CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-110510Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title TagEssential Addons for Elementor
- CVE-2026-109936Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render FilterOtter Blocks
- CVE-2026-109935Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST APIOtter Blocks
- CVE-2026-109934Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST APIOtter Blocks
- CVE-2026-109933Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style AttributesOtter Blocks
- CVE-2026-107858Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development ServerGoogle Agent Development Kit (ADK) for Java
- CVE-2026-109198Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration ParameterCleanTalk Anti-Spam – Complete Spam Protection
- CVE-2026-115497Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parametercodepeople Music Store – WordPress eCommerce
- CVE-2026-55835Lookyloo: Potential sub-system DoS due to parameter missmatch in notificationlookyloo
- CVE-2026-86055Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account TakeoverPart-DB-server
- CVE-2026-86020Part-DB: Spreadsheet Formula Injection in XLSX Part ExportsPart-DB-server
- CVE-2026-86019Part-DB: Attachment Size Limit Bypass via API Base64 UploadPart-DB-server
- CVE-2026-86018Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment DownloadsPart-DB-server
- CVE-2026-59188Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment ViewerPart-DB-server
- CVE-2026-55600Part-DB: Stored HTML injection in BOM validation results via unescaped Part namePart-DB-server
- CVE-2026-54631Part-DB: Hardcoded APP_SECRET enables forged remember-me cookiePart-DB-server
- CVE-2026-90458OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish serviceOpenStack Ironic
- CVE-2026-54630Part-DB: Authenticated RCE via .phar attachment upload served from public/mediaPart-DB-server
- CVE-2026-54615Part-DB is an open source inventory management system for electronic componentsPart-DB-server
- CVE-2026-89419OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpointOpenStack Ironic
- CVE-2026-115638OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bombOpenStack Ironic
- CVE-2026-115547Command Execution via Admin Console Input in Okta Access GatewayOkta Access Gateway
- CVE-2026-115546Authentication Source Verification Issue in Okta Access GatewayOkta Access Gateway
- CVE-2026-115537gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirectgedelumbung HospitalManagement
- CVE-2026-19678Server-Side Request Forgery (SSRF) Leading to Internal Solr Data DisclosureonPhase Forms
- CVE-2026-19677Authentication Bypass Leading to Server-Side Command ExecutiononPhase Forms
- CVE-2026-115536gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scriptinggedelumbung HospitalManagement
- CVE-2026-115486Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoningRed Hat Enterprise Linux
- CVE-2026-115485Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuioRed Hat Enterprise Linux
- CVE-2026-115484Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msgRed Hat Enterprise Linux