk-middleware-usb
- CVE-2026-116487NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds ReadNXP mcuxsdk-middleware-usb
- CVE-2026-116486Objenesis before 3.6 Type Confusion via Class Name Instantiator Cacheeasymock objenesis
- CVE-2026-116485danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpointshuangxd- danmu_api
- CVE-2026-116219Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameterdolibarr
- CVE-2026-116218Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type fielddolibarr
- CVE-2026-116217RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.phpfrancoisjacquet rosariosis
- CVE-2026-116216MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignmentmaccmspro maccms10 · magicblack maccms10
- CVE-2026-116215MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemptionmaccmspro maccms10 · magicblack maccms10
- CVE-2026-116214MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Codemaccmspro maccms10 · magicblack maccms10
- CVE-2026-116213Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar SymlinksWebasyst Framework
- CVE-2026-116212Webasyst Framework through 4.4.0 Stored XSS via Photos Album URLWebasyst Framework
- CVE-2026-116210Webasyst Framework through 4.4.0 Photos App CSRF via Backend ActionsWebasyst Framework
- CVE-2026-116281Kameleo Profile Controller t.cs ListProfiles information disclosureKameleo
- CVE-2026-107157Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt FrameworkQt
- CVE-2026-115196An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic.mautic/core
- CVE-2026-115195A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}).mautic/core
- CVE-2026-115194A path traversal vulnerability exists in the Mautic Asset API.mautic/core
- CVE-2026-115193A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7.mautic/core
- CVE-2026-115192An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}).mautic/core
- CVE-2026-116280Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgeryKameleo
- CVE-2026-115191A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax).mautic/core
- CVE-2026-115190An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.mautic/core
- CVE-2026-115189A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic.mautic/core
- CVE-2026-115188An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.mautic/core
- CVE-2026-116275AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injectionAllenAI AllenNLP
- CVE-2026-116492Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup APIfrappe crm
- CVE-2026-110475Improper Authentication Vulnerability in CreditNirvana Collections PlatformCreditNirvana Collections Platform
- CVE-2026-116274JIZHICMS Front-end Order OrderController.php pay improper authorizationJIZHICMS