CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-13594Improper Access Control vulnerabilityZohocorp Log360 · Zohocorp EventLog Analyzer
- CVE-2026-120988billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend…NAVER billboard.js
- CVE-2026-120987Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.NAVER Whale browser
- CVE-2025-5769Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI ModificationWSO2 API Control Plane · WSO2 API Manager +1
- CVE-2025-1397Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled…WSO2 Universal Gateway · WSO2 Traffic Manager +7
- CVE-2026-104647weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()weMail
- CVE-2026-104648weMail <= 2.1.6 - Editor+ API Key DisclosureweMail
- CVE-2026-103379WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API TokenWATI Chat and Notification
- CVE-2026-105967Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url ParameterGallery for Social Photo
- CVE-2026-106004DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion RevocationDT LMS
- CVE-2026-105993DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings UpdateDT Directory Lite Addon
- CVE-2026-115205AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_itemAZEXO Store Locator
- CVE-2026-77800Authentication bypass vulnerabilityZohocorp ManageEngine Key Manager Plus
- CVE-2026-77799Two-factor authentication bypassZohocorp ManageEngine Key Manager Plus
- CVE-2026-120578AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parametermigkapa AI Alt Text Generator
- CVE-2026-120538Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding…smub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2026-120577FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameterwpmanageninja FluentCart A New Era of eCommerce – Faster, L…
- CVE-2026-120575Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Nametigroumeow Photo Engine
- CVE-2026-120574SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5…SureCart – Ecommerce Made Easy For Selling Physical Product…
- CVE-2026-120534Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field TypeACF Extended Advanced Custom Fields: Extended PRO
- CVE-2026-120563WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Fieldamirhelzer WPML Multilingual & Multicurrency for WooCommerce
- CVE-2026-120561JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modificationjetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-120559Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversalsatindersingh Contact Form Extender for Divi – Submissions…
- CVE-2026-120524News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Actionblazethemes News Kit Addons For Elementor
- CVE-2026-120558Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameterzorem Advanced Shipment Tracking for WooCommerce
- CVE-2026-120552SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in…tigroumeow SEO Engine – Smart SEO with AI, Schema & Redirec…
- CVE-2026-120551WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey'…aresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2026-120544Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Routekodezen Academy LMS – AI Course Builder, Quizzes, Certifica…
- CVE-2026-120518BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handlerkalengi BuddyPress XProfile Custom Image Field
- CVE-2026-120971Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responsesRed Hat build of Apache Camel 4 for Quarkus · Red Hat bu… +6