CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-109974All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attributeplugins360 All-in-One Video Gallery – Video Player & Galler…
- CVE-2026-84999Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX HandlerPie Register Premium
- CVE-2026-107625Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Fieldultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-115624GROWI contains a missing authorization check vulnerability in its collaborative editing feature.GROWI
- CVE-2026-109848GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a…GROWI
- CVE-2026-105272GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a…GROWI
- CVE-2026-118378Tabularis before 0.28.0 SQL Injection via MCP describe_table table_nameTabularisDB tabularis
- CVE-2026-118377mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacksmewebstudio pos
- CVE-2026-118376WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 AddressesTencent WeKnora
- CVE-2026-118375llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()ggml-org llama.cpp
- CVE-2026-118374LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP ResponseOpenBSD LibreSSL
- CVE-2026-118373LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()OpenBSD LibreSSL
- CVE-2026-118372LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL PathOpenBSD LibreSSL
- CVE-2026-118371LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request LineOpenBSD LibreSSL
- CVE-2026-118370libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixeslibexpat
- CVE-2026-117610libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparserlibexpat
- CVE-2026-117609rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decodermerbanan rtl_433
- CVE-2026-117608Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflowassimp
- CVE-2026-117607Xerte Online Toolkits through 3.15.5 RCE via Language Pack Importthexerteproject xerteonlinetoolkits
- CVE-2026-117606NexoPOS through 6.3.0 Missing Authorization via Cash Register Session ActionsBlair2004 NexoPOS
- CVE-2026-117605nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup HandlersnopSolutions nopCommerce
- CVE-2015-20129CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/CrushFTP
- CVE-2014-125138C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image FieldsC97net qEngine CMS · C97net Kemana Directory +1
- CVE-2014-125137C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.phpC97net qEngine CMS · C97net Kemana Directory +1
- CVE-2014-125136C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backupC97net qEngine CMS · C97net Kemana Directory +1
- CVE-2013-20009Linksys WAG200G through 1.01.06 Stored XSS via policy_name ParameterLinksys WAG200G
- CVE-2013-20008Linksys WAG200G through 1.01.06 Admin Password Change Without Current PasswordLinksys WAG200G
- CVE-2013-20007Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgiLinksys WAG200G
- CVE-2026-118272a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposurea2ui-project a2ui
- CVE-2026-106013Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameterartbees Jupiter X Core