CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116622Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookiewpscripts Food Store – Online Food Delivery & Pickup
- CVE-2026-97645Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List FieldGravity Forms
- CVE-2026-89435Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameterstrategy11team Formidable Forms – Contact Form, Survey, Qui…
- CVE-2026-90437Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field ValuesGravity Forms
- CVE-2026-118593Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-118952Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rulesRed Hat streams for Apache Kafka
- CVE-2026-118165Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' AttributeFirelight Lightbox
- CVE-2026-118101BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post ModificationBuddyForms
- CVE-2026-118100BuddyForms < 2.10.3 - Unauthenticated Form Configuration DisclosureBuddyForms
- CVE-2026-118072Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer BlacklistingFraud Prevention For WooCommerce and EDD
- CVE-2026-118071Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message AttributeJoinchat
- CVE-2026-117572WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' ParameterWP Visitor Statistics
- CVE-2026-117571WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device ParametersWP Visitor Statistics
- CVE-2026-115277WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' ParameterUser Frontend
- CVE-2026-114444Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File ViewerSecurity Plugin, Firewall & Malware Scanner with Auto Remov…
- CVE-2026-114443Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App CodeSecurity Plugin, Firewall & Malware Scanner with Auto Remov…
- CVE-2026-114422Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata ReplacerEnable Media Replace
- CVE-2026-119087Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameterkeywordrush Content Egg – Affiliate Product Importer & Pric…
- CVE-2026-119059Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via…keywordrush Content Egg – Affiliate Product Importer & Pric…
- CVE-2026-118634Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attributeliedekef Events Made Easy
- CVE-2026-118500Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parametercoolplugins Cool FormKit Lite – Advanced Form Builder for E…
- CVE-2026-118698JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attributebeardev JoomSport – for Sports: Team & League, Football, Ho…
- CVE-2026-118194Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authenticationcyberlord92 Page and Post Restriction
- CVE-2026-5461Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadatawpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-104368Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in…webtoffee Export and Import Users and Customers
- CVE-2026-103963Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of serviceRed Hat Enterprise Linux
- CVE-2026-107249Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192Drupal Block AJAX
- CVE-2026-107250ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193Drupal ECA Helper
- CVE-2026-107251Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194Drupal Entity Reference Manager
- CVE-2026-107252MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195MathJax: LaTeX for Drupal