CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-109931Infility Global < 2.16.25 - Unauthenticated Google Translate API Key UpdateInfility Global
- CVE-2026-109927CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_roleHIPAA Forms
- CVE-2026-103234WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer EmailWP Ultimate Review
- CVE-2026-100142FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDORFluentCart A New Era of eCommerce
- CVE-2026-114570WordPress stored XSS via Quick Edit display namesWordPress Foundation WordPress
- CVE-2026-114223NewType Infortech｜NT OneAPP - Exposure of Sensitive InformationNewType Infortech NT OneAPP
- CVE-2026-114222NewType Infortech｜NT OneAPP - Authentication BypassNewType Infortech NT OneAPP
- CVE-2026-114221NewType Infortech｜NT OneAPP - Credential DisclosureNewType Infortech NT OneAPP
- CVE-2026-114220NewType Infortech｜NT OneAPP - Improper Certificate ValidationNewType Infortech NT OneAPP
- CVE-2026-114219NewType Infortech｜NT OneAPP - Hard-coded CredentialsNewType Infortech NT OneAPP
- CVE-2026-110353Denial of service in HTTP/2 PING frame handlingHAProxy
- CVE-2026-110354Denial of service in HTTP chunked body parserHAProxy
- CVE-2026-114732Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installationsRoundcube Webmail
- CVE-2026-114731Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)Roundcube Webmail
- CVE-2026-114730Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypassRoundcube Webmail
- CVE-2026-114729Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes to, from and values for URIs, but…Roundcube Webmail
- CVE-2026-114728Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a…Roundcube Webmail
- CVE-2026-114577oretnom23 php-travel-agency-system Insertion insert.php sql injectionoretnom23 php-travel-agency-system
- CVE-2026-114727Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing imagesRoundcube Webmail
- CVE-2026-114726Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control…Roundcube Webmail
- CVE-2026-114725Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization…Roundcube Webmail
- CVE-2026-114724Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize()Roundcube Webmail
- CVE-2026-114723Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generationRoundcube Webmail
- CVE-2026-114664Frappe before 16.33.0 Blind SQL Injection via get_eventsfrappe
- CVE-2026-114663Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Argumentsvyperlang vyper
- CVE-2026-114662Obot before 0.26.0 API Key Theft via CLI Login Token Requestobot-platform obot
- CVE-2026-114661OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpointsopenremote
- CVE-2026-114660Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directivesgetgrav grav
- CVE-2026-114659Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routesgetgrav grav-plugin-flex-objects
- CVE-2026-114658Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invitegetgrav grav-plugin-login