CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-110514WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDORWPZOOM Portfolio Lite
- CVE-2026-109926Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin ActivationProductive Commerce
- CVE-2026-109147WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' ParameterWP Booking System
- CVE-2026-108073SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' ParameterSureCart
- CVE-2026-107790WP Job Openings < 4.1.1 - Author+ Stored XSS via Job TitleHireZoot
- CVE-2026-107789SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDORSmartyParcel
- CVE-2026-107788SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label DeletionSmartyParcel
- CVE-2026-107506Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions SettingSimple Banner
- CVE-2026-107237Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_liveBackup and Staging by WP Time Capsule
- CVE-2026-107128Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing AuthorizationUncanny Toolkit for LearnDash
- CVE-2026-107127Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRFUncanny Toolkit for LearnDash
- CVE-2026-106932Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoiceMoloni
- CVE-2026-105999Booking Package < 1.7.31 - Unauthenticated Calendar Account Information DisclosureBooking Package
- CVE-2026-105998Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing AuthorizationBooking Package
- CVE-2026-105996Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable TokenBooking Package
- CVE-2026-105992Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation BypassEttrick Escape Room Booking
- CVE-2026-105262Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term TranslationFalang multilanguage for WordPress
- CVE-2026-105257LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDORAppointment Booking Plugin
- CVE-2026-103302Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant SecretPayment Gateway for Idram
- CVE-2026-102499Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX ActionModern Events Calendar Lite · Modern Event Calendar Pro
- CVE-2026-100145Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST RouteSynchrony Financing
- CVE-2026-93856In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages APIOpenStack Cinder
- CVE-2026-71195In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the shareOpenStack Manila
- CVE-2026-82819Universal Naming Convention (UNC) Path Injection in Cerberus FTP ServerCerberus FTP Server
- CVE-2026-114040DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversalDT42 BerryNet
- CVE-2026-114039projectworlds Advanced Library Management System report_search.php mysqli_query sql injectionprojectworlds Advanced Library Management System
- CVE-2026-92824Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifactsRed Hat Hardened Images · Red Hat Enterprise Linux +2
- CVE-2026-92822Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yamlRed Hat Hardened Images · Red Hat Enterprise Linux +2
- CVE-2026-92823Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yamlRed Hat Hardened Images · Red Hat Enterprise Linux +2
- CVE-2026-82814Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injectionsmub Duplicator – Backups & Migration Plugin – Cloud Backup…