CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-78845Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are…
- CVE-2026-116604SourceCodester Online Food Ordering System delete_admin.php missing authenticationSourceCodester Online Food Ordering System
- CVE-2026-116603SourceCodester Online Food Ordering System add_food.php unrestricted uploadSourceCodester Online Food Ordering System
- CVE-2026-111422Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote hostApache Software Foundation Apache Airflow SSH provider
- CVE-2026-116828YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operandyeswiki
- CVE-2026-116827YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Importyeswiki
- CVE-2026-116826YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFileyeswiki
- CVE-2026-116825YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inboxyeswiki
- CVE-2026-116824YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handleryeswiki
- CVE-2026-116823YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallbackyeswiki
- CVE-2026-116822YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameteryeswiki
- CVE-2026-116821YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernamesyeswiki
- CVE-2026-116820YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameteryeswiki
- CVE-2026-116819OpenPanel before 3.0.0 Credential Disclosure via notification.rules QueryOpenpanel-dev openpanel
- CVE-2026-116818OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocketOpenpanel-dev openpanel
- CVE-2026-116817OpenPanel before 3.0.0 Missing Authentication on Worker Bull BoardOpenpanel-dev openpanel
- CVE-2026-116815OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.tsOpenpanel-dev openpanel
- CVE-2026-116814OpenPanel before 3.0.0 Sensitive Information Exposure via Application LogsOpenpanel-dev openpanel
- CVE-2026-116813OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.tsOpenpanel-dev openpanel
- CVE-2026-116812OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filterOpenpanel-dev openpanel
- CVE-2026-116811OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript TemplateOpenpanel-dev openpanel
- CVE-2026-116810OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferencesOpenpanel-dev openpanel
- CVE-2026-116809OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC ProcedureOpenpanel-dev openpanel
- CVE-2026-116808OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.valuesOpenpanel-dev openpanel
- CVE-2026-116807OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC QueryOpenpanel-dev openpanel
- CVE-2026-116806OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC MutationOpenpanel-dev openpanel
- CVE-2026-116805OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.listOpenpanel-dev openpanel
- CVE-2026-116804DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Contentcure53 DOMPurify · dompurify
- CVE-2026-116803DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtreescure53 DOMPurify · dompurify
- CVE-2026-116802DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Modecure53 DOMPurify · dompurify