CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-100155Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tagkstover Ninja Forms – Contact Form Builder with Calculators…
- CVE-2026-92294Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page'…brainstormforce Spectra Legacy – Gutenberg Blocks
- CVE-2026-109997Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalizationkstover Ninja Forms – Contact Form Builder with Calculators…
- CVE-2026-119977WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code ExecutionWordPress Foundation WordPress
- CVE-2026-109234Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronizationtigroumeow Meow Lightbox
- CVE-2026-116563Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute…smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…
- CVE-2026-101326Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_namekstover Ninja Forms – Contact Form Builder with Calculators…
- CVE-2026-116755SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template FieldsSoftIron HyperCloud
- CVE-2026-110176File Force Download for Drupal 7 Access Bypass via Unconditional Download HeadersDrupal File Force Download
- CVE-2026-77152Field Collection for Drupal 7 access bypass via missing parent entity access checkField Collection for Drupal
- CVE-2026-117656Unverified Sign in with Apple callback parameter can override verified ID token claimspow-auth assent · assent
- GHSA-2WRX-84QJ-4PCGanacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoSgithub.com/anacrolix/torrent
- CVE-2026-63414Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsshopify_app
- CVE-2026-63410secp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplicationsgbett secp256k1-native
- CVE-2026-63400Coop sessions are not invalidated on password resetroostorg coop
- CVE-2026-63398Coop has SAML cross-tenant authentication bypassroostorg coop
- CVE-2026-63401Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUserroostorg coop
- CVE-2026-63396Coop has a data leak via unauthenticated GraphQL Query.allOrgsroostorg coop
- CVE-2026-63399Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrgroostorg coop
- CVE-2026-63402i18next: Shared built-in corruption through inherited-key deepExtend recursioni18next
- CVE-2026-63339IXP Manager has authenticated non-administrator privilege escalationinex IXP-Manager
- CVE-2026-63338IXP Manager has Broken Object-Level Authorizationinex IXP-Manager
- CVE-2026-63393OpenSearch SQL plugin: Unsafe cursor deserialization permits server code executionopensearch-project sql
- CVE-2026-63378TAKO AI Agent for Okta: Authenticated Python execution through validator bypassfctr-id okta-ai-agent
- CVE-2026-63377TAKO AI Agent for Okta: Unauthenticated first-run administrator takeoverfctr-id okta-ai-agent
- CVE-2026-63346Refitter: C# source injection through OpenAPI header parameter nameschristianhelle refitter
- CVE-2026-63344Refitter: C# source injection through OpenAPI content-type map keyschristianhelle refitter
- CVE-2026-63345Refitter: C# source injection through OpenAPI path keyschristianhelle refitter
- CVE-2026-61725sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwriteshasenbanck sevenz-rust2
- CVE-2026-63341Aedes has Uncaught Exception and Uncontrolled Resource Consumptionmoscajs aedes