CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-93522X.Org Server Glamor CopyArea Heap Buffer Overflowx.org xorg-x11-server · x.org xwayland
- CVE-2026-116778FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command executionfogproject
- CVE-2026-116776USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoSn-romanovich usb-test
- CVE-2026-56828Shopper: read-only team permissions allow administrator creation and permission escalationshopperlabs shopper · shopper/framework
- CVE-2026-47235SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Arraysimulationcraft simc
- CVE-2026-93521X.Org Server RandR ChangeProviderProperty Heap Buffer Overflowx.org xorg-x11-server · x.org xwayland
- CVE-2026-59979YosemiteCrew: Missing organization authorization on service and PMS library/template routesYosemiteCrew Yosemite-Crew
- CVE-2026-44179XWiki Pro Macros: excerpt-include title and content injection executes codexwikisas xwiki-pro-macros · com.xwiki.pro:xwiki-pro-macros
- CVE-2026-50542Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosurexibosignage xibo-cms
- CVE-2026-118029Unverified ownership of the default Athena query result location in AWS SDK for pandasaws-sdk-pandas
- CVE-2026-50543Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devicesxibosignage xibo-cms
- CVE-2026-112357GFI KerioConnect KOFF < 10.0.9p2 Privilege EscalationGFI USA GFI KerioConnect
- CVE-2026-50539Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachmentsxibosignage xibo-cms
- CVE-2026-112356GFI KerioConnect < 10.0.9p2 XSS via Link Auto-FormatterGFI USA GFI KerioConnect
- CVE-2026-67187Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List FieldsSaturday Drive Ninja Forms
- CVE-2026-115402OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition…OpenVPN ovpn-dco-win
- CVE-2026-93520X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Writex.org xorg-x11-server · x.org xwayland
- CVE-2026-93519X.Org Server XFixes Pointer Barrier Event List Buffer Overflowx.org xorg-x11-server · x.orgg xwayland
- CVE-2026-93518X.Org Server XKB ResizeKeyType Numeric Truncationx.org xorg-x11-server · x.org xwayland
- CVE-2026-115603WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerabilityAdvanced Ads – Tracking
- CVE-2026-115968WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerabilityUltimate Member
- CVE-2026-116390WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerabilitystepasyuk Filter Everything — WordPress & WooComme…
- CVE-2026-116389WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerabilitycrossi72 Phoenix Media Rename
- CVE-2026-115590WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerabilityweDevs Dokan
- CVE-2026-116078HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Banditmtrudel bandit · bandit
- CVE-2026-50541Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Exportxibosignage xibo-cms
- CVE-2026-52729Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletionxibosignage xibo-cms
- CVE-2026-105420Path Traversal in Wing WFTP Server leading to Remote Code ExecutionWing Soft Technology Wing FTP Server
- CVE-2026-59959SAIL: WebP decoder division by zero through malformed animated canvas metadataHappySeaFox sail
- CVE-2026-93517X.Org Server GLX RenderLarge Heap Buffer Overflowx.orgg xorg-x11-server · x.org xwayland