CVE-2026 list

CVE-2026 records published in May 2026

Page four of seven: records 3,001 to 4,000 of the 6,293 published in May 2026, newest first. The first page carries the figures for May 2026.

CVE-2026 records published in May 2026, newest first: records 3,001 to 4,000 of 6,293
CVE Summary CVSS EPSS Published Signals
CVE-2026-4054Mattermost doesn't validate the response body of proxied images4.3CNA v3.10.4%2026-05-15Fix
CVE-2026-4053Mattermost post edit time limit is not enforced on some post update operations3.1CNA v3.10.3%2026-05-15Fix
CVE-2026-2652Authentication bypass in MLflow/MLflow8.6CNA v3.01.4%2026-05-15NucleiFix
CVE-2026-2031Google Cloud Internal Integration Platform APIs improper access control10.0CNA v4.00.5%2026-05-15Fix
CVE-2026-0481Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability9.2CNA v4.00.3%2026-05-15
CVE-2026-0438AMD Ryzen and Threadripper processors SMM handler vulnerability5.4CNA v4.00.1%2026-05-15
CVE-2026-0432AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics incorrect default permissions8.5CNA v4.00.1%2026-05-15
CVE-2026-0428AMD Instinct™ MI300A improper quantity validation1.8CNA v4.00.1%2026-05-15
CVE-2026-0427AMD Instinct™ MI210 incomplete cleanup4.6CNA v4.00.1%2026-05-15
CVE-2026-46470GStreamer Good Plug-ins divide by zero9.1v3.10.2%2026-05-14Fix
CVE-2026-46469GStreamer Good Plug-ins divide by zero5.5v3.10.1%2026-05-14Fix
CVE-2026-46446Alinto SOGo SQL injection7.1CNA v3.10.4%2026-05-14Fix
CVE-2026-46445Alinto SOGo SQL injection7.1CNA v3.10.4%2026-05-14Fix
CVE-2026-46419Yubico webauthn-server-core second factor return value check vulnerability7.5CNA v3.10.4%2026-05-14Fix
CVE-2026-46356Fleet: IP spoofing allows bypassing API rate limiting6.9CNA v4.00.4%2026-05-14Fix
CVE-2026-45781MCP Registry: OCI validator skips ownership check on upstream rate limits3.5CNA v3.10.2%2026-05-14Fix
CVE-2026-45448ntopng URL redirection to untrusted site (open redirect)4.3CNA v3.10.3%2026-05-14
CVE-2026-45375SiYuan Bazaar marketplace cross-site scripting9.0CNA v3.10.4%2026-05-14
CVE-2026-45371SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs7.2CNA v4.00.4%2026-05-14Fix
CVE-2026-45370python-utcp CLI subprocess environment information disclosure7.7CNA v3.10.4%2026-05-14Fix
CVE-2026-45369universal-tool-calling-protocol python-utcp utcp-cli vulnerable to command injection8.3CNA v3.10.4%2026-05-14Fix
CVE-2026-45248Hedera Guardian authentication bypass information disclosure6.9CNA v4.00.4%2026-05-14
CVE-2026-45205Apache Commons Configuration: StackOverflowError for YAML input with cycles5.3CISA ADP v3.10.8%2026-05-14Fix
CVE-2026-45148SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata4.3CNA v3.10.3%2026-05-14Fix
CVE-2026-45147SiYuan tag API missing authorization4.3CNA v3.10.3%2026-05-14Fix
CVE-2026-44919OpenStack Ironic: Pre-Validation Checksum Calculation allows denial of service6.5v3.10.5%2026-05-14Fix
CVE-2026-44827Diffusers: None.py Trust Remote Code Bypass8.8CNA v3.10.7%2026-05-14Fix
CVE-2026-44700Elixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshake8.7CNA v4.00.4%2026-05-14Fix
CVE-2026-44679Tuist: Forgot password flow lacks throttling for reset email delivery6.9CNA v4.00.4%2026-05-14Fix
CVE-2026-44678Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID7.1CNA v4.00.4%2026-05-14
CVE-2026-44673CESNET libyang LYB parser heap buffer overflow7.5CNA v3.11.0%2026-05-14Fix
CVE-2026-44671ZITADEL: LDAP Filter injection in Login Flow7.5CNA v3.10.6%2026-05-14Fix
CVE-2026-44670SiYuan: Stored XSS via attribute view name to Electron renderer RCE in SiYuan9.4CNA v4.00.6%2026-05-14Fix
CVE-2026-44666HRConvert2: Missing Sanitization enables unauthenticated remote command execution9.3CNA v4.00.5%2026-05-14Fix
CVE-2026-44662rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding5.1CNA v4.00.2%2026-05-14Fix
CVE-2026-44661universal-tool-calling-protocol python-utcp utcp-http vulnerable to SSRF4.7CNA v3.10.2%2026-05-14Fix
CVE-2026-44647OneDev: Path traversal (read capability via Git LFS pointer resolution)7.1CNA v4.00.4%2026-05-14Fix
CVE-2026-44638libsixel SIXEL decoder null pointer dereference2.5CNA v3.10.1%2026-05-14Fix
CVE-2026-44637libsixel SIXEL parser integer overflow7.1CNA v3.10.2%2026-05-14Fix
CVE-2026-44636libsixel SIXEL encoder integer overflow7.4CNA v3.10.1%2026-05-14Fix
CVE-2026-44633Live Helper Chat REST API chat update endpoint incorrect authorization8.1CNA v3.10.4%2026-05-14Fix
CVE-2026-44592Gradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning9.4CNA v3.10.2%2026-05-14
CVE-2026-44589Nuxt OG Image URL denylist server-side request forgery3.7CNA v3.10.3%2026-05-14Fix
CVE-2026-44588SiYuan: Electron Renderer RCE9.4CNA v4.00.6%2026-05-14Fix
CVE-2026-44586SiYuan Bazaar marketplace cross-site scripting8.3CNA v3.10.4%2026-05-14Fix
CVE-2026-44544Gittuf's policy can be rolled back to prior valid versions4.9CNA v4.00.3%2026-05-14Fix
CVE-2026-44542FileBrowser Public Share delete API path traversal allows Unauthenticated arbitrary file deletion9.1CNA v3.10.6%2026-05-14Fix
CVE-2026-44523enchant97 note-mark note Mark: JWT Secret Weakness allows full account takeover via token forgery10.0CNA v3.10.2%2026-05-14Fix
CVE-2026-44522enchant97 note-mark note Mark: Arbitrary file write8.6CNA v4.00.7%2026-05-14Fix
CVE-2026-44520Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler5.7CNA v3.10.3%2026-05-14Fix
CVE-2026-44516Valtimo: Sensitive data exposure7.6CNA v3.10.3%2026-05-14Fix
CVE-2026-44515Nextcloud News: Authenticated blind SSRF via feed URL2.3CNA v4.00.3%2026-05-14Fix
CVE-2026-44514Kubetail dashboard WebSocket endpoints vulnerability6.5CNA v3.10.2%2026-05-14Fix
CVE-2026-44513Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components8.8CNA v3.10.9%2026-05-14Fix
CVE-2026-44511Katalyst Koi: Session cookies can be replayed after user logout7.4CNA v3.10.3%2026-05-14Fix
CVE-2026-44504Aegra thread run endpoint insecure direct object reference8.6CNA v4.00.4%2026-05-14Fix
CVE-2026-44503Microsoft Kiota RedirectHandler middleware vulnerability7.0CNA v4.00.9%2026-05-14Fix
CVE-2026-44501DataHub OIDC REDIRECT_URL Cookie deserialization4.3CNA v3.10.2%2026-05-14Fix
CVE-2026-44484lightning-ai pytorch-lightning Compromise of PyTorch Lightning PyPi Package Versions9.3CNA v4.00.7%2026-05-14Fix
CVE-2026-44482soundcloud-rpc track metadata rendering remote code execution9.6CNA v3.10.6%2026-05-14Fix
CVE-2026-44430MCP Registry HTTP namespace verification server-side request forgery6.3CNA v4.00.3%2026-05-14Fix
CVE-2026-44429MCP Registry: Stored XSS in catalogue UI5.1CNA v4.00.2%2026-05-14Fix
CVE-2026-44428MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience2.1CNA v4.00.3%2026-05-14Fix
CVE-2026-44427MCP Registry: Open redirect0.0CNA v4.00.4%2026-05-14Fix
CVE-2026-44375Nerdbank.MessagePack DateTime decoding denial of service7.5CNA v3.10.6%2026-05-14Fix
CVE-2026-44374Backstage unprocessed entities catalog plugin incorrect authorization4.3CNA v3.10.3%2026-05-14Fix
CVE-2026-44371Open OnDemand: Specially crafted filenames can execute javascript in the file browser5.3CNA v4.00.4%2026-05-14Fix
CVE-2026-44348PoDoFo: Double free vulnerability in compute_hash_to_sign2.5CNA v3.10.1%2026-05-14Fix
CVE-2026-44312css_parser allows to MITM included HTTPS css urls5.8CNA v3.10.2%2026-05-14Fix
CVE-2026-44308Spring Cloud AWS SNS HTTP/HTTPS endpoint notification handling spoofing6.3CNA v4.00.3%2026-05-14Fix
CVE-2026-44283Etcd: Read access via PrevKv in Etcd transactions may bypass RBAC authorization checks0.0CNA v3.10.3%2026-05-14Fix
CVE-2026-44216Wasmtime: Panic when allocating a table exceeding the size of the host's address space5.9CNA v4.00.6%2026-05-14Fix
CVE-2026-44212PrestaShop customer service view stored cross-site scripting9.3CNA v3.10.4%2026-05-14Fix
CVE-2026-43996Academy Software Foundation OpenImageIO TGA decoder out-of-bounds read5.5CNA v3.10.2%2026-05-14Fix
CVE-2026-43909Academy Software Foundation OpenImageIO DPX decoder out-of-bounds read8.8CNA v3.10.5%2026-05-14Fix
CVE-2026-43908Academy Software Foundation OpenImageIO DPX decoder out-of-bounds write8.8CNA v3.10.5%2026-05-14Fix
CVE-2026-43907Academy Software Foundation OpenImageIO DPX decoder out-of-bounds write8.3CNA v3.10.5%2026-05-14Fix
CVE-2026-43906OpenImageIO: HEIF heap overflow8.5CNA v4.00.2%2026-05-14Fix
CVE-2026-43905OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation7.1CNA v4.00.2%2026-05-14Fix
CVE-2026-43904OpenImageIO: Softimage PIC RLE decoder heap buffer overflow longCount not clamped to image width8.4CNA v4.00.2%2026-05-14Fix
CVE-2026-43903Academy Software Foundation OpenImageIO SGI RLE decoder out-of-bounds write8.4CNA v4.00.2%2026-05-14Fix
CVE-2026-43644podinfo reflected XSS via /echo endpoint6.1NVD v3.10.3%2026-05-14Fix
CVE-2026-42897Microsoft Exchange Server cross-site scripting8.1CNA v3.10.5%2026-05-14KEVEmerging ThreatsFix
CVE-2026-42881STIGQter: Arbitrary file write leading to local code execution via Export HTML8.4CNA v4.00.2%2026-05-14Fix
CVE-2026-42847ClipBucket action logs admin endpoint SQL injection7.1CNA v4.00.3%2026-05-14Fix
CVE-2026-42598Pode: Directory traversal is possible on Static Routes6.9CNA v4.00.5%2026-05-14Fix
CVE-2026-42597Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme5.9CNA v3.10.4%2026-05-14Fix
CVE-2026-42596Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook9.4CNA v3.11.8%2026-05-14NucleiFix
CVE-2026-42595Gotenberg: Server-side request forgery8.6CNA v3.10.4%2026-05-14Fix
CVE-2026-42594Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine7.5CNA v3.10.4%2026-05-14Fix
CVE-2026-42593Gotenberg stamp and watermark expressions path traversal5.3CNA v3.10.4%2026-05-14Fix
CVE-2026-42592Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes5.3CNA v3.10.2%2026-05-14Fix
CVE-2026-42591Gotenberg: Server-side request forgery (SSRF) in github.com/gotenberg/gotenberg/v88.2CNA v3.10.3%2026-05-14Fix
CVE-2026-42590Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist8.2CNA v3.10.4%2026-05-14Fix
CVE-2026-42589Gotenberg: Unauthenticated RCE via ExifTool Metadata Key injection9.8CNA v3.13.7%2026-05-14NucleiExploit codeFix
CVE-2026-42572Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`5.3CNA v3.10.3%2026-05-14Fix
CVE-2026-42559modelcontextprotocol rust-sdk dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport8.8CNA v3.10.2%2026-05-14Exploit codeFix
CVE-2026-42555Valtimo: SpEL injection via StandardEvaluationContext allows remote code execution by admin users9.1CNA v3.10.8%2026-05-14Fix
CVE-2026-42457loft-sh loft vCluster Platform: Stored XSS can lead to privilege escalation9.0CNA v3.10.5%2026-05-14Fix
CVE-2026-42334Mongoose: Improper sanitization of $nor in sanitizeFilter may allow NoSQL injection7.5CNA v3.10.5%2026-05-14Fix
CVE-2026-42327rust-openssl OCSP responder URL parsing improper input validation8.7CNA v4.00.2%2026-05-14Fix
CVE-2026-42283DevSpace UI Server WebSocket CheckOrigin does not validate source7.7CNA v3.10.2%2026-05-14Fix
CVE-2026-42281MagicMirror²: Unauthenticated SSRF via /cors endpoint9.2CNA v4.01.7%2026-05-14NucleiExploit codeFix
