CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-54851WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityAwesomemotive Contact Form by WPForms
- CVE-2026-62000WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerabilityWC Lovers WCFM Marketplace
- CVE-2026-121818About Time Technologies｜Herowatch Go - Security MisconfigurationAbout Time Technologies Herowatch Go
- CVE-2026-121817About Time Technologies｜Herowatch Go Server - Insecure Direct Object ReferenceAbout Time Technologies Herowatch Go Server
- CVE-2026-121816About Time Technologies｜Herowatch Mini - Missing AuthenticationAbout Time Technologies Herowatch Mini
- CVE-2026-87044Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of servicezephyrproject zephyr
- CVE-2026-87043sys_rand_get() silently returns an unwritten buffer when the entropy device is not readyzephyrproject zephyr
- CVE-2026-87041Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memoryzephyrproject zephyr
- CVE-2026-87040Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read…zephyrproject zephyr
- CVE-2026-87039I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to driverszephyrproject zephyr
- CVE-2026-87038Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user modezephyrproject zephyr
- CVE-2026-16511Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memoryzephyrproject zephyr
- CVE-2026-85036Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queuezephyrproject zephyr
- CVE-2026-118983VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy BlocksVikWidgetsLoader
- CVE-2026-118783All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode AttributeAll-in-One Video Gallery
- CVE-2026-118637Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] ShortcodeSimple Download Monitor
- CVE-2026-118523EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status OverrideEventPrime
- CVE-2026-118422Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-PathStape Conversion Tracking
- CVE-2026-118407Premium Packages < 7.3.1 - Subscriber+ Guest Order TakeoverPremium Packages
- CVE-2026-118404Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDORPremium Packages
- CVE-2026-118403Premium Packages < 7.3.1 - Unauthenticated Guest Order Status DisclosurePremium Packages
- CVE-2026-115426WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory SettingWPvivid — Backup, Migration & Staging
- CVE-2026-115262Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During RestoreDuplicator · duplicator-pro
- CVE-2026-115257WP Roster < 2.36 - Unauthenticated Roster Data ModificationWP Roster
- CVE-2026-115250Text Typing < 2.2.2 - Contributor+ Stored XSSText Typing
- CVE-2026-115243WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_filesWPvivid — Backup, Migration & Staging
- CVE-2026-115242WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site PathWPvivid — Backup, Migration & Staging
- CVE-2026-115241WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot IDWPvivid — Backup, Migration & Staging
- CVE-2026-114431Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG UploadEnable Media Replace
- CVE-2026-112244Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry PointsDuplicator · duplicator-pro