CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-120201Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Headerdromara Jpom
- CVE-2026-120200Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routesgnmyt Nexterm
- CVE-2026-120199LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions APIlearnhouse
- CVE-2026-102212Pre-Auth Heap Buffer Overflow in the Multipart RequestOpengear IM7200 · Opengear CM7100 +1
- CVE-2026-78192WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default…WebDyne
- CVE-2026-78191WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pagesWebDyne
- CVE-2026-78190WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scriptingWebDyne
- CVE-2026-78189WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route…WebDyne
- CVE-2026-78188WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributesWebDyne
- RUSTSEC-2026-0432`codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)codeq
- RUSTSEC-2026-0434`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)ant-releases
- CVE-2026-15272Web 2.0 Directory <= 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_filter' ParameterShamalli Web 2.0 Directory plugin for WordPress
- CVE-2026-120194Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice stepRed Hat Enterprise Linux · Red Hat OpenShift AI +1
- CVE-2026-118599epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension installGNOME Epiphany
- CVE-2026-118598epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone accessGNOME Epiphany
- CVE-2026-104926WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' ParameterThemeHigh WooCommerce Extra Product Options Pro
- CVE-2026-109231Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via…vendidero Germanized for WooCommerce
- CVE-2026-107711FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpointwppool FlexStock – Product Stock Sync with Google Sheets fo…
- CVE-2026-120114Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpointqriouslad Debug Log Manager – Conveniently Monitor and Insp…
- CVE-2026-100151Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameterkstover Ninja Forms – Contact Form Builder with Calculators…
- CVE-2026-109197WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameterwpdirectorykit WP Directory Kit
- CVE-2026-96554BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group NameBoss Media BuddyBoss Platform
- CVE-2026-76010Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC…smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…
- CVE-2026-116752GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injectionpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-117681Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyonekonflux-ci
- CVE-2026-116964Konflux-ci: remote code execution via eval() in manifest scriptskonflux-ci
- CVE-2026-116086Konflux-ci: jq filter injection in github workflow issue managementkonflux-ci
- CVE-2026-114217Konflux-ci: github token plaintext exposure in ci/cd scriptskonflux-ci
- CVE-2026-101325Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parametercontrid Newsletters
- CVE-2026-110530FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Contentradgeek FeedWordPress