CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-103693Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object InjectionFrontend Dashboard · ProfileGrid
- CVE-2024-3586LetterPress < 2.4.0 - Admin+ Stored XSSLetterPress
- CVE-2026-89216vTables < 0.3 - Unauthenticated SQL Injection via orderby ParametervTables
- CVE-2026-88928PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification BypassPAYCOMET for WooCommerce
- CVE-2026-78396Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information DisclosureLink Library
- CVE-2026-78395Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement BypassLink Library
- CVE-2026-115302Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics DeletionContact Form by Supsystic
- CVE-2026-115301Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text BlockContact Form by Supsystic
- CVE-2026-115300Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRFContact Form by Supsystic
- CVE-2026-115299Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRFContact Form by Supsystic
- CVE-2026-115282Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content DisclosureRecipe Card Blocks Lite
- CVE-2026-93293Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handlersaadiqbal Password Protected – Protect Your Site Content Wi…
- CVE-2026-118905nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sednvm-sh nvm
- CVE-2026-93757Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisitewild-apricot Wild Apricot Login
- CVE-2026-96228SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeoversslplugins SSL Wireless SMS Notification
- CVE-2026-96666Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filtervberkel Schema App Structured Data
- CVE-2026-93904Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameterdejanmarkovic Social Web Suite – Social Media Auto Post, So…
- CVE-2026-93855SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameterbrewlabs SendPress Newsletters
- CVE-2026-96669Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookiewpscripts Food Store – Online Food Delivery & Pickup
- CVE-2026-96741DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruptionmlfactory DSGVO All in one for WP
- CVE-2026-109516Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Tokenguruteam Bot for Telegram on WooCommerce
- CVE-2026-42949A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809).Frangoteam
- CVE-2026-40063A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809).Frangoteam
- CVE-2026-42922A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).Frangoteam
- CVE-2026-118426In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user…Octopus Deploy Octopus Server
- CVE-2026-113409The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripticanva ortto
- CVE-2026-114173The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages.canva ortto
- CVE-2026-113387The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public canva ortto
- CVE-2026-66092Stored XSS in pre-login notice via reachable legacy logon routeApereo Foundation openEQUELLA
- CVE-2026-66091Unauthenticated IDOR Enables Disclosure of Other Users’ last-known detailsApereo Foundation openEQUELLA