CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-85351FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library ImportFV Flowplayer Video Player
- CVE-2026-85347FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox CaptionFV Flowplayer Video Player
- CVE-2026-85346FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser HandlersFV Flowplayer Video Player
- CVE-2026-19256All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute ForceAll In One Login
- CVE-2026-16304WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_idsWP Event Manager
- CVE-2026-123014iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary…iTerm2
- CVE-2026-123012In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a…Gogs · gogs.io/gogs
- CVE-2026-118193GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameterstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2026-120533Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profiledavidanderson Redux Framework
- CVE-2026-104812Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Keydavidanderson Redux Framework
- CVE-2026-116617Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameterstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-93389LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via…litespeedtech LiteSpeed Cache
- CVE-2026-120553Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode…ivole Customer Reviews for WooCommerce
- CVE-2026-123011STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.STMicroelectronics st-mems-android-linux-sensors-hal
- CVE-2026-123010@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim.twilio-labs netlify-okta-auth
- CVE-2026-122236OpenHands Landing missing authenticationOpenHands
- CVE-2026-122191itsourcecode Airline Reservation System manage_booked.php sql injectionitsourcecode Airline Reservation System
- CVE-2026-122190SourceCodester Online Food Ordering System Category Management add_category.php cross site scriptingSourceCodester Online Food Ordering System
- CVE-2026-122189OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-boundsOpenPPL ppl.nn
- CVE-2026-122188DeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading run.py override_config path traversalDeepGraphLearning KnowledgeGraphEmbedding
- CVE-2026-48173In the NAS message handler, improper validation of the length field in NAS message causes memory corruptionSamsung Semiconductor Exynos
- CVE-2026-48174In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service…Samsung Semiconductor Exynos
- CVE-2026-35494In the baseband, memory corruption during NAS packet processing can cause a denial of service.Samsung Semiconductor Exynos
- CVE-2026-48175Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.Samsung Semiconductor Exynos
- CVE-2026-48178Out of bound access in PPC due to race condition in global variable accessSamsung Semiconductor Exynos
- CVE-2026-48186Improper handling of messages before AS security activation can cause unexpected behaviorSamsung Semiconductor Exynos
- CVE-2026-68993A double free vulnerability in NPU driver due to improper pointer management (940)Samsung Semiconductor Exynos
- CVE-2026-68994A double free vulnerability in NPU driver due to improper pointer management (941)Samsung Semiconductor Exynos
- CVE-2026-48183Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissionsSamsung Semiconductor Exynos
- CVE-2026-68984In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.Samsung Semiconductor Exynos