CVE-2026-42186OpenBao's Namespace Deletion may not Delete Data properly2.3CNA v4.00.4%2026-05-14Fix
CVE-2026-42159Flowsint: Stored XSS in description of node5.3CNA v4.00.3%2026-05-14Fix
CVE-2026-41937Vvveb unrestricted file upload RCE via plugin upload8.6CNA v4.00.6%2026-05-14Fix
CVE-2026-41935Vvveb uncontrolled recursion denial of service7.1CNA v4.00.5%2026-05-14Fix
CVE-2026-41933Vvveb directory listing information disclosure6.9CNA v4.00.4%2026-05-14Fix
CVE-2026-41932Vvveb stored XSS via Signup controller5.3CNA v4.00.4%2026-05-14Fix
CVE-2026-41888Distribution: Tag deletion bypasses `storage.delete.enabled` configuration6.3CNA v4.00.3%2026-05-14Fix
CVE-2026-41615Microsoft Authenticator information disclosure9.6CNA v3.11.1%2026-05-14Fix
CVE-2026-41315midoks mdserver-web OS command injection9.3CNA v4.01.3%2026-05-14
CVE-2026-41281KDDI あんしんフィルター for au cleartext transmission of sensitive information6.3CNA v4.00.1%2026-05-14
CVE-2026-40893Gotenberg ExifTool tag blocklist vulnerability8.2CNA v3.10.5%2026-05-14Fix
CVE-2026-38740Foscam VD1 Video Doorbell cleartext transmission of sensitive information5.3CISA ADP v3.10.2%2026-05-14
CVE-2026-27886Strapi may leak sensitive data via relational filtering due to lack of query sanitization9.2CNA v4.02.5%2026-05-14NucleiExploit codeFix
CVE-2026-27680CSS injection vulnerability in SAP NetWeaver Application Server ABAP3.1CNA v3.10.3%2026-05-14Fix
CVE-2026-26191Fleet vulnerable to OS command injection in software packages6.0CNA v4.00.9%2026-05-14Fix
CVE-2026-26062Fleet server may terminate unexpectedly when handling certain gRPC requests8.7CNA v4.00.5%2026-05-14Fix
CVE-2026-24899Fleet Windows MDM Azure AD JWT authentication bypass8.2CNA v4.00.4%2026-05-14Fix
CVE-2026-24712Northern.tech Cfengine command injection7.3CISA ADP v3.10.9%2026-05-14Fix
CVE-2026-24711Northern.tech Cfengine improper access control5.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-24710Northern.tech Cfengine cross-site scripting6.1CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-24000Fleet has a rate limiting bypass via untrusted client IP headers6.9CNA v4.00.4%2026-05-14Fix
CVE-2026-23998Fleet has a Windows MDM management endpoint authentication bypass8.2CNA v4.00.2%2026-05-14Fix
CVE-2026-22707Strapi upload Plugin MIME Validation Bypass via Content API5.3CNA v4.00.2%2026-05-14Fix
CVE-2026-22706Strapi: Password Reset Does not Revoke Existing Refresh Sessions2.1CNA v4.00.3%2026-05-14Exploit codeFix
CVE-2026-22599Strapi vulnerable to SQL injection in Content Type Builder9.3CNA v4.01.2%2026-05-14Exploit codeFix
CVE-2026-21730Verint Verba login logging stored cross-site scripting6.1v3.10.2%2026-05-14Fix
CVE-2026-20224Cisco Catalyst SD-WAN Manager XML external entity injection8.6CNA v3.11.0%2026-05-14Exploit codeFix
CVE-2026-20210Cisco Catalyst SD-WAN Manager privilege escalation5.4CNA v3.10.2%2026-05-14Fix
CVE-2026-20209Cisco Catalyst SD-WAN Manager privilege escalation5.4CNA v3.10.2%2026-05-14Fix
CVE-2026-20182Cisco Catalyst SD-WAN controller authentication bypass10.0CNA v3.191.5%2026-05-14KEVNucleiMetasploitExploit codeKCVFix
CVE-2026-8634Crabbox Environment variable information disclosure9.3CNA v4.01.0%2026-05-14Fix
CVE-2026-8629OpenClaw Crabbox agent ticket endpoints privilege escalation8.6CNA v4.00.5%2026-05-14Fix
CVE-2026-8621Crabbox authentication bypass via header spoofing8.7CNA v4.00.7%2026-05-14Fix
CVE-2026-8597Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDK6.4CNA v4.00.6%2026-05-14Fix
CVE-2026-8596Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path8.5CNA v4.00.8%2026-05-14Fix
CVE-2026-8587Google Chrome extensions use-after-free8.8CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8586Google Chrome Chromoting inappropriate implementation5.5CISA ADP v3.10.1%2026-05-14Fix
CVE-2026-8585Google Chrome Media inappropriate implementation7.5CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8584Google Chrome Views inappropriate implementation4.2CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8583Google Chrome WebXR insufficient policy enforcement5.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8582Google Chrome Dawn object lifecycle issue5.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8581Google Chrome GPU use-after-free8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8580Google Chrome Mojo use-after-free9.6CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8579Google Chrome improper input validation3.1CISA ADP v3.10.1%2026-05-14Fix
CVE-2026-8578Google Chrome GPU out-of-bounds read3.1CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8577Google Chrome Fonts integer overflow8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8576Google ChromeOS inappropriate implementation4.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8575Google Chrome UI use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8574Google Chrome Core use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8573Google Chrome Codecs integer overflow8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8572Google Chrome Network insufficient policy enforcement3.1CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8571Google Chrome GPU insufficient policy enforcement8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8570Google Chrome V8 type confusion6.5CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8569Google Chrome Codecs out-of-bounds write8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8567Google Chrome ANGLE integer overflow4.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8566Google Chrome Payments insufficient policy enforcement4.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8565Google Chrome Downloads inappropriate implementation4.7CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8564Google Android Downloads in Google Chrome incorrect security UI4.2CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8563Google Chrome IFrame Sandbox insufficient policy enforcement4.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8562Google Chrome Navigation side-channel information leak4.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8561Google Chrome Fullscreen incorrect security UI5.4CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8560Google Chrome SwiftShader heap-based buffer overflow4.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8559Google Chrome Internationalization integer overflow4.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8558Google Chrome Fonts out-of-bounds write8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8557Google Chrome Accessibility use-after-free7.5CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8556Google Chrome ANGLE inappropriate implementation3.1CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8555Google Chrome GTK use-after-free8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8554Google Chrome ANGLE type confusion3.1CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8553Google Chrome GPU use-after-free3.1CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8552Google Chrome GPU heap-based buffer overflow4.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8551Google Chrome Downloads use-after-free8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8550Google Chrome Google Lens use-after-free6.5CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8549Google Chrome Media use-after-free8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8548Google Chrome Media out-of-bounds write8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8547Google Chrome Passwords insufficient policy enforcement7.5CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8546Google Chrome GPU out-of-bounds read5.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8545Google Chrome memory corruption3.1CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8544Google Chrome Media use-after-free8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8543Google Chrome FileSystem out-of-bounds read5.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8542Google Chrome Core use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8541Google Chrome UI out-of-bounds read5.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8540Google Chrome V8 type confusion8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8539Google Chrome SanitizerAPI injection5.4CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8538Google Chrome denial of service5.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8537Google Chrome ViewTransitions insufficient policy enforcement4.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8536Google Chrome improper input validation3.1CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8535Google ChromeOS out-of-bounds read5.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8534Google ChromeOS integer overflow8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8533Google Chrome Accessibility use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8532Google Chrome XML integer overflow8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8531Google Chrome WebML heap-based buffer overflow8.8CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8530Google Chrome Network use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8529Google Chrome Codecs heap-based buffer overflow8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8528Google Chrome improper input validation4.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8527Google Chrome arbitrary code execution8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8526Google Chrome WebRTC out-of-bounds write8.8CISA ADP v3.10.5%2026-05-14Fix
CVE-2026-8525Google Chrome ANGLE heap-based buffer overflow8.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8524Google Chrome WebAudio out-of-bounds write8.8CISA ADP v3.10.5%2026-05-14Fix
CVE-2026-8523Google Chrome Mojo use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8522Google Chrome Downloads use-after-free8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8521Google Chrome Tab Groups use-after-free7.5CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8520Google Chrome race condition8.3CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8519Google Chrome ANGLE integer overflow8.8CISA ADP v3.10.2%2026-05-14Fix
CVE-2026-8518Google Chrome Blink use-after-free8.8CISA ADP v3.10.4%2026-05-14Fix
CVE-2026-8517Google Chrome WebShare object lifecycle issue8.8CISA ADP v3.10.5%2026-05-14Fix
CVE-2026-8516Google Chrome improper input validation5.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8515Google Chrome HID use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8514Google Chrome Aura use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8513Google Chrome Input use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8512Google Chrome FileSystem use-after-free8.3CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8511Google Chrome UI use-after-free9.6CISA ADP v3.10.3%2026-05-14Fix
CVE-2026-8510Google Chrome Skia integer overflow7.5CISA ADP v3.110.5%2026-05-14Fix
