CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119051flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keyshughsk flat
- CVE-2026-119050Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflectionagno-agi agno
- CVE-2026-119049FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claimingidinging FreeMail
- CVE-2026-119048JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Modulethinkgem JeeSite
- CVE-2019-25781Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket ParsingPython-Markdown Markdown
- CVE-2026-42707WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerabilityHivePress Claim Listings
- CVE-2026-48195WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins PDF Poster
- CVE-2026-113691Stored Cross-Site Scripting in BMC ITSM Knowledge ArticlesBMC IT Service Management Suite
- CVE-2026-39741WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerabilityRelyWP Simple Cloudflare Turnstile
- CVE-2026-48196WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerabilityKaliforms Kali Forms
- CVE-2026-22386WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerabilityAhmad WP Job Portal
- CVE-2026-52709WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins Video Gallery Block
- CVE-2026-113690Stored Cross-Site Scripting in BMC ITSM AttachmentsBMC IT Service Management Suite
- CVE-2026-113689Stored Cross-Site Scripting in BMC ITSM Work NotesBMC IT Service Management Suite
- CVE-2026-24533WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerabilityCozyThemes Cozy Blocks
- CVE-2026-42703WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerabilityKaliforms Kali Forms
- CVE-2026-113688Server-Side Request Forgery in BMC ITSM SmartITBMC IT Service Management Suite
- CVE-2026-118087WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerabilityGemini Labs Site Reviews
- CVE-2026-118094WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityIgor Funa Ad Inserter
- CVE-2026-39735WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerabilityCrocoblock JetEngine
- CVE-2026-56056WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerabilityMamunur Rashid The Post Grid
- CVE-2026-118093WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerabilityWPFunnels Team Product Feed Manager
- CVE-2026-93006Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file contentRed Hat Ceph Storage · Red Hat Enterprise Linux +2
- CVE-2026-93007Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validationRed Hat Ceph Storage · Red Hat Enterprise Linux +2
- CVE-2026-93011Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transformsRed Hat Ceph Storage · Red Hat Enterprise Linux +2
- CVE-2026-49142OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]openemr
- CVE-2026-93008Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurationsRed Hat Ceph Storage · Red Hat Enterprise Linux +2
- RUSTSEC-2026-0419Unbounded memory use on large request bodiesjuniper_warp
- RUSTSEC-2026-0420wasip3 UDP `send` can deliver a datagram to an address only allowed for receivingwasmtime-wasi
- RUSTSEC-2026-0421wasi-http p2: outgoing content-length can be invalid or not match bodywasmtime-wasi-http