CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-114356DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorizationDJI CrystalSky ZS600C
- CVE-2026-115480baserCMS: Public Web API mail-form submission bypasses image CAPTCHAbaserproject basercms
- CVE-2026-115479baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipientsbaserproject basercms
- CVE-2026-114355DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as rootDJI CrystalSky ZS600C
- CVE-2026-93640Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo ConfigurationZimbra Collaboration Suite
- CVE-2026-115481baserCMS is a website development frameworkbaserproject basercms
- CVE-2026-114354DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as rootDJI CrystalSky ZS600C
- CVE-2026-50057Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo PermissionsZimbra Collaboration Suite
- CVE-2026-114353DJI CrystalSky ZS600C USB-gadget backdoor allows root command executionDJI CrystalSky ZS600C
- CVE-2026-50056Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument InjectionZimbra Collaboration Suite
- CVE-2026-93639Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege EscalationZimbra Collaboration Suite
- CVE-2026-93638Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme ParameterZimbra Collaboration Suite
- CVE-2026-55826Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Pluginstape-io gtm-server-side-wordpress-plugin
- CVE-2026-93636Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute NameZimbra Collaboration Suite
- CVE-2026-93634Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File RecordsZimbra Collaboration Suite
- CVE-2026-93633Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet CharactersZimbra Collaboration Suite
- CVE-2026-93631Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account LinkingZimbra Collaboration Suite
- CVE-2026-93630Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname CanonicalizationZimbra Collaboration Suite
- CVE-2026-55606odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()openwrt odhcpd
- CVE-2026-53918odhcpd DHCPv6 IA dangling first pointer use-after-freeopenwrt odhcpd
- CVE-2026-53920odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosureopenwrt odhcpd
- CVE-2026-115754serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function bodyyahoo serialize-javascript · serialize-javascript
- CVE-2026-53921odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)openwrt odhcpd
- CVE-2026-93629Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer IdentityZimbra Collaboration Suite
- CVE-2026-93628Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee ResponseZimbra Collaboration Suite
- CVE-2026-93627Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST OrganizerZimbra Collaboration Suite
- CVE-2026-50053Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL ParametersZimbra Collaboration Suite
- CVE-2026-10632Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages ParameterZimbra Collaboration Suite
- CVE-2026-115752Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIconsignalk-server
- CVE-2026-115751mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostnameagentfront mcp-from-openapi