CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-115750mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirectsagentfront mcp-from-openapi
- CVE-2026-115749hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Importhydra-ecosystem hydra-ray-launcher
- CVE-2026-112848WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerabilityAivahThemes Hostme
- CVE-2026-112849WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerabilityAivahThemes Hostme
- CVE-2026-112850WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerabilityAncoraThemes Your Dress
- CVE-2026-112854WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerabilityaxiomthemes Holistic Center
- CVE-2026-112847WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerabilityThemeREX ZenSoul
- CVE-2026-112846WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerabilityThemeREX Group Save Life
- CVE-2026-112851WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerabilityThemeREX Group HotLock
- CVE-2026-112852WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerabilityThemeREX Group Helion
- CVE-2026-112853WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerabilityaxiomthemes Hallelujah
- CVE-2026-112856WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerabilityThemeREX Group Vagabonds
- CVE-2026-112857WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerabilityaxiomthemes Reprizo
- CVE-2026-112858WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerabilityaxiomthemes Rhodos
- CVE-2026-112859WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerabilityThemeREX Group Little Birdies
- CVE-2026-112855WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerabilityaxiomthemes Redy
- CVE-2026-112863WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerabilityHogash KALLYAS
- CVE-2026-115730i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrli18next-http-backend
- CVE-2026-115729@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypasspdfme common
- CVE-2026-115728@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsinghapijs @hapi/content · @hapi/content
- CVE-2026-99087Linux kernel: dm-integrity: fix NULL pointer dereference when the 'R' flag is usedLinux
- CVE-2026-99086Linux kernel: dm-integrity: validate the superblock on resumeLinux
- CVE-2026-99085Linux kernel: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF schedulerLinux
- CVE-2026-99084Linux kernel: readdir: take no inode lock on an immutable directoryLinux
- CVE-2026-99083Linux kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate()Linux
- CVE-2026-99082Linux kernel: KVM: x86: Use active memslots for the per-vCPU MMIO cacheLinux
- CVE-2026-55888XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversalflatpak xdg-desktop-portal
- CVE-2026-55889XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer keyflatpak xdg-desktop-portal
- CVE-2026-57210Heimdall: IP Spoofing via Unvalidated Forwarding Headersdadrus heimdall · https://github.com/dadrus/heimdall +1
- CVE-2026-57209Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Modedadrus heimdall · github.com/dadrus/heimdall