CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-59185identrail: Cross-tenant GitHub installation binding without ownership verificationidentrail
- CVE-2026-59179OpenHop: Path Traversal in Flow ID File Operationsnaorsabag openhop · @openhop/server
- CVE-2026-59177ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfacesesphome device-builder · esphome-device-builder
- CVE-2026-59176Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Importjordanburke functype · functype-mcp-server
- CVE-2026-59172Joker linter executed project-local .jokerd/linter.* files during lintingcandid82 joker
- CVE-2026-59164NORA missing cross-user token-management authorizationgetnora-io nora
- CVE-2026-93516.Org Server XInput Passive Grab Use-After-Freex.org xorg-x11-server · x.org xwayland
- CVE-2026-116391WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerabilityGS Plugins GS Logo Slider
- CVE-2026-116392WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerabilityPickPlugins Accordion
- CVE-2026-116393WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerabilityiHomefinder Optima Express
- CVE-2026-116404WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerabilityDavid Anderson Redux Framework
- CVE-2026-111850WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerabilityBuddyPress
- CVE-2026-115612WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerabilityiova.mihai SliceWP
- CVE-2026-115591WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerabilityContact Form by Supsystic
- CVE-2026-115593WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerabilityUnlimited Elements For Elementor
- CVE-2026-115596WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerabilityimpleCode eCommerce Product Catalog
- CVE-2026-111411WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerabilityAman FunnelKit Automations
- CVE-2026-115607WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerabilityCrowd Favorite DXP ToolKit
- CVE-2026-115957WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerabilityWP Discussion Board
- CVE-2026-115606WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityCrowd Favorite DXP ToolKit
- CVE-2026-115609WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerabilityStiofan GetPaid
- CVE-2026-55369Waline login accepts a non-string email as a match-all MongoDB querywalinejs waline · @waline/vercel
- CVE-2026-115904Topluyo Desktop for Linux has an OS Command Injection issuetopluyo App
- CVE-2026-93515.Org Server Present Extension Use-After-FreeX.org xorg-x11-server · x.org xwayland
- CVE-2026-21830HCL BigFix AEX is affected by multiple security vulnerabilities.HCL Software BigFix AEX
- CVE-2026-118037Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessingProgress Software Telerik Document Processing Libraries
- CVE-2026-118036Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question…Progress Software Telerik Document Processing Libraries
- CVE-2026-118035Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessingProgress Software Telerik Document Processing Libraries
- CVE-2026-118040Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessingProgress Software Telerik Document Processing Libraries
- CVE-2026-118039XML External Entity Reference in Telerik Document Processing Libraries SVG Image ProcessingProgress Software Telerik Document Processing Libraries