CVE-2026-8509Google Chrome WebML heap-based buffer overflow8.8CISA ADP v3.10.5%2026-05-14Fix
CVE-2026-8468Unbounded buffer accumulation in multipart header parsing causes denial of service in plug8.2CNA v4.00.8%2026-05-14Fix
CVE-2026-8295Integer overflow in simdjson6.9CNA v4.00.4%2026-05-14Fix
CVE-2026-8280Allocation of resources without limits or throttling in GitLab6.5CNA v3.10.5%2026-05-14Fix
CVE-2026-8181Burst Statistics - authentication bypass to admin account takeover9.8CNA v3.13.0%2026-05-14Reported exploitedNucleiExploit codeFix
CVE-2026-8144Missing authorization in GitLab4.3CNA v3.10.3%2026-05-14Fix
CVE-2026-7648ThimPress LearnPress REST API endpoint insecure direct object reference4.3CNA v3.10.4%2026-05-14Fix
CVE-2026-7525My Calendar WordPress plugin missing authorization unauthorized Event Publication4.3CNA v3.10.5%2026-05-14Fix
CVE-2026-7481Improper neutralization of input during web page generation (cross-site scripting) in GitLab8.7CNA v3.10.4%2026-05-14Fix
CVE-2026-7471Server-side request forgery (SSRF) in GitLab3.5CNA v3.10.3%2026-05-14Fix
CVE-2026-7377Improper neutralization of input during web page generation (cross-site scripting) in GitLab8.7CNA v3.10.4%2026-05-14Fix
CVE-2026-6923Nuvoton Improper Protection of Physical Side Channels3.8CNA v3.10.2%2026-05-14
CVE-2026-6883Missing authorization in GitLab2.6CNA v3.10.3%2026-05-14Fix
CVE-2026-6811PHP stack exhaustion6.0CNA v4.00.4%2026-05-14Fix
CVE-2026-6670Media Sync WordPress plugin path traversal6.5CNA v3.10.9%2026-05-14Fix
CVE-2026-6638PostgreSQL REFRESH PUBLICATION allows SQL injection via table name3.7CNA v3.10.3%2026-05-14Fix
CVE-2026-6637PostgreSQL refint allows stack buffer overflow and SQL injection8.8CNA v3.10.4%2026-05-14Fix
CVE-2026-6575PostgreSQL buffer over-read4.3CNA v3.10.3%2026-05-14Fix
CVE-2026-6514InfusedWoo Pro WordPress plugin unauthenticated arbitrary file read via URL parameter7.5CNA v3.10.5%2026-05-14Fix
CVE-2026-6512InfusedWoo Pro WordPress plugin unauthenticated missing authorization to arbitrary post deletion9.1CNA v3.10.5%2026-05-14Fix
CVE-2026-6510InfusedWoo Pro WordPress plugin unauthenticated missing authorization to privilege escalation9.8CNA v3.10.7%2026-05-14Fix
CVE-2026-6506InfusedWoo Pro WordPress plugin missing authorization privilege escalation8.8CNA v3.10.5%2026-05-14Fix
CVE-2026-6504Royal Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-14Fix
CVE-2026-6479PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion7.5CNA v3.10.6%2026-05-14Fix
CVE-2026-6478PostgreSQL discloses MD5-hashed passwords via covert timing channel6.5CNA v3.10.6%2026-05-14Fix
CVE-2026-6477PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory8.8CNA v3.10.5%2026-05-14Fix
CVE-2026-6476PostgreSQL pg_createsubscriber allows SQL injection via subscription name7.2CNA v3.10.3%2026-05-14Fix
CVE-2026-6475PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice8.8CNA v3.10.3%2026-05-14Fix
CVE-2026-6474PostgreSQL timeofday can disclose portions of server memory4.3CNA v3.10.3%2026-05-14Fix
CVE-2026-6473PostgreSQL server undersizes allocations, via integer wraparound8.8CNA v3.11.0%2026-05-14Fix
CVE-2026-6472PostgreSQL CREATE type does not check multirange schema CREATE privilege5.4CNA v3.10.2%2026-05-14Fix
CVE-2026-6417GLS Shipping for WooCommerce WordPress plugin reflected cross-site scripting via failed_orders6.1CNA v3.10.3%2026-05-14Fix
CVE-2026-6335Improper neutralization of input during web page generation (cross-site scripting) in GitLab5.4CNA v3.10.3%2026-05-14Fix
CVE-2026-6332Schneider Electric EcoStruxure Machine Expert cleartext storage of sensitive information6.8CNA v4.00.2%2026-05-14Fix
CVE-2026-6271Career Section WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.11.1%2026-05-14Fix
CVE-2026-6252Meta Field Block WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-14Fix
CVE-2026-6225Taskbuilder WordPress plugin blind SQL injection6.5CNA v3.10.4%2026-05-14Fix
CVE-2026-6206MW WP Form WordPress plugin information disclosure5.3CNA v3.10.4%2026-05-14Fix
CVE-2026-6174CC Child Pages WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-14Fix
CVE-2026-6145User Registration and Membership WordPress plugin missing authorization5.3CNA v3.10.4%2026-05-14Exploit codeFix
CVE-2026-6073Improper neutralization of input during web page generation (cross-site scripting) in GitLab8.7CNA v3.10.3%2026-05-14Fix
CVE-2026-6063Authorization bypass through user-controlled key in GitLab4.3CNA v3.10.3%2026-05-14Fix
CVE-2026-6008IDOR in Im Park's DijiDemi6.8CNA v3.10.4%2026-05-14Fix
CVE-2026-5798Unsafe Object Reference (IDOR) vulnerability in Stel Order7.1CNA v4.00.4%2026-05-14
CVE-2026-5790Stored cross-site scripting (XSS) vulnerability in Stel Order5.1CNA v4.00.4%2026-05-14
CVE-2026-5486Unlimited Elements For Elementor WordPress plugin SQL injection6.5CNA v3.10.6%2026-05-14Fix
CVE-2026-5396Fluent Forms WordPress plugin authenticated (Subscriber+) authorization bypass via form_id parameter8.2CNA v3.10.4%2026-05-14Fix
CVE-2026-5395Fluent Forms WordPress plugin authenticated (Subscriber+) authorization bypass via table parameter8.2CNA v3.10.4%2026-05-14Fix
CVE-2026-5365LatePoint WordPress plugin cross-site request forgery4.3CNA v3.10.2%2026-05-14Fix
CVE-2026-5361Envira Gallery WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-14Fix
CVE-2026-5243The Plus Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-14Fix
CVE-2026-5193Essential Addons for Elementor WordPress plugin privilege escalation6.5CNA v3.10.3%2026-05-14Fix
CVE-2026-4527Cross-site request forgery (CSRF) in GitLab6.5CNA v3.10.2%2026-05-14Fix
CVE-2026-4524Authentication bypass using an alternate path or channel in GitLab6.5CNA v3.10.5%2026-05-14Fix
CVE-2026-4031Database Backup for WordPress WordPress plugin authorization bypass7.5CNA v3.10.6%2026-05-14Fix
CVE-2026-4030Database Backup for WordPress WordPress plugin arbitrary file read8.1CNA v3.10.6%2026-05-14Fix
CVE-2026-4029Database Backup for WordPress plugin missing authorization to unauthenticated Database export7.5CNA v3.10.5%2026-05-14Fix
CVE-2026-3892Motors Car Dealer, Classifieds and Listing WordPress plugin arbitrary file deletion8.1CNA v3.10.5%2026-05-14Fix
CVE-2026-3829WP Encryption WordPress plugin unauthorized access5.4CNA v3.10.2%2026-05-14Fix
CVE-2026-3718ManageWP Worker WordPress plugin unauthenticated stored cross-site scripting via MWP-Key-Name Header7.2CNA v3.10.3%2026-05-14Fix
CVE-2026-3694Bold Page Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-14Fix
CVE-2026-3607Access Control Check Implemented after Asset is Accessed in GitLab4.3CNA v3.10.4%2026-05-14Fix
CVE-2026-3290Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values7.4CNA v4.00.3%2026-05-14Fix
CVE-2026-3160Unintended proxy or intermediary (confused deputy) in GitLab5.8CNA v3.10.4%2026-05-14Fix
CVE-2026-3074Authorization bypass through user-controlled key in GitLab4.3CNA v3.10.3%2026-05-14Fix
CVE-2026-3073Authorization bypass through user-controlled key in GitLab4.3CNA v3.10.4%2026-05-14Fix
CVE-2026-2900Missing authorization in GitLab2.7CNA v3.10.4%2026-05-14Fix
CVE-2026-2347IDOR in Akıllı Ticaret's E-Commerce Pack9.8CNA v3.10.4%2026-05-14Fix
CVE-2026-1659Allocation of resources without limits or throttling in GitLab7.5CNA v3.10.4%2026-05-14Fix
CVE-2026-1630Reflected XSS in WEBCON BPS5.1CNA v4.00.4%2026-05-14Fix
CVE-2026-1338Authorization bypass through user-controlled key in GitLab4.3CNA v3.10.2%2026-05-14Fix
CVE-2026-1322Business Logic Errors in GitLab6.8CNA v3.10.3%2026-05-14Fix
CVE-2026-1184Deserialization of untrusted data in GitLab6.5CNA v3.10.3%2026-05-14Fix
CVE-2026-45740protobuf.js JSON descriptor parsing denial of service5.3CNA v3.10.5%2026-05-13Fix
CVE-2026-45714CubeCart: Server-side template injection (SSTI) in Smarty templates leading to RCE9.1CNA v3.10.5%2026-05-13Fix
CVE-2026-45708CubeCart: Authenticated RCE via Invoice template → Order Print7.2CNA v3.10.5%2026-05-13Fix
CVE-2026-45411vm2 has a Sandbox Breakout using Async Generator9.8CNA v3.10.9%2026-05-13Fix
CVE-2026-45229Quark Drive (quark-auto-save) mass assignment via POST /update8.7CNA v4.00.6%2026-05-13Fix
CVE-2026-45228Quark Drive (quark-auto-save) stored XSS via System Configuration5.1CNA v4.00.3%2026-05-13Fix
CVE-2026-45158OPNsense: Command injection via Attacker-Controlled DHCP Config9.1CNA v3.10.8%2026-05-13Fix
CVE-2026-45109Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes7.5CNA v3.10.8%2026-05-13Fix
CVE-2026-45055CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP host header8.1CNA v3.10.2%2026-05-13Fix
CVE-2026-45054CubeCart: Authenticated SQL injection via `sort[]` parameter in Admin Orders Transactions Listing4.9CNA v3.10.4%2026-05-13Fix
CVE-2026-45053CubeCart: Authenticated arbitrary file upload to RCE in REST Files API9.1CNA v3.10.8%2026-05-13Fix
CVE-2026-45033GitHub Copilot CLI: Nested Bare Repository can Execute arbitrary commands via core.fsmonitor8.5CNA v4.00.4%2026-05-13Exploit codeFix
CVE-2026-45028Astro: Server island encrypted parameters vulnerable to cross-component replay2.9CNA v4.00.2%2026-05-13Fix
CVE-2026-44931GNOME malcontent malcontent-timerd resource exhaustion5.1CNA v4.00.2%2026-05-13
CVE-2026-44665NaturalIntelligence fast-xml-builder XML injection6.1CNA v3.10.3%2026-05-13Fix
CVE-2026-44664fast-xml-builder Comment Value regex can be bypassed6.1CNA v3.10.3%2026-05-13Fix
CVE-2026-44612Bytello Share (Windows Edition) installer executable uncontrolled search path8.4CNA v4.00.2%2026-05-13
CVE-2026-44582Next.js: Cache poisoning via collisions in React Server component cache-busting3.7CNA v3.10.2%2026-05-13Fix
CVE-2026-44581Next.js: Cross-site scripting in App Router applications using CSP nonces4.7CNA v3.10.2%2026-05-13Fix
CVE-2026-44580Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input6.1CNA v3.10.3%2026-05-13Fix
CVE-2026-44579Next.js: Denial of service via connection exhaustion in applications using Cache components7.5CNA v3.10.8%2026-05-13Fix
CVE-2026-44578Next.js: Server-side request forgery in applications using WebSocket upgrades8.6CNA v3.11.9%2026-05-13NucleiEmerging ThreatsExploit codeFix
CVE-2026-44577Next.js: Denial of service in the Image Optimization API5.9CNA v3.10.9%2026-05-13Fix
CVE-2026-44576Next.js: Cache poisoning in React Server component responses5.4CNA v3.10.3%2026-05-13Fix
CVE-2026-44575Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes7.5CNA v3.10.8%2026-05-13Fix
CVE-2026-44574Next.js: Middleware / Proxy bypass through dynamic route parameter injection8.1CNA v3.10.7%2026-05-13Fix
CVE-2026-44573Next.js: Middleware / Proxy bypass in Pages Router applications using i18n7.5CNA v3.10.8%2026-05-13Fix
CVE-2026-44572Next.js: Middleware / Proxy redirects can be cache-poisoned3.7CNA v3.10.2%2026-05-13Fix
CVE-2026-44479Vercel: Non-interactive mode includes CLI arguments in suggested command output5.5CNA v3.10.2%2026-05-13Fix
CVE-2026-44478Hoppscotch onboarding config endpoint information disclosure7.5CNA v3.10.4%2026-05-13Fix
CVE-2026-44471Gix-fs: Symlink prefix-reuse allows worktree escape during checkout7.8CNA v3.10.2%2026-05-13Fix
