CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119368WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-119482WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerabilityCrocoblock JetFormBuilder
- CVE-2026-46499Collabora Online: Read-only session authorization bypass permits live document editsCollaboraOnline online
- CVE-2026-48164Collabora Online: Reflected HTML injection through host_session_idCollaboraOnline online
- CVE-2026-93327Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code ExecutionGoogle Cloud Application Integration
- CVE-2026-61627libass: Out-of-bounds read and write in wrap_lines_measurelibass
- GHSA-F3FJ-9625-RV3Mcharmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersgithub.com/charmbracelet/soft-serve
- CVE-2026-61626libass: Out-of-bounds bit clears for negative Matroska ReadOrder valueslibass
- CVE-2026-61739SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)socfortress CoPilot
- GHSA-FGXM-5HVV-X4VHcharmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesgithub.com/charmbracelet/soft-serve
- CVE-2026-116860WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerabilityArraytics Timetics
- CVE-2026-119370WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-65444WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerabilityCreative Themes Blocksy Companion
- CVE-2026-61738SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)socfortress CoPilot
- CVE-2026-61737ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-adminhuajian123 ng-antd-admin
- CVE-2026-44344Chamilo LMS: Conditional PHP execution through vendored QuickForm evalchamilo-lms
- CVE-2026-45141Chamilo LMS: CSRF in destructive skill-management AJAX actionschamilo-lms
- CVE-2026-45145Chamilo LMS: Database-backed PHP object injection in career deserializationchamilo-lms
- CVE-2026-45144Chamilo LMS: Stored XSS in public user-profile fieldschamilo-lms
- CVE-2026-61730SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mountsocfortress CoPilot
- CVE-2026-61729SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injectionsocfortress CoPilot
- CVE-2015-20130Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.phpNetsweeper
- CVE-2010-20125DedeCMS < 5.7 File Inclusion via plus/carbuyaction.phpDedeCMS
- CVE-2026-61728SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeoversocfortress CoPilot
- CVE-2026-111487Out-of-bounds write vulnerability in the assimp scene import plugin of Qt3D impacts Qt FrameworkQt Framework
- CVE-2026-119682Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager PlusManageEngine SharePoint Manager Plus
- CVE-2026-61708SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)socfortress CoPilot
- CVE-2026-112905Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theftgivanz Vvveb
- CVE-2026-110799Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeovergivanz Vvveb
- CVE-2026-119665WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIsMGdaasLab WHartTest