Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
12 matching advisories · 12 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium5.4
CVE-2026-129133

MRBS before 1.13.0 CSV Formula Injection via Report Export

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

meeting-room-booking-system · mrbs-code
medium5.4
CVE-2026-126289

NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts

NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

nocodb · nocodb
high7.1
CVE-2026-124018

Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Jegstudio · Gutenverse Form – Contact Form Builder, Block Form & Booking Form
medium6.5
CVE-2026-124591

Bahleel CsvExporter.php fputcsv csv injection

A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

n/a · Bahleel
high7.3
CVE-2026-111038

Multiple vulnerabilities in Coupa’s Total Spend Management Platform

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Coupa · Coupa Total Spend Management Platform
medium5.4
CVE-2026-121433

AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

AzuraCast · AzuraCast
high7.1
CVE-2026-67187

Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Saturday Drive · Ninja Forms
high8.4
CVE-2026-78209

exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

exceljs · exceljs