CVE-2026-44470Claude Desktop: Local privilege escalation via Directory Junction in CoworkVMService8.5CNA v4.00.2%2026-05-13Fix
CVE-2026-44467Claude Desktop: SSH Host Key Verification Bypass allows man-in-the-middle Attack on Remote Sessions7.4CNA v4.00.2%2026-05-13Fix
CVE-2026-44459Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify3.8CNA v3.10.3%2026-05-13Fix
CVE-2026-44458Hono: CSS Declaration injection via Style Object Values in JSX SSR4.3CNA v3.10.3%2026-05-13Fix
CVE-2026-44457Hono cache middleware vulnerability5.3CNA v3.10.3%2026-05-13Fix
CVE-2026-44456Hono: BodyLimit can be bypassed for chunked / unknown-length requests6.5CNA v3.10.3%2026-05-13Fix
CVE-2026-44455Hono: Unvalidated JSX Tag Names in Hono/jsx may allow HTML injection4.7CNA v3.10.2%2026-05-13Fix
CVE-2026-44448ERPNext: Unauthorised Document modification due to missing validation5.9CNA v3.10.3%2026-05-13Fix
CVE-2026-44447ERPNext: Possibility of SQL injection due to missing validation8.8CNA v3.10.5%2026-05-13Fix
CVE-2026-44446ERPNext: Possibility of SQL injection due to missing validation8.8CNA v3.10.5%2026-05-13Fix
CVE-2026-44445ERPNext: XML external entity (XEE) Reference vulnerability in the EDI module5.3CNA v4.00.4%2026-05-13Fix
CVE-2026-44442ERPNext: Unauthorised Document modification due to missing validation9.9CNA v3.10.4%2026-05-13Fix
CVE-2026-44441ERPNext: Possible SSRF by any authenticated user5.0CNA v3.10.3%2026-05-13Fix
CVE-2026-44440ERPNext: Path traversal leading to Sensitive File Exposure6.5CNA v3.10.6%2026-05-13Fix
CVE-2026-44439PlaywrightCapture page capture navigation server-side request forgery6.6CNA v4.00.5%2026-05-13Fix
CVE-2026-44437Angular SSR: Open redirect and Request Steering via Encoded X-Forwarded-Prefix6.9CNA v4.00.3%2026-05-13Fix
CVE-2026-44432urllib3 streaming response decompression denial of service8.9CNA v4.00.9%2026-05-13Fix
CVE-2026-44431urllib3 proxied redirect handling information disclosure8.2CNA v4.00.3%2026-05-13Exploit codeFix
CVE-2026-44426ShellHub: Cross-tenant IDOR in `GET /API/namespaces/:tenant` via API Key bypasses membership check6.5CNA v3.10.4%2026-05-13Fix
CVE-2026-44425ShellHub: Crash-DoS via field injection in filter and sort-by parameters5.4CNA v3.10.4%2026-05-13Fix
CVE-2026-44424ShellHub: Cross-tenant IDOR in `GET /API/devices/:uid` discloses device data of any namespace6.5CNA v3.10.4%2026-05-13Fix
CVE-2026-44423ShellHub: Cross-tenant IDOR in `GET /API/sessions/:uid` discloses SSH session data6.5CNA v3.10.4%2026-05-13Fix
CVE-2026-44418Incomplete fix for SQL injection in phili67/ecclesiacrm8.7CNA v4.00.4%2026-05-13
CVE-2026-44381MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings9.3CNA v4.00.8%2026-05-13NucleiFix
CVE-2026-44380MISP: Improper access control in auth key reset allows privilege escalation to site administrator8.6CNA v4.00.6%2026-05-13Fix
CVE-2026-44379MISP: Improper UUID validation in MISP Collections5.3CNA v4.00.3%2026-05-13Fix
CVE-2026-44377CubeCart: Server-side template injection (SSTI) in Smarty templates leading to RCE9.1CNA v3.11.0%2026-05-13Fix
CVE-2026-44376CubeCart: Reflected XSS in Store Search Bar6.1CNA v3.10.7%2026-05-13Exploit codeFix
CVE-2026-44373Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules`5.3CNA v3.10.6%2026-05-13Fix
CVE-2026-44372Nitro: Open redirect via Protocol-Relative URL Bypass in Wildcard Route Rules5.3CNA v4.00.4%2026-05-13Fix
CVE-2026-44369CVAT: Stored XSS via annotation guides8.5CNA v4.00.4%2026-05-13Fix
CVE-2026-44368PyQuorum: Timing side‑channel in mul_mod6.9CNA v4.00.5%2026-05-13Fix
CVE-2026-44364misp-modules website missing CSRF protection in the website home blueprint9.3CNA v4.00.2%2026-05-13
CVE-2026-44363Unsafe remote resource fetching in expansion misp-modules5.8CNA v4.00.1%2026-05-13Fix
CVE-2026-44351fast-jwt async key resolver authentication bypass9.1CNA v3.10.3%2026-05-13Fix
CVE-2026-44295protobufjs-cli pbjs static code generation code injection8.7CNA v3.10.4%2026-05-13Fix
CVE-2026-44294protobuf.js generated code compilation denial of service5.3CNA v3.10.4%2026-05-13Fix
CVE-2026-44293protobuf.js generated toObject code code injection7.7CNA v4.00.7%2026-05-13Fix
CVE-2026-44292protobuf.js generated message constructors prototype pollution5.3CNA v3.10.3%2026-05-13Fix
CVE-2026-44291protobuf.js type lookup tables code injection8.1CNA v3.10.4%2026-05-13Fix
CVE-2026-44290protobuf.js schema option handling prototype pollution7.5CNA v3.10.5%2026-05-13Fix
CVE-2026-44289protobuf.js protobuf decoder uncontrolled recursion7.5CNA v3.10.7%2026-05-13Fix
CVE-2026-44288protobufjs has overlong UTF-8 decoding5.3CNA v3.10.3%2026-05-13Fix
CVE-2026-44248Netty: Resource exhaustion in MqttDecoder5.3CNA v3.10.7%2026-05-13Fix
CVE-2026-44195OPNsense: Authentication lockout bypass5.3CNA v3.10.4%2026-05-13Fix
CVE-2026-44194OPNsense: RCE on user managment9.1CNA v3.10.8%2026-05-13Fix
CVE-2026-44193OPNsense: RCE via XMLRPC endpoint using `OPNsense.restore_config_section` method9.1CNA v3.10.9%2026-05-13Fix
CVE-2026-44009vm2 has Sandbox Breakout through Null Proto Exception9.8CNA v3.10.7%2026-05-13Fix
CVE-2026-44008vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`9.8CNA v3.10.9%2026-05-13Fix
CVE-2026-44007vm2 nested sandbox require restriction improper access control9.1CNA v3.10.6%2026-05-13Fix
CVE-2026-44006vm2 has a sandbox escape10.0CNA v3.10.8%2026-05-13Fix
CVE-2026-44005vm2 sandbox prototype bridge prototype pollution10.0CNA v3.10.8%2026-05-13Fix
CVE-2026-44004vm2 Sandbox Access to Host Buffer.alloc allows timeout Bypass resulting in memory exhaustion7.5CNA v3.10.7%2026-05-13Fix
CVE-2026-44003Vm2's Transformer Fast-Path Bypass exposes Internal State variable5.3CNA v3.10.4%2026-05-13Fix
CVE-2026-44002vm2 is vulnerable to host file path disclosure via Stack Trace information leak5.8CNA v3.10.3%2026-05-13Fix
CVE-2026-44001vm2 has a sandbox escape via Promise Constructor Unhandled Rejection (Process crash DoS)8.6CNA v3.10.7%2026-05-13Fix
CVE-2026-44000vm2 Host Promise Resolution Preserves Object Identity across Sandbox Boundary6.5CNA v3.10.3%2026-05-13Fix
CVE-2026-43999vm2 sandbox builtin allowlist incorrect authorization9.9CNA v3.11.0%2026-05-13Fix
CVE-2026-43998vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape8.5CNA v3.10.9%2026-05-13Fix
CVE-2026-43997vm2 Access to host object enables sandbox escape10.0CNA v3.10.8%2026-05-13Fix
CVE-2026-43970ninenines cowlib decompression bomb in cow_spdy:inflate/2 allows memory exhaustion8.2CNA v4.00.6%2026-05-13Fix
CVE-2026-43489Linux kernel live update file tracking vulnerability5.5v3.10.1%2026-05-13Fix
CVE-2026-43488Linux kernel xHCI USB host controller driver vulnerability5.5v3.10.1%2026-05-13Fix
CVE-2026-43487In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Disable LPM on ST1000DM010-2EP102 According to a user report, the ST1000DM010-2EP102 has problems with LPM, causing random system freezes. The drive belongs to the same BarraCuda family as the ST2000DM008-2FR1025.5v3.10.1%2026-05-13Fix
CVE-2026-43486Linux kernel arm64 contiguous PTE handling infinite loop5.5v3.10.1%2026-05-13Fix
CVE-2026-43485Linux kernel nouveau GSP ACPI probing vulnerability5.5NVD v3.10.2%2026-05-13Fix
CVE-2026-43484In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid bitfield RMW for claim/retune flags Move claimed and retune control flags out of the bitfield word to avoid unrelated RMW side effects in asynchronous contexts. The host->claimed bit shared a word with retune fla5.5v3.10.1%2026-05-13Fix
CVE-2026-43483Linux kernel KVM AVIC interrupt controller vulnerability5.5v3.10.1%2026-05-13Fix
CVE-2026-43482Linux kernel sched_ext scheduler vulnerability5.5v3.10.1%2026-05-13Fix
CVE-2026-43481In the Linux kernel, the following vulnerability has been resolved: net-shapers: don't free reply skb after genlmsg_reply() genlmsg_reply() hands the reply skb to netlink, and netlink_unicast() consumes it on all return paths, whether the skb is queued successfully or freed on an error path. net_7.8CNA v3.10.2%2026-05-13Fix
CVE-2026-43480Linux kernel AMD ACP3x audio driver null pointer dereference5.5v3.10.1%2026-05-13Fix
CVE-2026-43479Linux kernel lan78xx USB Ethernet driver vulnerability5.5v3.10.1%2026-05-13Fix
CVE-2026-43478Linux kernel rt1011 audio codec driver null pointer dereference5.5v3.10.1%2026-05-13Fix
CVE-2026-43477In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL Apparently ICL may hang with an MCE if we write TRANS_VRR_VMAX/FLIPLINE before enabling TRANS_DDI_FUNC_CTL. Personally I was only able to reproduce a hang (on5.5v3.10.1%2026-05-13Fix
CVE-2026-43476In the Linux kernel, the following vulnerability has been resolved: iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() sizeof(num) evaluates to sizeof(size_t) (8 bytes on 64-bit) instead of the intended __be32 element size (4 bytes). Use sizeof(*meas) to correctly match the buffer7.8CNA v3.10.2%2026-05-13Fix
CVE-2026-42961ELECOM WAB-BE187-M cross-site request forgery5.1CNA v4.00.3%2026-05-13
CVE-2026-42950ELECOM WAB-BE187-M improper check for exceptional conditions5.1CNA v4.00.3%2026-05-13
CVE-2026-42948ELECOM WAB-BE187-M stored cross-site scripting4.8CNA v4.00.3%2026-05-13
CVE-2026-42946F5 NGINX SCGI and uWSGI modules vulnerability8.3CNA v4.00.9%2026-05-13Fix
CVE-2026-42945F5 NGINX ngx_http_rewrite_module heap buffer overflow9.2CNA v4.03.4%2026-05-13Reported exploitedExploit codeFix
CVE-2026-42937F5 BIG-IP iControl REST and tmsh vulnerability7.1CNA v4.00.3%2026-05-13Fix
CVE-2026-42934F5 NGINX charset module out-of-bounds read6.3CNA v4.00.7%2026-05-13Fix
CVE-2026-42930F5 BIG-IP appliance mode iControl REST vulnerability8.5CNA v4.00.6%2026-05-13Fix
CVE-2026-42926F5 NGINX HTTP/2 proxy module vulnerability6.3CNA v4.00.3%2026-05-13Exploit codeFix
CVE-2026-42924F5 BIG-IP iControl SOAP privilege escalation8.5CNA v4.00.4%2026-05-13Fix
CVE-2026-42920F5 BIG-IP DTLS denial of service8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-42919F5 BIG-IP appliance mode privilege escalation7.1CNA v4.00.4%2026-05-13Fix
CVE-2026-42781BIG-IP FastL4 virtual server vulnerability7.1CNA v4.00.3%2026-05-13Fix
CVE-2026-42780F5 Big-ip SSL Orchestrator path traversal6.9CNA v4.01.2%2026-05-13Fix
CVE-2026-42602OpenTelemetry Collector Contrib Azure authenticator extension authentication bypass8.1CNA v3.10.3%2026-05-13Fix
CVE-2026-42587Netty HttpContentDecompressor denial of service7.5CNA v3.11.0%2026-05-13Fix
CVE-2026-42586Netty: CRLF injection in Netty Redis Codec Encoder6.8CNA v3.10.2%2026-05-13Fix
CVE-2026-42585Netty: HTTP request smuggling due to malformed Transfer-Encoding6.5CNA v3.10.3%2026-05-13Fix
CVE-2026-42584Netty: HttpClientCodec response desynchronization7.3CNA v3.10.7%2026-05-13Fix
CVE-2026-42583Netty: Lz4FrameDecoder resource exhaustion7.5CNA v3.10.5%2026-05-13Fix
CVE-2026-42582Netty: HTTP/3 QPACK literal unbounded allocation7.5CNA v3.10.5%2026-05-13Fix
CVE-2026-42581Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization5.8CNA v3.10.7%2026-05-13Fix
CVE-2026-42580Netty: HTTP request smuggling due to incorrect chunk size parsing6.5CNA v3.10.4%2026-05-13Fix
