CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-112243Duplicator < 5.1.0 - Reflected XSS via 'logname' ParameterDuplicator · duplicator-pro
- CVE-2026-111962WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export FileWP Remote Users Sync
- CVE-2026-111740Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title DisclosurePost Duplicator
- CVE-2026-110964Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOREssential Real Estate
- CVE-2026-110692PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV ImportPowerPack Addons for Elementor: Widgets, Form Styler and Te…
- CVE-2026-108068FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration WizardFV Flowplayer Video Player
- CVE-2026-108067FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure…FV Flowplayer Video Player
- CVE-2026-108041SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking SettingsSEOPress
- CVE-2026-106649Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click ActionKali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-106000Booking Package < 1.7.34 - Unauthenticated Payment BypassBooking Package
- CVE-2026-105413Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field ValuesForm Maker by 10Web
- CVE-2026-105191WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit LogERP: Complete HR, Accounting & CRM Suite Built for WooComme…
- CVE-2026-104719CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category ScriptsCookieYes
- CVE-2026-101166Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_orderMollie Payments for WooCommerce
- CVE-2026-101165Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_payMollie Payments for WooCommerce
- CVE-2026-77690Command injection vulnerabilityZohocorp ManageEngine Key Manager Plus
- CVE-2026-77779Improper access control vulnerabilityZohocorp ManageEngine Key Manager Plus
- CVE-2025-11229Privilege Escalation via Client Credentials Grant Type in WSO2 Identity ServerWSO2 Identity Server · WSO2 Identity Application Management…
- CVE-2026-11753A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the…LY Armeria
- CVE-2026-11749A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing…LY Armeria
- CVE-2026-105296Multiple Akeeba products lack the anti-CSRF check on some actions.Akeeba Backup for Joomla! · Akeeba Backup for WordPress +2
- CVE-2026-80335Out-of-bounds Write in BootloaderUnisoc (Shanghai) Technologies Co. Bootloader
- CVE-2026-79405Improper Input Validation in Modem FirmwareUnisoc (Shanghai) Technologies Co. Modem
- CVE-2026-121618Linksys E5600 Factory Quality Control fqc.cgi information disclosureLinksys E5600
- CVE-2026-121617Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds writeLinksys E5600
- CVE-2026-121802@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address)…better-auth Better Auth
- CVE-2026-121616Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds writeLinksys E5600
- CVE-2026-121615Linksys E5600 Login mesh_login.cgi improper authenticationLinksys E5600
- CVE-2026-84729Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or…ASUS Router firmware
- CVE-2026-84730Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with…ASUS Router firmware