CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- RUSTSEC-2026-0422Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-checkwasmtime
- RUSTSEC-2026-0423Cross-engine type confusion with host-created struct-types-with-supertypeswasmtime
- RUSTSEC-2026-0424Unchecked memory usage in transferring borrowed resources between componentswasmtime
- RUSTSEC-2026-0427`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)sn-releases
- CVE-2026-119028oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Valuesoapi-codegen
- CVE-2026-119027oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extensionoapi-codegen
- CVE-2026-109822Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information.Yamaha NWR100
- CVE-2026-97854Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability.Yamaha NWR100
- CVE-2026-103665The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs).Yamaha LAN Monitor for Windows
- CVE-2026-97860YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths.Yamaha YMS-VPN8 · Yamaha YMS-VPN8-CP
- CVE-2026-27401WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerabilityYITH PayPal Express Checkout for WooCommerce
- CVE-2026-115821NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' ParametersNewsmanApp
- CVE-2026-110184Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameterblazethemes Newsmatic
- CVE-2026-92086MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameterwebsoudan MW WP Form
- CVE-2026-109216Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keysmetabox Meta Box – A Framework for Dynamic Websites
- CVE-2026-96767NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Headerwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-119025open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windowssindresorhus open · modelcontextprotocol inspector +1
- CVE-2026-5702Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC applicationSABBATIC app
- CVE-2026-5700Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC applicationSABBATIC app
- CVE-2026-5699Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC applicationSABBATIC app
- CVE-2026-5698Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC applicationSABBATIC app
- CVE-2026-5697Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC applicationSABBATIC app
- CVE-2026-115611WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityPluginUs.Net TableOn
- CVE-2026-115964WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerabilityStylemixThemes Motors
- CVE-2026-115962WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerabilitymyCred
- CVE-2026-115592WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerabilityOceanWP
- CVE-2026-116409WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerabilityWP Swings Upsell Order Bump Offer for WooCommerce
- CVE-2026-112827WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerabilityVillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce
- CVE-2026-114193WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerabilityEyal Fitoussi GEO my WordPress
- CVE-2026-115599WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerabilityThimPress LearnPress