CVE-2026-42579Netty: DNS Codec input validation bypass in Netty (Encoder + Decoder)7.5CNA v3.10.8%2026-05-13Fix
CVE-2026-42578Netty: HTTP header injection via HttpProxyHandler Disabled Validation2.9CNA v4.01.2%2026-05-13Fix
CVE-2026-42577Netty: Epoll transport denial of service via RST on half-closed TCP connection7.5CNA v3.10.6%2026-05-13Fix
CVE-2026-42561Python-Multipart: Denial of service via unbounded multipart part headers7.5CNA v3.10.8%2026-05-13Fix
CVE-2026-42557JupyterLab command linker cross-site scripting8.6CNA v4.00.7%2026-05-13Fix
CVE-2026-42552Flight: Sensitive information disclosure via default error handler in flightphp/core7.5CNA v3.10.4%2026-05-13Fix
CVE-2026-42551flightphp core interpretation conflict7.5CNA v3.10.4%2026-05-13Fix
CVE-2026-42550flightphp core flight: SQL injection8.8CNA v3.10.5%2026-05-13Fix
CVE-2026-42549flightphp core path traversal4.4CNA v3.10.2%2026-05-13Fix
CVE-2026-42548flightphp core flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp8.6CNA v4.00.5%2026-05-13Fix
CVE-2026-42463SQLBot: Unauthorized access8.6CNA v4.00.4%2026-05-13Fix
CVE-2026-42409F5 BIG-IP HTTP/2 profile iRule handling null pointer dereference8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-42408F5 BIG-IP DNS tmsh command information disclosure6.7CNA v4.00.1%2026-05-13Fix
CVE-2026-42406BIG-IP and BIG-IQ privilege escalation8.5CNA v4.00.3%2026-05-13Fix
CVE-2026-42304Twisted: Denial of service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains7.5CNA v3.11.0%2026-05-13Fix
CVE-2026-42290protobuf.js is vulnerable to OS command injection in the CLI7.8CNA v3.10.2%2026-05-13Fix
CVE-2026-42266JupyterLab Extension Manager vulnerability8.8CNA v3.10.9%2026-05-13Fix
CVE-2026-42063F5 BIG-IP iControl SOAP vulnerability6.9CNA v4.00.4%2026-05-13Fix
CVE-2026-42062ELECOM WRC-BE72XSD-B OS command injection9.3CNA v4.02.3%2026-05-13
CVE-2026-42058F5 BIG-IP iControl REST information disclosure5.3CNA v4.00.3%2026-05-13Fix
CVE-2026-42032CKAN: Unauthenticated authorization bypass in `datastore_search_sql`6.7CNA v4.00.4%2026-05-13Fix
CVE-2026-42031CKAN: Unauthenticated SQL injection and authorization bypass in `datastore_search_sql`8.3CNA v4.02.2%2026-05-13NucleiFix
CVE-2026-41959F5 BIG-IP iControl and tmsh REST vulnerability7.1CNA v4.00.3%2026-05-13Fix
CVE-2026-41957F5 BIG-IP and BIG-IQ Configuration utility deserialization of untrusted data8.7CNA v4.00.9%2026-05-13Fix
CVE-2026-41956F5 BIG-IP Traffic Management Microkernel stack-based buffer overflow8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-41954F5 BIG-IP iControl REST and tmsh vulnerability6.9CNA v4.00.4%2026-05-13Fix
CVE-2026-41953BIG-IP privilege escalation8.5CNA v4.00.4%2026-05-13Fix
CVE-2026-41255CKAN: CSRF exemption primed by anonymous requests6.1CNA v3.10.1%2026-05-13Fix
CVE-2026-41227BIG-IP HTTP/2 Layer 7 DoS Protection8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-41225F5 BIG-IP iControl REST incorrect use of privileged apis8.6CNA v4.00.5%2026-05-13Fix
CVE-2026-41219F5 BIG-IP An improper neutralization7.1CNA v4.00.4%2026-05-13Fix
CVE-2026-41218F5 BIG-IP PEM iRules use-after-free8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-41217F5 BIG-IP tmsh incorrect permission assignment8.3CNA v4.00.2%2026-05-13Fix
CVE-2026-41132CKAN: No certificate validation on STMP connection6.6CNA v4.00.2%2026-05-13Fix
CVE-2026-41051SUSE openSUSE Tumbleweed csync2 uses insecure temporary directories when compiled with C99 or later5.1CNA v4.00.1%2026-05-13Fix
CVE-2026-41050SUSE Rancher Fleet Helm deployer incorrect authorization9.9CNA v3.10.4%2026-05-13Fix
CVE-2026-40703BIG-IP Configuration utility CSRF5.3CNA v4.00.1%2026-05-13Fix
CVE-2026-40701F5 NGINX ngx_http_ssl_module use-after-free6.3CNA v4.00.7%2026-05-13Exploit codeFix
CVE-2026-40699F5 BIG-IP Configuration utility XPath injection7.1CNA v4.00.4%2026-05-13Fix
CVE-2026-40698F5 BIG-IP iControl REST and TMSH vulnerability8.5CNA v4.00.4%2026-05-13Fix
CVE-2026-40631F5 BIG-IP iControl SOAP privilege escalation8.5CNA v4.00.4%2026-05-13Fix
CVE-2026-40629F5 BIG-IP SSL profile connection handling resource exhaustion8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-40621ELECOM WRC-BE72XSD-B authentication bypass9.3CNA v4.00.7%2026-05-13
CVE-2026-40618F5 BIG-IP SSL profile processing incorrect buffer size calculation8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-40462F5 BIG-IP iControl REST and tmsh vulnerability7.1CNA v4.00.3%2026-05-13Fix
CVE-2026-40460F5 NGINX HTTP/3 QUIC module IP spoofing6.9CNA v4.00.4%2026-05-13Fix
CVE-2026-40435BIG-IP httpd access control vulnerability6.9CNA v4.00.3%2026-05-13Fix
CVE-2026-40423F5 BIG-IP SIP profile denial of service8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-40067F5 BIG-IP Access Policy Manager apmd process denial of service8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-40061F5 BIG-IP iControl REST and tmsh vulnerability8.5CNA v4.00.4%2026-05-13Fix
CVE-2026-40060F5 BIG-IP Advanced WAF and ASM bd process denial of service8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-39806HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit8.7CNA v4.00.9%2026-05-13Fix
CVE-2026-39803HTTP/1 chunked body reader ignores length cap in bandit8.7CNA v4.01.0%2026-05-13Fix
CVE-2026-39459F5 BIG-IP iControl REST and tmsh vulnerability8.6CNA v4.00.5%2026-05-13Fix
CVE-2026-39458F5 BIG-IP DNS cache denial of service8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-39455F5 BIG-IP Configuration utility LDAP authentication vulnerability8.7CNA v4.00.5%2026-05-13Fix
CVE-2026-39428CubeCart: Stored cross-site scripting (XSS)4.8CNA v3.10.2%2026-05-13Fix
CVE-2026-39358CubeCart: Time-based blind SQL injection7.2CNA v3.10.4%2026-05-13Fix
CVE-2026-37430ShopOrderImportController.java component of qihang-wms commit arbitrary file upload7.3CISA ADP v3.10.4%2026-05-13
CVE-2026-37429qihang-wms SysUserMapper.xml SQL injection6.5CISA ADP v3.10.3%2026-05-13
CVE-2026-37428qihang-wms SysDeptMapper.xml SQL injection6.5CISA ADP v3.10.3%2026-05-13
CVE-2026-36742Hiseeu C90 UART bootloader incorrect default permissions6.8CISA ADP v3.10.2%2026-05-13
CVE-2026-36741U-speed T18-21k command injection7.2CISA ADP v3.12.6%2026-05-13
CVE-2026-36738U-speed T18-21k improper access control6.8CISA ADP v3.10.3%2026-05-13
CVE-2026-35506ELECOM WRC-BE72XSD-B OS command injection8.6CNA v4.01.7%2026-05-13
CVE-2026-35062F5 BIG-IP iControl SOAP information disclosure7.1CNA v4.00.3%2026-05-13Fix
CVE-2026-34176F5 BIG-IP Knowledge Appliance mode iControl REST vulnerability8.5CNA v4.00.9%2026-05-13Fix
CVE-2026-34019F5 BIG-IP BFD vulnerability6.3CNA v4.00.4%2026-05-13Fix
CVE-2026-33585Arqit SKA-Platform improper handling of parameters3.8CNA v3.10.1%2026-05-13Fix
CVE-2026-33584Arqit SKA-Platform enables Access to Debug Information5.3CNA v3.10.3%2026-05-13Fix
CVE-2026-33583Arqit SKA-Platform vulnerable to key exposure8.7CNA v3.10.3%2026-05-13Fix
CVE-2026-33381Grafana OSS users can generate Service Account tokens after permissions removal5.9CNA v3.10.3%2026-05-13Fix
CVE-2026-33380Grafana OSS SQL Expressions Read file from Disk6.3CNA v3.10.3%2026-05-13Fix
CVE-2026-33378Grafana Data Source Plugin: DoS (OOM) via Negative Interval injection in $__timeGroup Macro6.5CNA v3.10.4%2026-05-13Fix
CVE-2026-33377Grafana OSS Dashboard Import Overwrites ACL Editor privilege escalation to Dashboard Admin7.1CNA v3.10.2%2026-05-13Fix
CVE-2026-33376Grafana OSS auth Proxy IPv6 whitelist bypass7.4CNA v3.10.3%2026-05-13Fix
CVE-2026-32993WebPros cPanel CRLF injection8.3CNA v3.10.4%2026-05-13Fix
CVE-2026-32992WebPros cPanel improper certificate validation8.2CNA v3.10.3%2026-05-13Fix
CVE-2026-32991WebPros cPanel incorrect authorization7.1CNA v3.10.3%2026-05-13Fix
CVE-2026-32673F5 BIG-IP scripted monitors vulnerability8.5CNA v4.00.4%2026-05-13Fix
CVE-2026-32661Canon Marketing Japan GUARDIANWALL Mail Security Cloud stack-based buffer overflow9.3CNA v4.00.7%2026-05-13Reported exploited
CVE-2026-32643BIG-IP and BIG-IQ privilege escalation8.5CNA v4.00.3%2026-05-13Fix
CVE-2026-31156openplcproject OpenPLC_v3 path injection6.5CISA ADP v3.10.5%2026-05-13Exploit code
CVE-2026-30906Zoom Communications Zoom Rooms installer untrusted search path7.8CNA v3.10.2%2026-05-13Fix
CVE-2026-30905Zoom Communications Zoom Workplace VDI Plugin external control of a file path7.8CNA v3.10.2%2026-05-13Fix
CVE-2026-30904Zoom Communications Zoom Workplace protection mechanism failure1.8CNA v3.10.2%2026-05-13Fix
CVE-2026-29206WebPros cPanel SQL injection8.1CNA v3.10.4%2026-05-13Fix
CVE-2026-29205WebPros cPanel execution with unnecessary privileges8.6CNA v3.10.4%2026-05-13Fix
CVE-2026-28758F5 BIG-IP iControl REST API cleartext storage of sensitive information6.7CNA v4.00.1%2026-05-13Fix
CVE-2026-28383Grafana plugin resources can lead to unbounded memory allocation6.5CNA v3.10.4%2026-05-13Fix
CVE-2026-28380Grafana OSS BAC in Snapshot API allows deletion of unauthorized dashboard snapshots6.5CNA v3.10.3%2026-05-13Fix
CVE-2026-28379Viewer-triggered race condition in Grafana Live leads to complete server crash6.5CNA v3.10.3%2026-05-13Fix
CVE-2026-28376Grafana Live push endpoint allows unbounded memory allocation leading to OOM6.5CNA v3.10.4%2026-05-13Fix
CVE-2026-28374Grafana OSS IDOR in Annotations API allows unprivileged users to delete annotation4.3CNA v3.10.3%2026-05-13Fix
CVE-2026-25710KDE plasma-login-manager execution with unnecessary privileges7.0CNA v4.00.2%2026-05-13
CVE-2026-25705Rancher extensions have arbitrary file access via path traversal8.4CNA v3.10.5%2026-05-13Fix
CVE-2026-25107ELECOM WRC-X1800GS-B hard-coded cryptographic key6.9CNA v4.00.1%2026-05-13
CVE-2026-24464F5 BIG-IP appliance mode iControl REST vulnerability6.9CNA v4.00.9%2026-05-13Fix
CVE-2026-22677nesquena hermes-webui hermes WebUI path traversal via Session Import endpoint6.0CNA v4.00.4%2026-05-13Fix
CVE-2026-21821HCL BigFix SCM Reporting jQuery library vulnerability8.3CNA v3.10.2%2026-05-13
CVE-2026-21024Samsung Mobile Samsung System Support Service improper privilege management6.3CNA v4.00.1%2026-05-13
CVE-2026-21022Samsung Mobile Devices Routines improper handling of insufficient permissions6.9CNA v4.00.1%2026-05-13Fix
CVE-2026-21021Samsung Mobile Devices Routines improper input validation5.1CNA v4.00.2%2026-05-13Fix
CVE-2026-21020Samsung Mobile Devices OmaCP improper export of Android application components5.1CNA v4.00.1%2026-05-13Fix
CVE-2026-21019Samsung Mobile Devices FacAtFunction in Galaxy Watch improper input validation8.9CNA v4.00.2%2026-05-13
CVE-2026-21018Samsung Mobile Devices SveService out-of-bounds write6.8CNA v4.00.2%2026-05-13Exploit codeFix
CVE-2026-21016Samsung Mobile Devices LocationManager incorrect privilege assignment5.1CNA v4.00.1%2026-05-13Fix
CVE-2026-21015Samsung Mobile Devices FactoryCamera incorrect default permissions6.8CNA v4.00.1%2026-05-13Fix
CVE-2026-20916F5 BIG-IQ iControl REST path traversal7.2CNA v4.00.4%2026-05-13Fix
CVE-2026-8500Web::Passwd versions for Perl is vulnerable to RCE9.8CISA ADP v3.12.5%2026-05-13
