CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-107147Authentication bypass by spoofing in twofactor_gauthenticatoralexandregz twofactor_gauthenticator
- CVE-2026-107146Insufficient session expiration in twofactor_gauthenticatoralexandregz twofactor_gauthenticator
- CVE-2026-107145Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticatoralexandregz twofactor_gauthenticator
- CVE-2026-102787Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5phoca.cz Phoca Download extension for Joomla
- CVE-2026-102788Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2balbooa.com Gridbox extension for Joomla
- CVE-2026-102789Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2balbooa.com Gridbox extension for Joomla
- CVE-2026-117493Multiple vulnerabilities in Sisense’s Cloud BI PlatformSisense Cloud BI Platform
- CVE-2026-85299Missing Authorization in Compute Engine allows Cross-Project Disk ExfiltrationGoogle Cloud Compute Engine
- CVE-2026-92885Qode Membership <= 2.0.6.2 - Authentication Bypass via Social LoginQode Themes Qode Membership
- CVE-2026-65213Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerabilitySMCI MBD-X12SPI
- CVE-2026-65211Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerabilitySMCI MBD-X12SPI
- CVE-2026-65210Supermicro BMC IPMI feature contains Arbitrary File Access vulnerabilitySMCI MBD-X12SPI
- CVE-2026-65220Supermicro BMC IPMI feature contains a Privilege escalation vulnerabilitySMCI MBD-X12SPI
- CVE-2026-65219Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerabilitySMCI MBD-X12SPI
- CVE-2026-18451Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch tokenSMCI MBD-X12SPI
- CVE-2026-18450Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerabilitySMCI X12SPI
- CVE-2026-10511Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameterartbees Jupiter X Core
- CVE-2026-18449Supermicro BMC contains a SMCRAKP Fixed Key vulnerabilitySMCI X12SPI
- CVE-2026-107472Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts QtQt
- CVE-2026-16521Supermicro BMC's syslog feature contains a command injection vulnerabilitySMCI MBD-X12STW-F
- CVE-2026-111461SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE SeriesMoxa OnCell G3150A-LTE Series
- CVE-2026-101034Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentialsBroadcom Symantec Ghost Solution Suite
- CVE-2026-111460Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE SeriesMoxa OnCell G3150A-LTE Series
- CVE-2026-111459Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)Moxa Remote Connect Suite
- CVE-2026-106174A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network…Fortinet FortiOS
- CVE-2026-105946Out-of-bounds read vulnerability in NTLM authentication handling impacts Qtqt
- CVE-2026-103325TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC BypassTiendaCrypto para WooCommerce
- CVE-2026-103359PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook ForgeryPayDunya WooCommerce Payment Gateway
- CVE-2026-110910qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injectionljharb qs
- CVE-2026-75891Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpointthemeum Kirki – Freeform Page Builder, Website Builder & Cu…