CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-120436Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnmNetpbm
- CVE-2026-120435Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppmNetpbm
- CVE-2026-120434Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPolyNetpbm
- CVE-2026-120433Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPolyNetpbm
- CVE-2026-120432Netpbm before 10.86.51, 11.02.30, and 11.15.08 Integer Overflow in winicontopamNetpbm
- CVE-2026-120431Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer OverflowNetpbm
- CVE-2026-120430Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesControllerowen2345 Camaleon CMS
- CVE-2026-120429Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaControllerowen2345 Camaleon CMS
- CVE-2026-120428PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String BypassChaitin PandaWiki
- CVE-2026-120427MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Readzmister2016 MrDoc
- CVE-2026-120426OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve RouteOpenCSG CSGHub
- CVE-2026-120425Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpointmunafio Chatify
- CVE-2026-120318Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAXCodeixer Product Gallery Slider & Additional Variation Imag…
- CVE-2025-71450inih before r63 Stack Buffer Under-Read in ini_parse_stream Discard Loopbenhoyt inih
- CVE-2026-74993SQL Injection in Starnet Computer Systems' Inventory Tracking ApplicationStarnet Computer and Network Systems Inventory Tracking App…
- CVE-2026-111959Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds readsApache Software Foundation arrow · arrow-data
- CVE-2026-102802Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension…regularlabs.com Sourcerer Free extension for Joomla · re… +1
- CVE-2026-103419Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.joomshaper.com Helix Ultimate extension for Joomla
- CVE-2026-103420Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com StageIt extension for Joomla
- CVE-2026-105600Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com StageIt extension for Joomla
- CVE-2026-105601Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com StageIt extension for Joomla
- CVE-2026-105602Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.joomshaper.com Helix Ultimate extension for Joomla
- CVE-2026-102801Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1regularlabs.com Users Anywhere (Free, Pro) extension for Jo…
- CVE-2026-114364Apache Syncope: SQL injection via unsanitized opEvent in Audit Events searchApache Software Foundation org.apache.syncope.core:syncope-…
- CVE-2026-113687Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypassApache Software Foundation org.apache.syncope.core:syncope-…
- CVE-2026-113511Apache Syncope: Delegated administration boundaries can be bypassed for Realm updateApache Software Foundation org.apache.syncope.core.idrepo:s…
- CVE-2026-120463Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linkingsassanix Warracker
- CVE-2026-110535Apache Syncope: AuthProfile value escalation via self-service updateApache Software Foundation org.apache.syncope.core.am:synco…
- CVE-2026-109083Apache Syncope: Remote Code Execution via Flowable JUEL expressionApache Software Foundation org.apache.syncope.ext.flowable:…
- CVE-2026-116606Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security GatewayBarracuda Networks Barracuda Email Security Gateway