CVE-2026-8496A cross-site scripting (XSS) vulnerability in Alinto SOGo6.1CISA ADP v3.10.5%2026-05-13Fix
CVE-2026-8466Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy8.2CNA v4.00.5%2026-05-13Fix
CVE-2026-8463Crypt::Argon2 argon2_verify out-of-bounds read5.3NVD v3.10.5%2026-05-13Fix
CVE-2026-8369Improper input validation in OpenThread NAT64 Translator6.0CNA v4.00.3%2026-05-13
CVE-2026-8367aria2c improper certificate validation5.3NVD v3.10.2%2026-05-13Fix
CVE-2026-8336MongoDB Server post-authentication use-after-free error in $_internalJsEmit and mapreduce commands7.7CNA v4.00.5%2026-05-13Fix
CVE-2026-8328Python CPython ftplib server-side request forgery5.9CNA v4.00.7%2026-05-13Fix
CVE-2026-8202MongoDB Server post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators5.3CNA v4.00.5%2026-05-13Fix
CVE-2026-8201MongoDB Server A use-after-free6.1CNA v4.00.2%2026-05-13Fix
CVE-2026-8200MongoDB Server schema validation log messages may not redact user data4.8CNA v4.00.3%2026-05-13Fix
CVE-2026-8199MongoDB Server post-auth memory exhaustion via bitwise match expressions7.1CNA v4.00.5%2026-05-13Fix
CVE-2026-8053MongoDB Server FlatBSON Duplicate Field Index Drift8.7CNA v4.00.7%2026-05-13Exploit codeFix
CVE-2026-7635coreActivity: Activity Logging for WordPress plugin unauthenticated PHP object injection8.1CNA v3.10.8%2026-05-13Fix
CVE-2026-7619Charitable WordPress plugin authenticated (Custom+) SQL injection via s Search parameter6.5CNA v3.10.5%2026-05-13Fix
CVE-2026-7168curl cross-proxy Digest auth state leak5.3v3.10.5%2026-05-13Fix
CVE-2026-7051Blog2Social: Social Media Auto Post and Scheduler WordPress plugin missing authorization5.4CNA v3.10.5%2026-05-13Fix
CVE-2026-7009curl OCSP stapling bypass with Apple SecTrust5.3v3.10.3%2026-05-13Fix
CVE-2026-6965Tutor LMS WordPress plugin insecure direct object reference to authenticated arbitrary post deletion5.3CNA v3.10.5%2026-05-13Fix
CVE-2026-6962wpcodefactory Cost of Goods plugin for WooCommerce shortcode attributes stored cross-site scripting6.4CNA v3.10.3%2026-05-13Fix
CVE-2026-6929JoomSport WordPress plugin unauthenticated SQL injection via sortf parameter7.5CNA v3.10.5%2026-05-13Fix
CVE-2026-6888Advantech SaaS Composer SQL injection7.2CNA v3.10.7%2026-05-13Fix
CVE-2026-6828Fluent Forms WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-13Fix
CVE-2026-6429curl netrc credential leak with reused proxy connection5.3CISA ADP v3.10.5%2026-05-13Fix
CVE-2026-6282Lenovo Personal Cloud T2s path traversal8.6CNA v4.00.6%2026-05-13Fix
CVE-2026-6281Lenovo Personal Cloud T2s OS command injection8.7CNA v4.00.8%2026-05-13Fix
CVE-2026-6276curl stale custom cookie host causes cookie leak7.5v3.10.3%2026-05-13Fix
CVE-2026-6253curl proxy credentials leak over redirect-to proxy5.9CISA ADP v3.10.8%2026-05-13Fix
CVE-2026-6177Custom Twitter Feeds WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-05-13Fix
CVE-2026-5773curl wrong reuse of SMB connection7.5v3.10.6%2026-05-13Fix
CVE-2026-5545curl wrong reuse of HTTP Negotiate connection6.5v3.10.4%2026-05-13Fix
CVE-2026-4873curl connection reuse ignores TLS requirement5.9CISA ADP v3.10.4%2026-05-13Fix
CVE-2026-4798Avada Builder WordPress plugin unauthenticated SQL injection via product_order parameter7.5CNA v3.10.5%2026-05-13Fix
CVE-2026-4782Avada Builder WordPress plugin arbitrary file read6.5CNA v3.10.5%2026-05-13Fix
CVE-2026-4609ProfileGrid WordPress plugin missing authorization authenticated arbitrary Group Joining7.1CNA v3.10.4%2026-05-13Fix
CVE-2026-4608ProfileGrid WordPress plugin authenticated (Subscriber+) SQL injection via rid parameter6.5CNA v3.10.5%2026-05-13Fix
CVE-2026-4607ProfileGrid WordPress plugin missing authorization authenticated Group settings modification4.3CNA v3.10.4%2026-05-13Fix
CVE-2026-3426RTMKit Addons for Elementor WordPress plugin missing authorization widget Configuration modification4.3CNA v3.10.4%2026-05-13Fix
CVE-2026-3425RTMKit Addons for Elementor WordPress plugin authenticated (Author+) local file inclusion via path8.8CNA v3.10.8%2026-05-13Fix
CVE-2026-3004Snow Monkey Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-13Fix
CVE-2026-2725Improper authorization in Gerrit allowing Code Review Bypass via Submitted Together6.0CNA v4.00.2%2026-05-13
CVE-2026-2695Lack of Server-side validation in Instruction Input in TeamViewer DEX Platform (On-Premises)6.3CNA v3.10.3%2026-05-13Fix
CVE-2026-2515Hostinger Reach WordPress plugin missing authorization authenticated Integration API Key update5.3CNA v3.10.4%2026-05-13Fix
CVE-2026-0265PAN-OS: Authentication bypass with Cloud Authentication Service (CAS) enabled7.2CNA v4.01.1%2026-05-13MetasploitFix
CVE-2026-0264Palo Alto Networks Cloud NGFW DNS proxy and DNS Server features buffer overflow7.2CNA v4.00.5%2026-05-13Fix
CVE-2026-0263PAN-OS: Remote code execution (RCE) in IKEv2 Processing7.2CNA v4.00.4%2026-05-13Fix
CVE-2026-0262PAN-OS: Denial of service vulnerabilities in Network Traffic Parsing6.6CNA v4.00.4%2026-05-13Fix
CVE-2026-0261PAN-OS: Authenticated admin command injection6.1CNA v4.01.4%2026-05-13Fix
CVE-2026-0259WildFire WF-500 and Wf-500-b: Arbitrary file read and Delete vulnerability in WildFire Appliance5.0CNA v4.00.3%2026-05-13Fix
CVE-2026-0258PAN-OS: Server-side request forgery (SSRF) in IKEv2 Certificate URL Fetching4.8CNA v4.00.3%2026-05-13Fix
CVE-2026-0257Palo Alto Networks PAN-OS authentication bypass7.8CNA v4.096.9%2026-05-13KEVNucleiExploit codeFix
CVE-2026-0256PAN-OS: Stored cross-site scripting (XSS) vulnerability in the Web interface4.4CNA v4.00.2%2026-05-13Fix
CVE-2026-0251GlobalProtect App: Local privilege escalation5.9CNA v4.00.2%2026-05-13Fix
CVE-2026-0250GlobalProtect App: Buffer overflow vulnerability during connection to portal or Gateway5.2CNA v4.00.4%2026-05-13Fix
CVE-2026-0249GlobalProtect App: Certificate validation bypass4.9CNA v4.00.1%2026-05-13Fix
CVE-2026-0248Prisma Access Agent: Improper certificate validation6.2CNA v4.00.2%2026-05-13Fix
CVE-2026-0247Prisma Access Agent Endpoint DLP: Authorization bypass5.9CNA v4.00.2%2026-05-13Fix
CVE-2026-0246Prisma Access Agent: Local privilege escalation5.9CNA v4.00.1%2026-05-13Fix
CVE-2026-0245Prisma Access Agent: Information disclosure4.3CNA v4.00.1%2026-05-13Fix
CVE-2026-0244Prisma SD-WAN: Improper certificate validation5.2CNA v4.00.2%2026-05-13Fix
CVE-2026-0243Prisma SD-WAN: Denial of service (DoS) vulnerability through IPv6 Crafted Packet4.9CNA v4.00.2%2026-05-13Fix
CVE-2026-0242Trust Protection Foundation: SQL injection6.1CNA v4.00.2%2026-05-13Fix
CVE-2026-0241Trust Protection Foundation: Multiple authorization bypass5.1CNA v4.00.3%2026-05-13Fix
CVE-2026-0240Trust Protection Foundation: Sensitive information disclosure4.5CNA v4.00.2%2026-05-13Fix
CVE-2026-0239Chronosphere Chronocollector information disclosure4.9CNA v4.00.2%2026-05-13Fix
CVE-2026-0238Broker VM: Improper input validation in Broker VM Certificate and Key fields1.1CNA v4.00.1%2026-05-13Fix
CVE-2026-0237Prisma Browser: Improperly Restricted Automation Bridge allows Security Bypass7.3CNA v4.00.2%2026-05-13Fix
CVE-2026-0236Prisma Browser: Code injection enables Security Controls Bypass7.3CNA v4.00.2%2026-05-13Fix
CVE-2026-0235Prisma Browser: Access and Data Rule Bypass5.8CNA v4.00.1%2026-05-13Fix
CVE-2026-45430Backdrop CMS contributed projects backdrop-contrib/salesforce cross-site request forgery7.1CNA v3.10.1%2026-05-12Fix
CVE-2026-45393Local privilege escalation to SYSTEM in Cribl Edge for Windows8.5CNA v4.00.4%2026-05-12Fix
CVE-2026-45392DOM-based XSS in Cribl Stream7.1CNA v4.00.5%2026-05-12Fix
CVE-2026-45391Local privilege escalation in Cribl Edge for Linux8.5CNA v4.01.7%2026-05-12Fix
CVE-2026-45362Sangoma Switchvox cleartext storage of sensitive information3.2CNA v3.10.1%2026-05-12Fix
CVE-2026-45321Malware in 42 @TanStack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys9.6CNA v3.11.1%2026-05-12KEVExploit codeFix
CVE-2026-45227Heym sandbox escape via Python Introspection8.7CNA v4.00.4%2026-05-12Fix
CVE-2026-45226Heym authorization bypass in Workflow Execution7.6CNA v4.00.5%2026-05-12Fix
CVE-2026-45225Heym path traversal file upload via upload_file7.2CNA v4.00.5%2026-05-12Fix
CVE-2026-45218WP Travel WordPress plugin SQL injection7.7CNA v3.10.4%2026-05-12Fix
CVE-2026-45215WP EasyPay WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-05-12Fix
CVE-2026-45214Xpro Elementor Addons WordPress plugin SQL injection8.5CNA v3.10.4%2026-05-12Fix
CVE-2026-45213BEAR WordPress plugin SQL injection7.6CNA v3.10.4%2026-05-12Fix
CVE-2026-45212Asset CleanUp: Page Speed Booster WordPress plugin broken access control5.3CNA v3.10.4%2026-05-12Fix
CVE-2026-45211APIExperts Square for WooCommerce WordPress plugin SQL injection8.5CNA v3.10.4%2026-05-12Fix
CVE-2026-45210Broadstreet Ads WordPress plugin broken access control5.4CNA v3.10.3%2026-05-12Fix
CVE-2026-45185Exim BDAT body parsing use-after-free9.8CNA v3.10.9%2026-05-12Exploit codeFix
CVE-2026-45091sealed-env unseal token information disclosure9.1CNA v3.10.4%2026-05-12Exploit codeFix
CVE-2026-44874HPE Aruba Networking Wireless Operating System authenticated arbitrary file download4.9CNA v3.10.5%2026-05-12Fix
CVE-2026-44873Insufficient Session Invalidation on User Account Deactivation in AOS-8 Operating System5.4CNA v3.10.2%2026-05-12Fix
CVE-2026-44872HPE Aruba Networking Wireless Operating System authenticated arbitrary file upload7.2CNA v3.11.2%2026-05-12Fix
CVE-2026-44871HPE Aruba Networking Wireless Operating System (AOS) command line interface command injection7.2CNA v3.11.4%2026-05-12Fix
CVE-2026-44870HPE Aruba Networking Wireless Operating System (AOS) command line interface command injection7.2CNA v3.11.4%2026-05-12Fix
CVE-2026-44869HPE Aruba Networking Wireless Operating System (AOS) command injection7.2CNA v3.11.4%2026-05-12Fix
CVE-2026-44868HPE Aruba Networking Wireless Operating System (AOS) command injection7.2CNA v3.11.4%2026-05-12Fix
CVE-2026-44867HPE Aruba Networking Wireless Operating System (AOS) command injection7.2CNA v3.11.4%2026-05-12Fix
CVE-2026-44866HPE Aruba Networking Wireless Operating System (AOS) command injection7.2CNA v3.11.4%2026-05-12Fix
CVE-2026-44865HPE Aruba Networking Wireless Operating System (AOS) command injection7.2CNA v3.11.5%2026-05-12Fix
