CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-61840Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Servicesvantern-org questbot
- CVE-2026-62056WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerabilityWP ManageNinja Fluent CRM
- CVE-2026-62023WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerabilityUnlimited Elements For Elementor
- CVE-2026-62019WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerabilityLiquid Web / StellarWP BookIt
- CVE-2026-104674WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerabilityArraytics Booktics
- CVE-2026-62047WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerabilityLiquid Web / StellarWP Event Tickets
- CVE-2026-39739WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force Ultimate Addons for Elementor - Lite
- CVE-2026-73322Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()Apache Software Foundation Apache Pinot
- CVE-2026-52710WordPress GIFTiT – Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerabilityithemelandco GIFTiT – Free Gifts for WooCommerce
- CVE-2026-62057WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerabilityFahim Reza Divi Contact Form
- CVE-2026-62121WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerabilityUnlimited Elements For Elementor
- CVE-2026-62122WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerabilityArraytics Booktics
- CVE-2026-119117Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for JavaAWS amazon-kinesis-producer
- CVE-2026-119777Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parserRed Hat Enterprise Linux
- CVE-2026-119979LM Studio before 0.4.22+1 Path Traversal via Model DownloaderElement Labs LM Studio
- CVE-2026-11962037954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload37954679 cak-filemanagement-system
- CVE-2026-84243gettext: Directory traversal via the LANGUAGE environment variableThe GNU C Library glibc
- CVE-2026-119086Missing type validation in xQueueSelectFromSet in FreeRTOS-KernelFreeRTOS-Kernel
- CVE-2026-118697In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and…JetBrains Toolbox App · JetBrains IntelliJ IDEA +9
- CVE-2026-118696In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before…JetBrains IntelliJ IDEA · JetBrains PyCharm +9
- CVE-2026-119978Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStoreFlowiseAI Flowise · flowise +1
- CVE-2026-69446Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2026-119764Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Previewits-a-feature Mythic
- CVE-2026-119763changelog.com before commit 7b35e829 Missing Authorization via Preview Routesthechangelog changelog.com
- CVE-2026-119762Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested RequestsAxigen Mail Server
- CVE-2026-119761Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display NameAxigen Mail Server
- CVE-2026-119760sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()dlundquist sniproxy
- CVE-2026-76012Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task…smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…
- CVE-2026-119113GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameterpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-105894Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Updateakbilisim Ak Framework