CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-115965WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerabilityBuddyPress
- CVE-2026-115967WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerabilityHamid Alinia Login with phone number
- CVE-2026-115963WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerabilityVideoWhisper.com Broadcast Live Video
- CVE-2026-118989WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via RedirectsWebToffee Product Import Export for WooCommerce
- CVE-2026-33924Authenticated RCE in update functionality in Guardian/CMC before 26.4.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2026-33923Update bundle signature bypass in Guardian/CMC before 26.4.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2026-118984OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-logincheaper-inference OmniRoute
- CVE-2026-71569Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host NameApache Software Foundation Apache Camel
- CVE-2026-115942Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow readApache Software Foundation Apache Qpid Proton C
- CVE-2026-114230Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL framesApache Software Foundation Apache Qpid Proton C
- CVE-2026-105042Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crashApache Software Foundation Apache Qpid Proton C
- CVE-2026-105031Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust…Apache Software Foundation Apache Qpid Proton C
- CVE-2026-111417Cross-user Document Access on Foxit Official Website's HTML-to-PDF ServiceFoxit Software foxit.com
- CVE-2026-111418SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF ServiceFoxit Software foxit.com
- CVE-2026-111419Hardcoded API Token in Foxit Official WebsiteFoxit Software foxit.com
- CVE-2026-117611Trust of compromised eMudhra root CA in bundled CA storesCheckmk
- CVE-2026-111318HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sinkdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2026-107743Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' ParameterMapster WP Maps
- CVE-2026-91153Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2026-116763LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)litespeedtech LiteSpeed Cache
- CVE-2026-104727Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keysberocket Sequential Order Numbers for WooCommerce
- CVE-2026-109215LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serializationlitespeedtech LiteSpeed Cache
- CVE-2026-91152Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameterwpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2026-107627Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Blockwpsoul Greenshift – animation and page builder blocks
- CVE-2026-107629Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerTextwpsoul Greenshift – animation and page builder blocks
- CVE-2026-110707RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Elementthemeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2026-103875Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Linksdglingren Media Library Assistant
- CVE-2026-118192JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attributebeardev JoomSport – for Sports: Team & League, Football, Ho…
- CVE-2026-103485Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Propertyhupe13 Extensions for Leaflet Map
- CVE-2026-88941Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center.Kaspersky Network Agent · Kaspersky Administration Server