CVE-2026-44864Authenticated remote code execution via SQL injection in AOS-8 and AOS-10 Operating Systems7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44863Authenticated remote code execution via SQL injection in AOS-8 and AOS-10 Operating Systems7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44862Authenticated remote code execution via SQL injection in AOS-8 and AOS-10 Operating Systems7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44861Authenticated remote code execution via SQL injection in AOS-8 and AOS-10 Operating Systems7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44860Authenticated remote code execution via SQL injection in AOS-8 and AOS-10 Operating Systems7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44859HPE Aruba Networking Wireless Operating System (AOS) stack-based buffer overflow7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44858HPE Aruba Networking Wireless Operating System (AOS) stack-based buffer overflow7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44857HPE Aruba Networking Wireless Operating System (AOS) stack-based buffer overflow7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44856HPE Aruba Networking Wireless Operating System (AOS) stack-based buffer overflow7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44855HPE Aruba Networking Wireless Operating System (AOS) stack-based buffer overflow7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44854HPE Aruba Networking Wireless Operating System authenticated remote code execution7.2CNA v3.11.6%2026-05-12Fix
CVE-2026-44853HPE Aruba Networking Wireless Operating System authenticated remote code execution7.2CNA v3.11.6%2026-05-12Fix
CVE-2026-44852HPE Aruba Networking Wireless Operating System authenticated remote code execution7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-44548ChurchCRM legacy delete pages cross-site request forgery8.1CNA v3.10.2%2026-05-12Fix
CVE-2026-44547ChurchCRM: Incomplete fix for public API login still bypasses 2FA and account lockout in ChurchCRM9.6CNA v3.10.4%2026-05-12Fix
CVE-2026-44412Siemens Solid Edge SE2026 stack-based buffer overflow7.3CNA v4.00.2%2026-05-12Fix
CVE-2026-44411Siemens Solid Edge SE2026 uninitialized pointer access7.3CNA v4.00.2%2026-05-12Fix
CVE-2026-44403Wing FTP Server authenticated remote code execution via Session Serialization8.6CNA v4.02.3%2026-05-12Exploit codeFix
CVE-2026-44352Flowsint: Broken access control allows reading of sketch logs from any user5.3CNA v4.00.4%2026-05-12Fix
CVE-2026-44347Warpgate: SSO CSRF -- State Token not Validated on Return5.8CNA v3.10.2%2026-05-12Fix
CVE-2026-44343WGDashboard improper input validation9.3CNA v4.02.4%2026-05-12NucleiFix
CVE-2026-44341GoJobs: Insecure direct object reference (IDOR) in Job Retrieval endpoint5.3CNA v3.10.4%2026-05-12
CVE-2026-44307Mako: Path traversal via backslash URI on Windows in TemplateLookup8.7CNA v4.00.9%2026-05-12Fix
CVE-2026-44306Statamic: Email enumeration via forgot password endpoint5.3CNA v3.10.3%2026-05-12Fix
CVE-2026-44305Lemur: LDAP TLS certificate verification globally disabled enables credential interception6.8CNA v3.10.1%2026-05-12Fix
CVE-2026-44304Lemur: LDAP Filter injection enables post-authentication privilege escalation8.1CNA v3.10.3%2026-05-12Fix
CVE-2026-44302Snappier: Infinite loop in SnappyStream decompression on malformed framed input7.5CNA v3.10.5%2026-05-12Fix
CVE-2026-44301Hugo: Node tool execution allows file system access outside the project directory6.2CNA v4.00.4%2026-05-12Fix
CVE-2026-44296Deskflow: TLS multiplexer DoS on failed `SSL_accept`7.5CNA v3.10.5%2026-05-12Fix
CVE-2026-44279Fortinet FortiTokenAndroid improper export of Android application components5.0CNA v3.10.1%2026-05-12Fix
CVE-2026-44278Fortinet FortiClientWindows hard-coded cryptographic key2.1CNA v3.10.1%2026-05-12Fix
CVE-2026-44277Fortinet FortiAuthenticator improper access control9.1CNA v3.10.5%2026-05-12Exploit codeFix
CVE-2026-44262Scramble: Remote code execution via evaluation of user-controlled input in validation rules9.4CNA v3.13.9%2026-05-12NucleiExploit codeFix
CVE-2026-44260efw4.X: Readonly Flag not Enforced Server-Side8.1CNA v3.10.4%2026-05-12Fix
CVE-2026-44259efw4.X: Stored XSS via previewServlet4.6CNA v3.10.2%2026-05-12Fix
CVE-2026-44258efw4.X: Path traversal via Unchecked dst parameter leads to remote code execution9.3CNA v4.00.5%2026-05-12Fix
CVE-2026-44257efw4.X: RCE via zipslip9.3CNA v4.00.5%2026-05-12Fix
CVE-2026-44246nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`7.2CNA v3.10.3%2026-05-12Exploit codeFix
CVE-2026-44245Kyverno: [Policy-reporter-ui] XSS via Stored Property Values in PropertyCard component6.1CNA v3.10.3%2026-05-12Fix
CVE-2026-44242Micronaut Framework resource bundle message cache denial of service3.7CNA v3.10.3%2026-05-12Fix
CVE-2026-44241Micronaut Framework time converter cache denial of service7.5CNA v3.10.7%2026-05-12Fix
CVE-2026-44240basic-ftp allows a malicious FTP server to cause client-side denial of service7.5CNA v3.10.5%2026-05-12Fix
CVE-2026-44232HackingRepo dssrf-js dssrf: Every IPv6 category bypasses is_url_safe8.7CNA v4.00.5%2026-05-12Fix
CVE-2026-44225Pulpy filesystem sandbox path traversal9.3CNA v3.11.4%2026-05-12Exploit codeFix
CVE-2026-44224Wiki.js: Privilege escalation via Missing Group Validation in users.update8.6CNA v4.00.6%2026-05-12Fix
CVE-2026-44223vLLM speculative decoding denial of service6.5CNA v3.10.4%2026-05-12Fix
CVE-2026-44222vLLM: Remote DoS via Special-Token Placeholders6.5CNA v3.10.5%2026-05-12Fix
CVE-2026-44221ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases9.0CNA v3.10.4%2026-05-12Fix
CVE-2026-44220ciguard pipeline file discovery link following3.2CNA v3.10.2%2026-05-12Fix
CVE-2026-44219ciguard SCA HTTP client resource exhaustion3.7CNA v3.10.3%2026-05-12Fix
CVE-2026-44218ciguard container image improper privilege management3.0CNA v3.10.1%2026-05-12Fix
CVE-2026-44217sse-channel event field handling CRLF injection6.6CNA v4.00.5%2026-05-12Fix
CVE-2026-44215NanaZip: Heap out-of-bounds write in NanaZip UFS directory parser4.4CNA v3.10.3%2026-05-12Fix
CVE-2026-44204shelf.nu shelf: SQL injection via sortBy parameter6.5CNA v3.10.4%2026-05-12Fix
CVE-2026-44196smp46 pingvin-share-x Pingvin Share X: TOTP authentication bypass via Password-only Login9.1CNA v3.10.5%2026-05-12Fix
CVE-2026-44184Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads8.0CNA v3.10.2%2026-05-12Fix
CVE-2026-44183Cleanuparr reverse-proxy client IP check vulnerability9.8CNA v3.10.3%2026-05-12Fix
CVE-2026-44167phpseclib has a mitigation bypass OID amplification DoS in ASN1::decodeOID7.5CNA v3.10.3%2026-05-12Fix
CVE-2026-44166PocketBase OAuth2 account linking improper authentication6.1CNA v4.00.3%2026-05-12Exploit codeFix
CVE-2026-440150xJacky nginx-ui Nginx UI: Server-side request forgery8.5CNA v3.10.4%2026-05-12
CVE-2026-44012Craft CMS asset folder lookup missing authorization7.1CNA v4.00.4%2026-05-12Fix
CVE-2026-44011Craft CMS: Potential authenticated remote code execution via malicious attached Behavior8.6CNA v4.00.4%2026-05-12Emerging ThreatsExploit codeFix
CVE-2026-44010Craft CMS: Missing authorization in GraphQL Address Resolver allows Cross-Scope PII Disclosure7.1CNA v4.00.4%2026-05-12Fix
CVE-2026-43993JunoClaw: SSRF in WAVS computeDataVerify allows cloud-metadata and internal-service access8.2CNA v3.10.4%2026-05-12
CVE-2026-43992JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter9.8CNA v3.10.4%2026-05-12
CVE-2026-43991JunoClaw: Plugin-shell shell-injection bypass via substring blocklist8.4CNA v3.10.3%2026-05-12
CVE-2026-43990JunoClaw: Plugin-shell shell-metacharacter injection via shell wrapper8.4CNA v3.10.2%2026-05-12
CVE-2026-43989JunoClaw: Upload_wasm accepted arbitrary filesystem paths without validation8.5CNA v3.10.2%2026-05-12
CVE-2026-43983Pocket ID OIDC refresh token flow improper authorization8.5CNA v4.00.4%2026-05-12Fix
CVE-2026-43948wger password reset incorrect authorization9.9CNA v3.10.4%2026-05-12Fix
CVE-2026-43939YAF.NET forum thread posts stored cross-site scripting7.3CNA v3.10.4%2026-05-12Fix
CVE-2026-43938YAFNET YAF.NET: Unauthenticated Stored Second-order XSS in Admin Event Log8.1CNA v3.10.4%2026-05-12Fix
CVE-2026-43937YAFNET YAF.NET: Pre-Handler authorization bypass on Admin Pages Enabling Blind SQL Execution8.8CNA v3.10.6%2026-05-12Fix
CVE-2026-43930Parse Server SMS one-time password login race condition2.1CNA v4.00.3%2026-05-12Fix
CVE-2026-43929ssrfcheck vulnerable to server-side request forgery (SSRF) and incomplete list of disallowed inputs8.2CNA v3.10.4%2026-05-12
CVE-2026-43916pam_authnft socket diagnostics parser out-of-bounds read8.7CNA v4.00.4%2026-05-12Fix
CVE-2026-43892AntSword: Incomplete noxss sanitization leads to 1-click RCE8.8CNA v3.10.5%2026-05-12Fix
CVE-2026-43891Changedetection.io: Arbitrary Local File Read via crafted backup restore7.5CNA v3.10.5%2026-05-12Fix
CVE-2026-43685Claris FileMaker Cloud remote code execution7.2CISA ADP v3.10.8%2026-05-12Fix
CVE-2026-43680Claris FileMaker Cloud remote code execution7.2CISA ADP v3.10.8%2026-05-12Fix
CVE-2026-43515Apache Tomcat: Security constraints not correctly applied9.1CISA ADP v3.11.2%2026-05-12Exploit codeFix
CVE-2026-43514Apache Tomcat: AJP secret compared in non-constant time3.7CISA ADP v3.10.5%2026-05-12Fix
CVE-2026-43513Apache Tomcat: LockOutRealm treats user names as case-sensitive7.5CISA ADP v3.10.5%2026-05-12Fix
CVE-2026-43512Apache Tomcat: Digest authenticator will authenticate any unknown user9.8CISA ADP v3.11.3%2026-05-12Exploit codeFix
CVE-2026-42899Microsoft NET ASP.NET Core denial of service7.5CNA v3.12.4%2026-05-12Fix
CVE-2026-42898Microsoft Dynamics 365 On-Premises remote code execution9.9CNA v3.11.0%2026-05-12Fix
CVE-2026-42896Microsoft Windows DWM Core library elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-42893Microsoft Outlook for iOS tampering7.4CNA v3.10.7%2026-05-12Fix
CVE-2026-42891Microsoft Edge (Chromium-based) for Android spoofing6.5CNA v3.10.5%2026-05-12Fix
CVE-2026-42889No-Instructions relay-server relay Server WebSocket authentication bypass when token is omitted9.1CNA v3.10.5%2026-05-12Fix
CVE-2026-42855Espressif arduino-esp32 WebServer digest authentication authentication bypass7.5CNA v3.10.5%2026-05-12Fix
CVE-2026-42854Espressif arduino-esp32 WebServer multipart parser stack-based buffer overflow9.8CNA v3.10.8%2026-05-12Fix
CVE-2026-42844Grav: Low-privileged API users can create super-admin accounts via blueprint-upload8.7CNA v4.00.5%2026-05-12Fix
CVE-2026-42838Microsoft Edge (Chromium-based) elevation of privilege5.4CNA v3.10.4%2026-05-12Fix
CVE-2026-42833Microsoft Dynamics 365 On-Premises remote code execution9.1CNA v3.10.9%2026-05-12Fix
CVE-2026-42832Microsoft Office spoofing7.7CNA v3.10.3%2026-05-12Fix
CVE-2026-42831Microsoft Office remote code execution7.8CNA v3.10.5%2026-05-12Fix
CVE-2026-42830Microsoft Azure Monitor Agent Metrics Extension elevation of privilege6.5CNA v3.10.6%2026-05-12Fix
CVE-2026-42825Microsoft Windows Telephony service elevation of privilege7.0CNA v3.10.3%2026-05-12Fix
CVE-2026-42823Microsoft Azure Logic Apps elevation of privilege9.9CNA v3.10.8%2026-05-12Fix
CVE-2026-42742Views for WPForms WordPress plugin SQL injection8.5CNA v3.10.4%2026-05-12Fix
CVE-2026-42741Ninja Forms Views WordPress plugin SQL command improper neutralization8.5CNA v3.10.4%2026-05-12Fix
CVE-2026-42545Granian: DoS via WSGI response header panic5.9CNA v3.10.4%2026-05-12Fix
CVE-2026-42544Granian: Unauthenticated DoS via WebSocket subprotocol header panic7.5CNA v3.10.5%2026-05-12Fix
CVE-2026-42541Kubewarden: RBAC Reconnaissance via unchecked can_i host capability call4.3CNA v3.10.3%2026-05-12Fix
CVE-2026-42498Apache Tomcat: WebSocket authentication header exposure7.3CISA ADP v3.10.6%2026-05-12Fix
