CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-85498Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflowRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-7190Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configurationICT Innovations’ PHP-CGI/PHP-FPM configuration
- CVE-2026-114358SQL Injection Vulnerability in Radius Xenia M2M PlatformRadius Synergies Radius Xenia M2M Platform
- CVE-2026-115303Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field MappingContact Form by Supsystic
- CVE-2025-62841Hard-coded Cryptographic Key #2QNAP Systems HBS 3 Hybrid Backup Sync · QNAP Systems Hybrid…
- CVE-2025-62839Hard-coded Cryptographic Key #1QNAP Systems HBS 3 Hybrid Backup Sync · QNAP Systems Hybrid…
- CVE-2026-118030Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent loginsRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-117859Keycloak-services: keycloak-services: par single-use bypass via flow restartRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-117688Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configurationRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-117548389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of serviceRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-117627Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictionsRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-114488Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without…Red Hat JBoss Enterprise Application Platform · Red Hat… +1
- CVE-2026-19610Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbeanRed Hat JBoss Enterprise Application Platform · Red Hat Sin…
- CVE-2026-15564Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserializationRed Hat JBoss Enterprise Application Platform
- CVE-2026-86794Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission FormCommunity Events
- CVE-2026-85007YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajaxVideo Player for YouTube
- CVE-2026-115259Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDORPhoto Engine
- CVE-2026-115245Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File UploadChat AI with Dispatcher
- CVE-2026-114270GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content DisclosureGeoDirectory
- CVE-2026-113617Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path TraversalAutomated Import Products to Cart
- CVE-2026-113616LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password ResetLogixFast Auth
- CVE-2026-111739Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' ParameterTwo Factor Authentication · All-In-One Security
- CVE-2026-110983WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRFWP Photo Album Plus
- CVE-2026-110505Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation BypassEnable SVG, WebP, and ICO Upload
- CVE-2026-110504Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization BypassEnable SVG, WebP, and ICO Upload
- CVE-2026-110030Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest RegistrationHide Price Until Login
- CVE-2026-108763Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDORWallet System for WooCommerce
- CVE-2026-108686WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key DisclosureWP Post Author
- CVE-2026-108685WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile FieldsWP Post Author
- CVE-2026-105258LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step SettingsAppointment Booking Plugin