CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119664Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.updatewannabespace tamery
- CVE-2026-119663Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.createwannabespace tamery
- CVE-2026-119662Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backendsongloft-org songloft
- CVE-2026-119661ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntriesstar7th ShowDoc
- CVE-2026-119660MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Keyyincongcyincong MuseBot
- CVE-2026-119659Blossom through 1.17.1 Authorization Bypass via Folder Endpointsblossom-editor Blossom
- CVE-2026-119658PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/updatePowerDNS-Admin
- CVE-2026-119657FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operationszyx0814 FilePress
- CVE-2026-119656CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageListCoreUnion CoreShop
- CVE-2026-119655CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageListCoreUnion CoreShop
- CVE-2026-119654DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorizationdevlive-community DataCap
- CVE-2026-119653Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_pathadmpub nging
- CVE-2026-119652HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List DisclosureHuLaSpark HuLa-Server
- CVE-2026-119651HuLa-Server through 3.0.7 IDOR via /feed/del Moment DeletionHuLaSpark HuLa-Server
- CVE-2026-119650HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyControllerHuLaSpark HuLa-Server
- CVE-2026-119649Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission CheckOrchardCMS Orchard
- CVE-2026-119648BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetailTencentBlueKing bk-cmdb
- CVE-2026-119647RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}dromara RuoYi-Vue-Plus
- CVE-2026-119646Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report APIOpen Web Analytics
- CVE-2026-119645ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoceasysoft zentaopms
- CVE-2026-119644Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpointsblossom-editor Blossom
- CVE-2026-119680Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart FeatureManageEngine SharePoint Manager Plus
- CVE-2026-100355Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guardbasecamp once-campfire
- CVE-2026-112348Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing TokenThemeum Kirki
- CVE-2026-112347Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page APIThemeum Kirki
- CVE-2026-119542Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerrorRed Hat build of Apache Camel 4 for Quarkus · Red Hat Da… +2
- CVE-2026-91912Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability.Dell OpenManage Enterprise
- CVE-2026-119528Gimp: gimp: stack buffer overflow in psd image resource header loaderRed Hat Enterprise Linux
- CVE-2026-91913Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS…Dell OpenManage Enterprise
- CVE-2026-111498OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability.Dell OpenManage Enterprise