CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-116852WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerabilityMarketing Fire Widget Options
- CVE-2026-116851WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerabilityimpleCode eCommerce Product Catalog
- CVE-2026-116847WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilityKitae Park Mang Board WP
- CVE-2026-116410WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerabilityMasteriyo - LMS
- CVE-2026-116405WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp VikRentCar
- CVE-2026-116401WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerabilityRealMag777 HUSKY
- CVE-2026-116386WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerabilityCozy Vision Technologies Pvt. SMS Alert Order Notifications
- CVE-2026-115947WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerabilityRealMag777 HUSKY
- CVE-2026-115604WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerabilityBrainstorm Force SureDash
- CVE-2026-114711WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerabilityMultiVendorX
- CVE-2026-107868WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerabilityYITHEMES YITH WooCommerce Product Add-Ons
- CVE-2026-105077WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerabilitySpacetime Ad Inserter
- CVE-2026-94175WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilitySaad Iqbal All In One Login
- CVE-2026-90888WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerabilityLeadSnap
- CVE-2026-78527WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerabilityGS Plugins GS Testimonial Slider
- CVE-2026-73186WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerabilityShortPixel Enable Media Replace
- CVE-2026-54855WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs Profile Builder
- CVE-2026-54854WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerabilityCozmoslabs Profile Builder
- CVE-2026-54850WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2026-48201WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerabilityRaul P. Fast Velocity Minify
- CVE-2026-39786WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerabilitybookingalgorithms BA Book Everything
- CVE-2026-39738WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerabilityAman FunnelKit Automations
- CVE-2026-39734WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerabilitySaad Iqbal WP EasyPay
- CVE-2026-39732WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerabilityIvijan-Stefan Stipic Transliterator
- CVE-2026-28160WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp VikRentCar
- CVE-2026-27061WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerabilitywpeverest User Registration
- CVE-2026-119526WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerabilityThemeREX Royal Event
- CVE-2026-62162Hydra: Deposit Claim omits Head state-token spending requirementcardano-scaling hydra
- CVE-2026-62160Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewaredaptin · github.com/daptin/daptin
- CVE-2026-61854VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growthjackh54 VoiceSentinel