CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-117536REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalationredaxo core
- CVE-2026-117535REDAXO before 5.21.3 Reflected XSS via opener_link in Media Poolredaxo core
- CVE-2026-117534REDAXO before 5.21.3 CSRF in Article History Pluginredaxo core
- CVE-2026-117533REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploadsredaxo core
- CVE-2026-117532REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Pluginredaxo core
- CVE-2026-116900REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgetsredaxo core
- CVE-2026-116899REDAXO before 5.21.4 Broken Access Control in Slice Operationsredaxo core
- CVE-2026-116898REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Moveredaxo core
- CVE-2026-116897REDAXO before 5.21.4 Missing Authorization in Version and History Previewsredaxo core
- CVE-2026-116896REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tablesredaxo core
- CVE-2026-116895REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameterredaxo core
- CVE-2026-116894REDAXO before 5.21.5 Insufficient Session Expiration on Password Changeredaxo core
- CVE-2026-116893REDAXO core before 5.21.5 Missing Authorization in rex_api_package APIredaxo core
- CVE-2026-117466In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.Octopus Deploy Octopus Server
- CVE-2026-117341In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log.Octopus Deploy Octopus Server
- CVE-2026-116870In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently.Octopus Deploy Octopus Server
- CVE-2026-110737Push Endpoint Returns Permissive CORS Headerscom.vaadin:vaadin · com.vaadin:vaadin-core +3
- CVE-2026-116892SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw ProfileSemanticMediaWiki
- CVE-2026-116891SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstateSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-116890Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask APISemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-116889SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code PropertySemanticMediaWiki
- CVE-2026-116888SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group HeadingSemanticMediaWiki
- CVE-2026-116887Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword PropertySemanticMediaWiki
- CVE-2026-116886Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:BrowseSemanticMediaWiki
- CVE-2026-116885Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id ParameterSemanticMediaWiki
- CVE-2026-116884SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data- AttributesSemanticMediaWiki
- CVE-2026-116883Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema DescriptionsSemanticMediaWiki
- CVE-2026-116882Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration LabelsSemanticMediaWiki
- CVE-2026-116881Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value AutocompleteSemanticMediaWiki
- CVE-2026-116880Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance ActionsSemanticMediaWiki