CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-112072vault-java-driver: stored deeply nested JSON kills every thread that reads itio.github.jopenlibs:vault-java-driver
- CVE-2026-109408vault-java-driver: SslConfig silently disables requested TLS verificationio.github.jopenlibs:vault-java-driver
- CVE-2026-107776Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount CouponDokan
- CVE-2026-100109Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_userSecurity For WooCommerce
- CVE-2026-123033Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their…iXsystems TrueNAS SCALE
- CVE-2026-123029Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the…Wowza Streaming Engine
- CVE-2026-123025An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin…OPNsense os-acme-client
- CVE-2026-123017GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server.GodotSteam
- CVE-2026-109150WP PageNavi Style <= 1.4 - Stored XSS via CSRFWP PageNavi Style
- CVE-2026-107787CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_mergeCatFolders
- CVE-2026-107786CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' SettingCatFolders
- CVE-2026-107775Dokan < 5.3.3 - Admin+ Cross-Site Vendor ActivationDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-107774Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact FormDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-107773Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST EndpointDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-105971Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajaxCar Dealer (Dealership) and Vehicle sales
- CVE-2026-105259Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG UploadEasy Social Icons
- CVE-2026-100144IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' ParameterIVPAY payments
- CVE-2025-15702Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSSCloud Blocks
- CVE-2025-15701Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color SettingsEasy Social Icons
- CVE-2026-91049EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load AttributeEWWW Image Optimizer
- CVE-2026-90967Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOREssential Real Estate
- CVE-2026-90966Essential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajaxEssential Real Estate
- CVE-2026-90965Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image DisclosureEssential Real Estate
- CVE-2026-90964Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email SendingEssential Real Estate
- CVE-2026-90963Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajaxEssential Real Estate
- CVE-2026-88814YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race ConditionYITH WooCommerce Gift Cards
- CVE-2026-87856Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction BypassSubscriptions for WooCommerce
- CVE-2026-86795Community Events < 1.6.0 - Unauthenticated Pending Events Disclosure via ajax_admin_event_listCommunity Events
- CVE-2026-86442WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDORWP Event Manager
- CVE-2026-85570Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key DisclosureTutor LMS