CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-122148In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability.Yealink MeetingBoard Pro
- CVE-2026-82029Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portalinvoiceninja
- CVE-2026-121929EmpireSoft EmpireCMS index.php cross site scriptingEmpireSoft EmpireCMS
- CVE-2026-122124On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB…Yealink UVC40 E2
- CVE-2026-122120In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be…Yealink Plug-in Softwares
- CVE-2026-121928InfiniFlow RAGFlow Images API file_utils.py cross site scriptingInfiniFlow RAGFlow
- CVE-2026-122118In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient…Yealink AVHub · Yealink UVC86 +6
- CVE-2026-57853DataGerry < 3.3.0 SSTI via DocAPI Template RenderingDataGerry
- CVE-2026-122116Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network…Yealink T3XW Series Phones · Yealink T4X Series Phones +11
- CVE-2026-121927InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgeryInfiniFlow RAGFlow
- CVE-2026-121971Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path Referencessensiolabs symfony/http-client
- CVE-2026-122054BIG-HKSCS decoding hang on crafted inputThe GNU C Library glibc
- CVE-2026-121926yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authenticationyezhihao jt808-server
- CVE-2026-119749GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment BypassAyeCode Payment forms, Buy now buttons, and Invoicing Syste…
- CVE-2026-119748GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoiceAyeCode Payment forms, Buy now buttons, and Invoicing Syste…
- CVE-2026-119747GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST APIAyeCode Payment forms, Buy now buttons, and Invoicing Syste…
- CVE-2026-20241Cisco Identity Services Engine Authorization Bypass VulnerabilityCisco Identity Services Engine Software · Cisco ISE Passive…
- CVE-2026-76419Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCisco Unified Communications Manager
- CVE-2026-76506Cisco Unified Computing System Central Remote Code Execution VulnerabilityCisco Unified Computing System Central Software
- CVE-2026-106554jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)com.fasterxml.jackson.dataformat:jackson-dataformat-cbor ·…
- CVE-2026-109518APT RCE via hard link reuseDebian APT · Ubuntu APT
- CVE-2026-119746ProSoft ICX35 Login Lockout Bypass via Client-Side CookiesProSoft Technology X35-HWC-A · ProSoft Technology ICX35-HWC…
- CVE-2026-121967Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversalcoder
- CVE-2026-121966Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leaktraefik
- CVE-2026-121965Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Keyparse-community parse-server
- CVE-2026-121964FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragmentFreeRDP
- CVE-2026-121963FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel CloseFreeRDP
- CVE-2026-121962FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization ReadFreeRDP
- CVE-2026-121961FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker RaceFreeRDP
- CVE-2026-121960FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequestFreeRDP