CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-111040Multiple vulnerabilities in Coupa’s Total Spend Management PlatformCoupa Total Spend Management Platform
- CVE-2026-111038Multiple vulnerabilities in Coupa’s Total Spend Management PlatformCoupa Total Spend Management Platform
- CVE-2026-111037Multiple vulnerabilities in Coupa’s Total Spend Management PlatformCoupa Total Spend Management Platform
- CVE-2026-111036Multiple vulnerabilities in Coupa’s Total Spend Management PlatformCoupa Total Spend Management Platform
- CVE-2026-115498Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Fieldwingerspeed Slim Jetpack
- CVE-2026-120554Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Savecarazo Import and export users and customers
- CVE-2026-93900Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeselliotvs Simple CAPTCHA with Cloudflare Turnstile
- CVE-2026-110935Path traversal in plug-in deploymentPhoenix Contact PLCnext Engineer
- CVE-2026-110022Signed plug-in validation bypassPhoenix Contact PLCnext Engineer
- CVE-2026-110021Missing GSDX SignatureValue verificationPhoenix Contact PLCnext Engineer
- CVE-2026-95649IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code executionI.R.I.S S.A. IRISPowerscan
- CVE-2026-94460IRISPowerscan Insecure default privilege assignment for installation accountI.R.I.S S.A. IRISPowerscan
- CVE-2026-94459IRISPowerscan Default accounts with predictable credentialsI.R.I.S S.A. IRISPowerscan
- CVE-2026-114421Empty initial password permits GINA account takeoverSEPPmail AG SEPPmail Secure Email Gateway
- CVE-2026-114420LDAP wildcard injection exposes GINA recipient accountsSEPPmail AG SEPPmail Secure Email Gateway
- CVE-2026-114426Pre-authentication upload parsing permits resource exhaustionSEPPmail AG SEPPmail Secure Email Gateway
- CVE-2026-114425Forged LFT metadata permits arbitrary file read and deletionSEPPmail AG SEPPmail Secure Email Gateway
- CVE-2026-114424Code execution through double evaluation in address replacement rulesSEPPmail AG SEPPmail Secure Email Gateway
- CVE-2026-19731Path Traversal in TÜBİTAK BİLGEM's İmzagerTÜBİTAK BİLGEM Software Technologies Research Institute İmz…
- CVE-2026-19721XXE in TÜBİTAK BİLGEM's İmzagerTÜBİTAK BİLGEM Software Technologies Research Institute İmz…
- CVE-2026-57666WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerabilityAguila Technologies WP Customer Area
- CVE-2026-119366WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerabilityAdvancedCoding wpDiscuz
- CVE-2026-62007WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerabilityUnlimited Elements For Elementor
- CVE-2026-54861WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerabilityAguila Technologies WP Customer Area
- CVE-2026-62126WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerabilityminiOrange SAML SP Single Sign On
- CVE-2026-57775WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerabilityRelyWP Simple Cloudflare Turnstile
- CVE-2026-57639WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerabilityRoland Murg WP Booking System
- CVE-2026-119477WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerabilityJacob N. Breetvelt WP Photo Album Plus
- CVE-2026-56065WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerabilityDoofinder for WooCommerce
- CVE-2026-110944Resource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer)Qt Framework