CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-106647Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID CollisionRoyal Addons for Elementor
- CVE-2026-106003Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and DeletionCourt Reservation
- CVE-2026-106002Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge DeletionCourt Reservation
- CVE-2026-105997Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary RecipientBooking Package
- CVE-2026-105972WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation AttributeMenu Cart for WooCommerce
- CVE-2026-104694Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' ParameterThrive Automator
- CVE-2026-103688Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File UploadCheckout Files Upload for WooCommerce
- CVE-2026-103382Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment ConfirmationCasso Flow
- CVE-2026-103372Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key DisclosurePayconiq
- CVE-2026-103331UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Payment Forgery via Empty IPN SecretUniPAY Payment Gateway For WooCommerce
- CVE-2026-15323Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON UploadKing-Theme Product Designer for WooCommerce WordPress | Lum…
- CVE-2026-109236Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameterzorem Customer Email Verification for WooCommerce
- CVE-2026-115522Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for PythonGoogle Agent Development Kit (ADK) for Python
- CVE-2026-104384Insufficiently protected credentials in EagleCloud Aquila on-premises versionEagleCloud Aquila
- CVE-2026-104383Code injection in EagleCloud Aquila on-premises versionEagleCloud Aquila
- CVE-2026-99100wifi: p54: validate firmware record lengthsLinux
- CVE-2026-118276a2ui-project a2ui Parser expression_parser.ts formatString resource consumptiona2ui-project a2ui
- CVE-2026-111727Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parametercodepeople Appointment Booking Calendar
- CVE-2026-1928Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Executionrankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…
- CVE-2026-116613Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attributebplugins Animated Text Block – Add Typing and Looping Text…
- CVE-2026-111255affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parametercservit affiliate-toolkit – Multi-Network Affiliate & Amazo…
- CVE-2026-118275a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumptiona2ui-project a2ui
- CVE-2026-118384GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.GNU mtools
- CVE-2026-118274a2ui-project a2ui Binder generic-binder.ts resource consumptiona2ui-project a2ui
- CVE-2026-118273a2ui-project a2ui data-model.ts DataModel.set resource consumptiona2ui-project a2ui
- CVE-2026-107745AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parametertigroumeow AI Engine – MCP Server & AI Chatbot for WordPres…
- CVE-2026-109209All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPCplugins360 All-in-One Video Gallery – Video Player & Galler…
- CVE-2026-111314affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parametercservit affiliate-toolkit – Multi-Network Affiliate & Amazo…
- CVE-2026-97019AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attributemohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2026-109999AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameternalam-1 AI Marketing Expert — AI Email Marketing, AI Conten…