CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-119745Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_downloadSender – Newsletter, SMS and Email Marketing Automation for…
- CVE-2026-118391Unbounded query cache growth from interpolated JSON paths and splice lists in Ectoelixir-ecto ecto · ecto
- CVE-2026-121993wePOS before 2.0.3 Missing Authorization via payment/process Endpointwedevs wePOS – Point Of Sale (POS) for WooCommerce & Dokan
- CVE-2026-121970Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgerywphostingdev Pay with Vipps and MobilePay for WooCommerce
- CVE-2026-121373Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for…sensiolabs symfony/html-sanitizer
- CVE-2026-121147Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile applicationTata Motors iRA · Tata Motors iRA.ev
- CVE-2026-121146Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile applicationTata Motors iRA · Tata Motors iRA.ev
- CVE-2026-121620CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verificationcoopcycle-web
- CVE-2026-121145Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile applicationTata Motors iRA · Tata Motors iRA.ev
- CVE-2026-118516Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Controlsensiolabs symfony/routing
- CVE-2026-121946zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builderszbateson mail-mime-parser
- CVE-2026-121945CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpointcoopcycle-web
- CVE-2026-121944sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLVirontec sngrep
- CVE-2026-121943Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packetirontec sngrep
- CVE-2026-121942ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.cmchehab zbar
- CVE-2026-121941libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysexmunt libmt32emu
- CVE-2026-121940Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script ControllersStonewuu ai-fusion-video
- CVE-2026-121939Databasement before 1.10.9 Account Takeover via OIDC Email Auto-LinkingDavid-Crty Databasement
- CVE-2026-121938langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}moyangzhan langchain4j-aideepin
- CVE-2026-121937loonflow before r3.2.3 IDOR via ticket_flow_history Endpointblackholll loonflow
- CVE-2026-121936easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS APIcosin2077 easyVoice
- CVE-2026-121144Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile applicationTata Motors iRA · Tata Motors iRA.ev
- CVE-2026-118513Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)sensiolabs symfony/security-http
- CVE-2026-107479Integer truncation vulnerability in QTextCodec conversion functions impacts Qt FrameworkQt
- CVE-2026-119468WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilityNoptin Newsletter Team Noptin
- CVE-2026-119481WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerabilityCrocoblock JetFormBuilder
- CVE-2026-65555WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerabilityUncanny Owl Uncanny Toolkit for LearnDash
- RUSTSEC-2026-0456Panic on an HEVC tile layout that does not match the active SPSheifer-hevc-dec
- RUSTSEC-2026-0458Memory exhaustion when parsing a crafted `iloc` boxheifer-isobmff
- RUSTSEC-2026-0460Panic on chroma QP offsets enabled with an empty offset listheifer-hevc-dec