CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-103312Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN CallbackPayment Integration Wompi
- CVE-2026-103332Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret KeyPayex Payment Gateway for Woocommerce
- CVE-2026-117472URL prefix handling permits API key read-scope bypass in Psono Serveresaqa Psono
- CVE-2026-117471User-controlled Duo host permits authenticated SSRF in Psono Serveresaqa Psono
- CVE-2026-117470WebAuthn assertion replay permits second-factor bypass in Psono Serveresaqa Psono
- CVE-2026-117469File-transfer type confusion permits unauthorized repository writes in Psono Serveresaqa Psono
- CVE-2026-117468Device-code claim permits restricted token escalation in Psono Serveresaqa Psono
- CVE-2026-111820Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Titledeconf Analytics Insights – Google Analytics Dashboard for…
- CVE-2026-88781Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory…ASUS motherboards firmware
- CVE-2026-116640Saruf-Ratul HR-Payroll-Management-System chat.php cross site scriptingSaruf-Ratul HR-Payroll-Management-System
- CVE-2026-116639MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scriptingMD-MAFUJUL-HASAN Online-Payroll-Management-System
- CVE-2026-116839A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found Ubiquiti airMAX M
- CVE-2026-116838A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability…Ubiquiti airMAX M
- CVE-2026-116623code-projects Simple Content Management System Admin welcome.php authorizationcode-projects Simple Content Management System
- CVE-2026-116837A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU…Ubiquiti airMAX M · Ubiquiti LTU PTMP +2
- CVE-2026-116844Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT Pfclairamb ftpserverlib · Syncplify Server!
- CVE-2026-116843Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Modemistralai mistral-vibe
- CVE-2026-116842DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dupdiasurgical DevilutionX
- CVE-2026-116841DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookupdiasurgical DevilutionX
- CVE-2026-116840llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_readerggml-org llama.cpp
- CVE-2026-116829llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_readerggml-org llama.cpp
- CVE-2026-116816llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizerggml-org llama.cpp
- CVE-2025-71439llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_infoggml-org llama.cpp
- CVE-2024-58400llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDsggml-org llama.cpp
- CVE-2024-58399llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsetsggml-org llama.cpp
- CVE-2026-116836A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS)…Ubiquiti airMAX M
- CVE-2026-116620Tencent RapidJSON Regex stream.h Take out-of-boundsTencent RapidJSON
- CVE-2026-116608DAMO Academy VideoLLaMA2 Model Loading init.py load_pretrained_model integrity checkDAMO Academy VideoLLaMA2
- CVE-2026-116605SourceCodester Online Food Ordering System order.php client-side enforcement of server-side securitySourceCodester Online Food Ordering System
- CVE-2026-107067An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information