CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-113496Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line argumentsRed Hat Enterprise Linux
- CVE-2026-113495Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line argumentsRed Hat Enterprise Linux
- CVE-2026-14933Unblu Spark Cross-Site Scripting in Embedded Co-BrowsingUnblu Spark
- CVE-2026-9589Unblu Spark Authorization Bypass in Configuration Cascade OperationsUnblu Spark
- CVE-2026-113384Optimal IdM OptimalCloud social redirectOptimal IdM OptimalCloud
- CVE-2026-113383Optimal IdM OptimalCloud Login cross site scriptingOptimal IdM OptimalCloud
- CVE-2026-113358LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routeslavalite cms
- CVE-2026-113357@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Markertester-army @e2e-dev/github
- CVE-2026-113356DokuWiki before 2026-07-14c PHP Object Injection via Draft Race ConditionDokuWiki
- CVE-2026-113355Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Linkschatwoot
- CVE-2026-113354Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/contentFinsys dockhand
- CVE-2026-113353LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX HandlersThimPress LearnPress
- CVE-2026-113352uTox through 0.18.1 Path Traversal via Auto-Accepted File TransfersuTox
- CVE-2026-113351libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserResetlibexpat
- CVE-2026-113350react-admin before 5.15.5 Stored XSS via UrlField and FileFieldmarmelab react-admin
- CVE-2026-113349OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEventOpenCATS
- CVE-2026-112787OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO ReportsOpenCATS
- CVE-2026-112786OpenCATS before 0.10.0 Missing Authorization via Import Revert ActionOpenCATS
- CVE-2026-112785OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX EndpointsOpenCATS
- CVE-2026-112784OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.phpOpenCATS
- CVE-2026-112783OpenCATS before 0.10.0 Missing Authorization via Activity AJAX EndpointsOpenCATS
- CVE-2026-108089Apache Cocoon: Unauthenticated access to diagnostic interfacesApache Software Foundation Apache Cocoon
- CVE-2026-108088Apache Cocoon: Cross-user cache poisoningApache Software Foundation Apache Cocoon
- CVE-2026-108087Apache Cocoon: SQL InjectionApache Software Foundation Apache Cocoon
- CVE-2026-108086Apache Cocoon: XEE could lead to SSRF and information disclosureApache Software Foundation Apache Cocoon
- CVE-2026-113382arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted uploadarizu-id fast-tunnel
- CVE-2026-107597jwks_uri from the OIDC discovery document is fetched without checking its origin or schemeEclipse Foundation Eclipse CSI - PIA
- CVE-2026-108062Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loopEclipse Foundation Eclipse CSI - PIA
- CVE-2026-111844WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerabilityBrizy
- CVE-2026-113381Osclass Item Model Item.php findUserItems sql injectionOsclass