CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119718Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point CacheBlender Foundation Blender
- CVE-2026-119716pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segmentswbond pybars3 · up9inc pybars4
- CVE-2026-119715NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headersnocodb
- CVE-2026-119714My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameterjoedolson My Calendar - Accessible Event Manager
- CVE-2026-119713Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands@paperclipai/server
- CVE-2026-119712PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documentspipeshub-ai
- CVE-2026-119711PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Headerpipeshub-ai
- CVE-2026-119710PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Routepipeshub-ai
- CVE-2026-119709Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadatagoniszewski grimoire
- CVE-2026-119708abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Namecolinin abp-next-admin
- CVE-2026-119707SonicJS through 3.0.0 Missing Authorization in Content Write APISonicJs-Org sonicjs
- CVE-2026-119706LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle DeserializationInternLM lmdeploy
- CVE-2026-119705SerpBear before 3.1.1 Missing Authentication via POST /api/notifytowfiqi serpbear
- CVE-2026-119704Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcpBastilleBSD bastille
- CVE-2026-119703xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Headerxinnan-tech xiaozhi-esp32-server
- CVE-2026-119702WPGraphQL before 2.24.1 Missing Authorization via createComment MutationWPGraphQL
- CVE-2026-119701WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail MutationsWPGraphQL
- CVE-2026-119700WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment MutationsWPGraphQL
- CVE-2026-119699WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoSWPGraphQL Smart Cache
- CVE-2026-104067Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Memory Access via SVM Import PluginScribus
- CVE-2026-104066Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel UnpackingScribus
- CVE-2026-104065Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Out-of-Bounds Write via Micrografx Draw ImportScribus
- CVE-2026-104064Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Overflow via TIFF Tile Buffer HandlingScribus
- CVE-2026-104063Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Read via PICT Planar Image DataScribus
- CVE-2026-104062Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT Pixmap LoaderScribus
- CVE-2026-104061Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Out-of-Bounds Write via PSD Image LoaderScribus
- CVE-2026-119369WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-119479WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerabilityCrocoblock JetFormBuilder
- CVE-2026-116407WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerabilityWebba Plugins Webba Booking
- CVE-2026-118238CVE-2026-118238Tenda W18E