CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119548Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhookgetlago lago
- CVE-2026-119547Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}forgejo
- CVE-2026-119546Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repoforgejo
- CVE-2026-119545Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discoveryforgejo
- CVE-2026-119429phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/setphpMyAdmin
- CVE-2026-119428phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup DisabledphpMyAdmin
- CVE-2026-119427phpMyAdmin through 5.2.3 SQL Injection via Designer saveSettingphpMyAdmin
- CVE-2026-119426phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sqlphpMyAdmin
- CVE-2026-119425OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARPopnsense core
- CVE-2026-119424OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identityopnsense core
- CVE-2026-119423OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Usernameopnsense core
- CVE-2026-119422Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connectorjuspay hyperswitch
- CVE-2026-119421Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmationjuspay hyperswitch
- CVE-2026-119420Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutationgetlago lago
- CVE-2026-119419CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collationcakephp
- CVE-2026-119418CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()cakephp
- CVE-2026-119417CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransportcakephp · cakephp/cakephp
- CVE-2026-119416CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matchingcakephp
- CVE-2026-119415CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Typecakephp
- CVE-2026-119414Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/createbitwarden server
- CVE-2026-119409OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Settingopnsense core
- CVE-2026-119408n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodesn8n-io n8n
- CVE-2026-119407Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameterselement-hq element-web · element-hq element-desktop
- CVE-2026-119379SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()SQLite
- CVE-2026-119378SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()SQLite
- CVE-2026-119377SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USINGSQLite
- CVE-2026-119376SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator ChainSQLite
- CVE-2026-119375SQLite before 3.54.0 Information Disclosure via WAL Page Size MismatchSQLite · libsqlite3-sys +1
- CVE-2026-119374SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()SQLite
- CVE-2026-119373SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()SQLite