CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-55551ZAC: Missing per-zaaktype authorization on by-ID decision and process readsinfonl dimpact-zaakafhandelcomponent
- CVE-2026-39375Frappe LMS has Stored XSS in Course Metafrappe lms
- CVE-2026-112816Improper certificate validation in the HTTPS listener in LXDCanonical LXD
- CVE-2026-119300Wekan: ReDoS via Unescaped User Input in RegExpwekan
- CVE-2026-119299gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segmentsgopacket · github.com/gopacket/gopacket
- CVE-2026-115642In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an…OpenStack keystonemiddleware
- CVE-2026-119466WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerabilityWPExperts APIExperts Square for WooCommerce
- CVE-2026-65566WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerabilityMeow Apps AI Engine
- CVE-2026-119298croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receiveschollz croc · github.com/schollz/croc/v11 +5
- CVE-2026-119148Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpointaws-nitro-enclaves-sdk-c
- CVE-2026-104623Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management clusterSUSE Rancher
- CVE-2026-62055WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerabilityLiquid Web / StellarWP Event Tickets
- CVE-2026-119365WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilitybPlugins Media Player Addons for Elementor – Media Player w…
- CVE-2026-119116Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-cAWS kmstool-enclave
- CVE-2026-119367WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-61789DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationbytebase dbhub · @bytebase/dbhub
- CVE-2026-119291zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directoryzuke-build zuke
- CVE-2026-119290Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runzuke-build zuke
- CVE-2026-104615Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespaceSUSE Rancher
- CVE-2026-119289Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block…zuke-build zuke
- CVE-2026-119288Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command linezuke-build zuke
- CVE-2026-119287Zuke: Command-form registry descriptors bypass the MCP launch policyzuke-build zuke
- CVE-2026-105454Stored XSS via crafted URLs in HTML ticket content in Request TrackerBest Practical Solutions Request Tracker
- CVE-2026-105455Stored XSS via related ticket subject on RTIR Split and Create Incident formsBest Practical Solutions RT for Incident Response
- CVE-2026-62141WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerabilityWP ManageNinja Fluent CRM
- CVE-2026-105456Stored XSS via HTML scrubber rule in RTIRBest Practical Solutions RT for Incident Response
- CVE-2026-119722Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()Blender Foundation Blender
- CVE-2026-119721Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id AccessorsBlender Foundation Blender
- CVE-2026-119720Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB BlockBlender Foundation Blender
- CVE-2026-119719Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail ExtractionBlender Foundation Blender