CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-103077WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred
- CVE-2026-114185WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityWPVibes AnyWhere Elementor
- CVE-2026-119485WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerabilityweDevs Dokan
- CVE-2026-39777WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers WCFM Membership
- CVE-2026-119487WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerabilityweDevs Dokan
- CVE-2026-120843WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerabilityBarn2 Plugins Posts Table with Search & Sort
- CVE-2026-114183WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerabilityWPVibes AnyWhere Elementor
- GHSA-9PPR-WFW9-XVR2Netfoil doesn't decrement TTLgithub.com/tinfoil-factory/netfoil
- CVE-2026-116859WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerabilityWPMU DEV Forminator
- CVE-2026-116858WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerabilityWPMU DEV Forminator
- CVE-2026-39743WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers WCFM Membership
- CVE-2026-120846WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerabilityUncanny Owl Uncanny Automator
- CVE-2026-115714Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS ConnectionsElastic Docker images
- CVE-2026-115716Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of ServiceElastic APM Server
- CVE-2026-115715Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-115710Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information DisclosureElasticsearch
- CVE-2026-115298Incorrect Authorization in Elasticsearch Leading to Information DisclosureElasticsearch
- CVE-2026-115297NULL Pointer Dereference in Packetbeat Leading to Denial of ServiceElastic Packetbeat
- CVE-2026-115295Authorization Bypass Through User-Controlled Key in Kibana Leading to Information DisclosureElastic Kibana
- CVE-2026-115294Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource DeletionElastic Kibana
- CVE-2026-115293Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential DisclosureElastic Kibana
- CVE-2026-115292Authorization Bypass Through User-Controlled Key in Kibana Leading to Information DisclosureElastic Kibana
- CVE-2026-115290Uncontrolled Recursion in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-115289Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information DisclosureElastic APM Server
- CVE-2026-119521WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2026-119495WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerabilityWebberZone Better Search
- CVE-2026-121261phpMyAdmin ShapeFile SHP File loadFromFile infinite loopphpMyAdmin ShapeFile
- CVE-2026-121259Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimatorRed Hat Enterprise Linux
- GHSA-M3QR-FVP4-78XJArc has unauthenticated application log disclosure via `/api/v1/logs`github.com/basekick-labs/arc
- CVE-2026-109594Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified…SonicWall Global Management System