CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-110894WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerabilityBrainstorm Force SureDash
- CVE-2026-114698WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerabilitymyCred
- CVE-2026-112327WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerabilityTMS Amelia
- CVE-2026-112379WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerabilityCodepeople Contact Form Email
- CVE-2026-93471Unbounded SAML message decompression in esaml allows memory exhaustionhandnot2 esaml · arekinath esaml +2
- CVE-2026-86696Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionhandnot2 esaml · arekinath esaml +2
- CVE-2026-105270Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustionarekinath esaml · handnot2 esaml +2
- CVE-2026-114182WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerabilityIdeaBox Creations PowerPack Addons for Elementor
- CVE-2026-112843WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerabilityWP Chill Strong Testimonials
- CVE-2026-112826WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerabilityeLightUp Falcon – WordPress Optimizations & Tweaks
- CVE-2026-114180WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerabilityWpmet Metform
- CVE-2026-111847WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerabilityKings Plugins MarketKing
- CVE-2026-114177WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerabilityXpro Elementor Addons
- CVE-2026-114175WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerabilityDigitalME eRoom
- CVE-2026-112867WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerabilityH5P
- CVE-2026-114184WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerabilityWPVibes Elementor Addon Elements
- CVE-2026-103634Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). count_min_sketch::deserialize() did not include the preamble in its input…Apache Software Foundation Apache DataSketches
- CVE-2026-114460Mod_qos: query truncation during json body merging permits security-rule bypasspbuchbinder mod_qos
- CVE-2026-114459Mod_qos: out-of-bounds reads in response-body substring matchingpbuchbinder mod_qos
- CVE-2026-114458Mod_qos: undersized connection-monitor scratch array permits heap buffer overflowpbuchbinder mod_qos
- CVE-2026-114457Mod_qos: missing nul termination in json value escaping permits out-of-bounds readspbuchbinder mod_qos
- CVE-2026-97328WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML ParserWebP Express
- CVE-2026-88849MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student EnrollmentMasterStudy LMS WordPress Plugin
- CVE-2026-78392Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' ParameterLink Library
- CVE-2026-111972Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDORPhoto Engine
- CVE-2026-111971Photo Engine < 6.5.8 - Author+ Stored XSS via Collection NamePhoto Engine
- CVE-2026-111958Royal MCP < 1.5.7 - Authentication Bypass via Preview Link TokenRoyal MCP
- CVE-2026-110011The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the…MB Custom Post Types & Custom Taxonomies
- CVE-2026-110010MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' ParameterMB Custom Post Types & Custom Taxonomies
- CVE-2026-109987PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via CookiePixelYourSite