CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114252itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injectionitsourcecode Sales-and-Inventory-System
- CVE-2026-113786pypdf: Unvalidated JPEG image data loadingpy-pdf pypdf · pypdf
- CVE-2026-114251itsourcecode Sales-and-Inventory-System cust_del.php sql injectionitsourcecode Sales-and-Inventory-System
- CVE-2026-114250itsourcecode Sales-and-Inventory-System cust_edit.php sql injectionitsourcecode Sales-and-Inventory-System
- CVE-2026-113779pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permissionpfrest pfSense-pkg-RESTAPI
- CVE-2026-111832WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerabilityWP Mailster
- CVE-2026-111834WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerabilityKitae Park Mang Board WP
- CVE-2026-111835WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerabilityBjornTech Swish for WooCommerce
- CVE-2026-111848WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerabilityDylan Kuhn Geo Mashup
- CVE-2026-112221WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force SureCart
- CVE-2026-111833WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerabilityBold Grid weForms
- CVE-2026-111837WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerabilityWasiliy Strecker Contest Gallery
- CVE-2026-111838WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerabilityThemeHunk Customizer
- CVE-2026-111840WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerabilityVideoWhisper.com Paid Videochat Turnkey Site
- CVE-2026-111852WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerabilityWPdreams Ajax Search Lite
- CVE-2024-6423Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information LeakageWSO2 API Manager · WSO2 Open Banking AM +5
- CVE-2026-109619PHP remote code execution via stale global statePHP Group PHP · libphp +2
- CVE-2026-104949WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby()EnterpriseDB WarehousePG
- CVE-2026-104948WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog()…EnterpriseDB WarehousePG
- CVE-2026-104947WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts()EnterpriseDB WarehousePG
- CVE-2026-114437Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-Forgo-chi chi · github.com/go-chi/chi/v5
- CVE-2025-0326Improper Token Revocation in WSO2 Identity Server Allows Unauthorized AccessWSO2 Identity Server · WSO2 Carbon OAuth
- CVE-2024-7478Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account DiscoveryWSO2 API Manager · WSO2 Identity Server as Key Manager +4
- CVE-2026-109618PHP remote code execution in out-of-memory handlingPHP Group PHP · libphp +2
- CVE-2024-5563Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force AttacksWSO2 Identity Server
- CVE-2024-4989Open Redirection via Callback URL in WSO2 API Manager Allows Phishing AttacksWSO2 API Manager
- CVE-2024-5139Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and RedirectionWSO2 Enterprise Integrator · WSO2 Identity Server +4
- CVE-2026-114249dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorizationdhikshitha29 Insurance-Management-System
- CVE-2026-111849WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerabilityMagepeople WpTravelly
- CVE-2026-114248dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authenticationdhikshitha29 Insurance-Management-System