CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-48884WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerabilityweDevs WP User Frontend
- CVE-2026-80069MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajaxStylemix MasterStudy LMS WordPress Plugin
- CVE-2026-80067MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step ParameterStylemix MasterStudy LMS WordPress Plugin
- CVE-2026-115713Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and…Elastic Cloud Enterprise
- CVE-2026-115712Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform SettingsElastic Cloud Enterprise
- CVE-2026-115711Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential…Elastic Cloud Enterprise
- CVE-2026-115709Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and…Elastic Cloud Enterprise
- CVE-2026-115708Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication BypassElastic Cloud Enterprise
- CVE-2026-115707Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege…Elastic Cloud Enterprise
- CVE-2026-115706Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege EscalationElastic Cloud Enterprise
- CVE-2026-39736WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerabilityCrocoblock JetEngine
- CVE-2026-116402WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerabilityBrainstorm Force SureForms
- CVE-2026-118425Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopbackRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-48202WordPress Brave plugin <= 0.8.8 - Content Injection vulnerabilityBrave
- CVE-2026-39782WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerabilityKaliforms Kali Forms
- CVE-2026-25467WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerabilityThemeGrill User Registration
- CVE-2026-116399WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerabilityInstaWP Connect
- CVE-2026-116857WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetSmartFilters
- CVE-2026-113697Reflected Cross-Site Scripting in BMC Helix Operations ManagementBMC Helix Operations Management
- CVE-2026-113696Improper Authorization in BMC ITSM SmartIT Change ApprovalsBMC IT Service Management Suite
- CVE-2026-113695Reflected Cross-Site Scripting in BMC ITSM SmartITBMC IT Service Management Suite
- CVE-2026-93009Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoderRed Hat Ceph Storage · Red Hat Enterprise Linux +2
- CVE-2026-93010Dnsmasq: dnsmasq: --leasequery without address argument applies no source address checkRed Hat Ceph Storage · Red Hat Enterprise Linux +2
- CVE-2026-113694Improper Authorization in BMC ITSM SmartIT AttachmentsBMC IT Service Management Suite
- CVE-2026-113693System Account Credential Disclosure in BMC ITSMBMC IT Service Management Suite
- CVE-2026-54862WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerabilityCodection Import and export users and customers
- CVE-2026-113692Path Traversal in BMC ITSMBMC IT Service Management Suite
- CVE-2026-119054Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-urlMultiple Pages Generator by Themeisle
- CVE-2026-119053lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()lwIP
- CVE-2026-119052llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Lengthggml-org llama.cpp