CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-110938JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsingEclipse Foundation Eclipse OpenJ9
- CVE-2026-111075JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserializationEclipse Foundation Eclipse OpenJ9
- CVE-2026-110899WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerabilityKevin Stover Ninja Forms
- CVE-2026-107435WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerabilityWP Chill Strong Testimonials
- CVE-2026-17557Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwardingRed Hat OpenShift AI
- CVE-2026-111074JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()Eclipse Foundation Eclipse OpenJ9
- CVE-2026-96901Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery TokenCart Abandonment Recovery for WooCommerce
- CVE-2026-92999Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_actionClick n Chat
- CVE-2026-92998Click n Chat unauthenticated SQL injection in sort parametersClick n Chat
- CVE-2026-92997Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' ParameterClick n Chat
- CVE-2026-88784Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link RewritingTranslate WordPress with Weglot
- CVE-2026-87838Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install WebhookWava Payment Plugin
- CVE-2026-87837Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment WebhookWava Payment Plugin
- CVE-2026-86611Download Manager (Free & Pro) - Privacy Settings Update via CSRFDownload Manager
- CVE-2026-85642Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoSFormidable Forms
- CVE-2026-81813Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer BypassElementor Website Builder
- CVE-2026-81812Elementor < 4.3.5 - Author+ Stored XSS via SVG UploadElementor Website Builder
- CVE-2026-79627Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff BypassAdvanced File Manager
- CVE-2026-15261TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_keyTI WooCommerce Wishlist
- CVE-2026-111957SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect CallbackSUMIT Payment Gateway for WooCommerce
- CVE-2026-111956WholesaleX < 3.0.9 - Unauthenticated Imported User CSV DisclosureWholesaleX
- CVE-2026-111955WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval BypassWholesaleX
- CVE-2026-111949miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor RebindingminiOrange 2FA
- CVE-2026-111948Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row ActionsUser Profile Builder
- CVE-2026-111947Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table DuplicationPricing Table WordPress Plugin
- CVE-2026-111596Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDORKliken: Ads + Pixel for Meta
- CVE-2026-111574Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug MetaboxRedirection for Contact Form
- CVE-2026-110982AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerptAI Engine
- CVE-2026-110651Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image OptimizerSwift Performance Lite
- CVE-2026-110523WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe DisconnectWP User Manager