CVE-2026-42446NanaZip: Stack out-of-bounds read in NanaZip ZealFS bitmap parser4.4CNA v3.10.2%2026-05-12Fix
CVE-2026-42445NanaZip: Uncontrolled recursion in NanaZip UFS directory traversal causes stack exhaustion3.3CNA v3.10.1%2026-05-12Fix
CVE-2026-42444NanaZip: Unbounded resource consumption in NanaZip littlefs parser3.3CNA v3.10.1%2026-05-12Fix
CVE-2026-42443NanaZip: Integer divide-by-zero in NanaZip UFS inode offset calculation3.3CNA v3.10.1%2026-05-12Fix
CVE-2026-42442NanaZip: Null-pointer dereference in NanaZip UFS parser when root inode is a symlink3.3CNA v3.10.1%2026-05-12Fix
CVE-2026-42355NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion3.3CNA v3.10.1%2026-05-12Fix
CVE-2026-42348opentelemetry-dotnet-contrib OpAMP client reads unbounded HTTP response bodies5.9CNA v3.10.4%2026-05-12Fix
CVE-2026-42338ip-address has XSS in Address6 HTML-emitting methods5.3CNA v4.00.5%2026-05-12Fix
CVE-2026-42303Fides: Privacy Request Identity Verification Bypass vulnerability via Duplicate Detection6.1CNA v4.00.6%2026-05-12Fix
CVE-2026-42300DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header9.3CNA v4.00.4%2026-05-12Fix
CVE-2026-42289ChurchCRM: Cross-site request forgery (CSRF) leading to admin privilege escalation8.8CNA v3.10.2%2026-05-12Fix
CVE-2026-42288ChurchCRM: Incomplete fix for unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD10.0CNA v3.11.0%2026-05-12Fix
CVE-2026-42268ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators8.2CNA v4.00.5%2026-05-12Fix
CVE-2026-42260Aas-ee Open-WebSearch fetchWebContent MCP tool server-side request forgery8.2CNA v3.10.4%2026-05-12Fix
CVE-2026-42196django-s3file is vulnerable to relative path traversal9.9CNA v4.00.6%2026-05-12Fix
CVE-2026-42191opentelemetry-dotnet OpenTelemetry's disk retry default temp path enables local blob injection6.5CNA v3.10.1%2026-05-12Fix
CVE-2026-42177Siemens linux-entra-sso Chrome extension SSO cookie header injection vulnerability5.3CNA v3.10.3%2026-05-12Fix
CVE-2026-42175requests-hardened is vulnerable to server-side request forgery6.5CNA v3.10.4%2026-05-12Fix
CVE-2026-42158Flowsint: Broken access control allows modification of investigation metadata from any user2.3CNA v4.00.3%2026-05-12Fix
CVE-2026-42157Flowsint: Stored XSS on map node marker in map page5.1CNA v4.00.5%2026-05-12Fix
CVE-2026-42156Flowsint: Cypher query injection in node type on node creation7.1CNA v4.00.5%2026-05-12Fix
CVE-2026-42141xibosignage xibo-cms xibo: Authenticated server-side request forgery in library upload7.7CNA v3.10.4%2026-05-12Exploit codeFix
CVE-2026-42048Langflow: Path traversal in Langflow Knowledge Bases API9.6CNA v3.10.6%2026-05-12Exploit codeFix
CVE-2026-42045LobeHub: Cross-site scripting(XSS) escalate to remote code execution(RCE)6.2CNA v3.10.4%2026-05-12Fix
CVE-2026-42006Open-Xchange OX Dovecot Pro resource exhaustion4.3CNA v3.10.8%2026-05-12Fix
CVE-2026-41901Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions9.0CNA v3.10.5%2026-05-12Exploit codeFix
CVE-2026-41895Changedetection.io: XXE vulnerability in the Changedetection.io project8.2CNA v4.00.4%2026-05-12Fix
CVE-2026-41872EPG "Kura Sushi Official App" improper certificate validation9.1CNA v4.00.3%2026-05-12
CVE-2026-41713VMware Spring AI prompt injection via Memory Poisoning in PromptChatMemoryAdvisor8.2CNA v3.10.4%2026-05-12Fix
CVE-2026-41712VMware Spring AI ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage7.5CNA v3.10.4%2026-05-12Fix
CVE-2026-41614Microsoft M365 Copilot for Desktop spoofing6.2CNA v3.10.4%2026-05-12Fix
CVE-2026-41613Microsoft Visual Studio Code elevation of privilege8.8CNA v3.10.8%2026-05-12Fix
CVE-2026-41612Microsoft Visual Studio Code information disclosure5.5CNA v3.10.6%2026-05-12Fix
CVE-2026-41611Microsoft Visual Studio Code remote code execution7.8CNA v3.10.5%2026-05-12Fix
CVE-2026-41610Microsoft Visual Studio Code security feature bypass6.3CNA v3.10.7%2026-05-12Fix
CVE-2026-41551Siemens ROS# relative path traversal9.3CNA v4.00.6%2026-05-12Exploit codeFix
CVE-2026-41530Chitora soft Lhaz path traversal4.6CNA v4.00.2%2026-05-12
CVE-2026-41513Horilla: Open redirect via Unvalidated `next` parameter in Notification endpoints4.8CNA v4.00.4%2026-05-12
CVE-2026-41293Apache Tomcat: HTTP/2 request headers not validated9.8CISA ADP v3.11.7%2026-05-12Fix
CVE-2026-41284Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling7.5CISA ADP v3.10.9%2026-05-12Fix
CVE-2026-41195mosparo rule package source URL server-side request forgery5.0CNA v3.10.3%2026-05-12Fix
CVE-2026-41125Siemens blueplanet 100 NX3 M8 SQL injection5.9CNA v4.00.2%2026-05-12Fix
CVE-2026-41109Microsoft GitHub Copilot and Visual Studio Code security feature bypass8.8CNA v3.10.9%2026-05-12Fix
CVE-2026-41107Microsoft Edge (Chromium-based) information disclosure7.4CNA v3.10.9%2026-05-12Fix
CVE-2026-41103Microsoft SSO plugin for Jira and Confluence elevation of privilege9.1CNA v3.10.8%2026-05-12Fix
CVE-2026-41102Microsoft PowerPoint for Android spoofing7.1CNA v3.10.3%2026-05-12Fix
CVE-2026-41101Microsoft Word for Android spoofing7.1CNA v3.10.3%2026-05-12Fix
CVE-2026-41100Microsoft 365 Copilot for Android spoofing4.4CNA v3.10.3%2026-05-12Fix
CVE-2026-41097Microsoft Windows secure Boot security feature bypass6.7CNA v3.12.2%2026-05-12Fix
CVE-2026-41096Microsoft Windows DNS client remote code execution9.8CNA v3.11.0%2026-05-12Exploit codeFix
CVE-2026-41095Microsoft Windows data Deduplication elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-41094Microsoft DATA Formulator remote code execution8.8CNA v3.10.9%2026-05-12Fix
CVE-2026-41089Microsoft Windows Netlogon remote code execution9.8CNA v3.11.0%2026-05-12Reported exploitedExploit codeFix
CVE-2026-41088Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.8CNA v3.10.4%2026-05-12Fix
CVE-2026-41086Microsoft Windows Admin Center in Azure Portal elevation of privilege8.8CNA v3.10.8%2026-05-12Fix
CVE-2026-40902PhpSpreadsheet: CPU denial of service via Unbounded Row Number in XLSX Row Dimensions7.5CNA v3.10.5%2026-05-12Fix
CVE-2026-40863PhpSpreadsheet: CPU denial of service via Unbounded Row Index in SpreadsheetML XML Reader7.5CNA v3.10.5%2026-05-12Fix
CVE-2026-40638Dell PowerScale InsightIQ execution with unnecessary privileges6.7CNA v3.10.2%2026-05-12Fix
CVE-2026-40421Microsoft Word information disclosure4.3CNA v3.10.7%2026-05-12Fix
CVE-2026-40420Microsoft Office Click-To-Run elevation of privilege8.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40419Microsoft Office Click-To-Run elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40418Microsoft Office Click-To-Run elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40417Microsoft Dynamics 365 Business Central elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40416Microsoft Edge (Chromium-based) for Android spoofing4.3CNA v3.10.5%2026-05-12Fix
CVE-2026-40415Microsoft Windows TCP/IP remote code execution8.1CNA v3.10.7%2026-05-12Fix
CVE-2026-40414Microsoft Windows TCP/IP denial of service7.4CNA v3.10.6%2026-05-12Fix
CVE-2026-40413Microsoft Windows TCP/IP denial of service7.4CNA v3.10.6%2026-05-12Fix
CVE-2026-40410Microsoft Windows SMB client elevation of privilege7.0CNA v3.10.3%2026-05-12Fix
CVE-2026-40408Microsoft Windows WAN ARP driver elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40407Microsoft Windows Common Log File System driver elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40406Microsoft Windows TCP/IP information disclosure7.5CNA v3.11.0%2026-05-12Fix
CVE-2026-40405Microsoft Windows TCP/IP denial of service7.5CNA v3.11.2%2026-05-12Fix
CVE-2026-40403Microsoft Windows Graphics component remote code execution8.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40402Microsoft Windows Hyper-V elevation of privilege9.3CNA v3.10.4%2026-05-12Fix
CVE-2026-40401Microsoft Windows TCP/IP denial of service7.1CNA v3.10.4%2026-05-12Fix
CVE-2026-40399Microsoft Windows TCP/IP elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40398Microsoft Windows Remote Desktop services elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40397Microsoft Windows Common Log File System driver elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40382Microsoft Windows Telephony service elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40381Microsoft Azure Connected Machine Agent elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40380Microsoft Windows Volume Manager extension driver remote code execution6.2CNA v3.10.4%2026-05-12Fix
CVE-2026-40379Azure Entra ID spoofing9.3CNA v3.10.9%2026-05-12Fix
CVE-2026-40377Microsoft Cryptographic services elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-40374Microsoft Power Automate Desktop information disclosure6.5CNA v3.11.0%2026-05-12Fix
CVE-2026-40370SQL server remote code execution8.8CNA v3.11.0%2026-05-12Fix
CVE-2026-40369Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.3%2026-05-12Exploit codeFix
CVE-2026-40368Microsoft SharePoint server remote code execution8.0CNA v3.12.1%2026-05-12Fix
CVE-2026-40367Microsoft Word remote code execution8.4CNA v3.10.4%2026-05-12Fix
CVE-2026-40366Microsoft Word remote code execution8.4CNA v3.10.4%2026-05-12Fix
CVE-2026-40365Microsoft SharePoint server remote code execution8.8CNA v3.11.1%2026-05-12Fix
CVE-2026-40364Microsoft Word remote code execution8.4CNA v3.10.4%2026-05-12Fix
CVE-2026-40363Microsoft Office remote code execution8.4CNA v3.10.4%2026-05-12Fix
CVE-2026-40362Microsoft Excel remote code execution7.8CNA v3.10.5%2026-05-12Fix
CVE-2026-40361Microsoft Outlook and Word remote code execution8.4CNA v3.10.4%2026-05-12Fix
CVE-2026-40360Microsoft Excel information disclosure7.8CNA v3.10.5%2026-05-12Fix
CVE-2026-40359Microsoft Excel remote code execution7.8CNA v3.10.5%2026-05-12Fix
CVE-2026-40358Microsoft Office remote code execution8.4CNA v3.10.4%2026-05-12Fix
CVE-2026-40357Microsoft SharePoint server remote code execution8.8CNA v3.12.3%2026-05-12Fix
CVE-2026-40300Zulip Server message edit history API improper access control6.0CNA v4.00.4%2026-05-12Fix
CVE-2026-40137Cross-site scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)6.1CNA v3.10.3%2026-05-12Fix
CVE-2026-40136Denial of service (DoS) in SAP Financial Consolidation4.3CNA v3.10.4%2026-05-12Fix
CVE-2026-40135OS command injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform6.5CNA v3.11.9%2026-05-12Fix
CVE-2026-40134Missing authorization Check in SAP Incentive and Commission Management4.3CNA v3.10.3%2026-05-12Fix
CVE-2026-40133Missing authorization check in SAP S/4HANA Condition Maintenance6.3CNA v3.10.3%2026-05-12Fix
CVE-2026-40132Missing authorization Check in SAP Strategic Enterprise Management5.4CNA v3.10.2%2026-05-12Fix
CVE-2026-40131SQL injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library3.4CNA v3.10.2%2026-05-12Fix
CVE-2026-40129Code injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform4.3CNA v3.10.3%2026-05-12Fix
CVE-2026-40020Open-Xchange OX Dovecot Pro improper access control3.1CNA v3.10.3%2026-05-12Fix
CVE-2026-40016Open-Xchange OX Dovecot Pro resource exhaustion5.3CNA v3.10.4%2026-05-12Fix
CVE-2026-39432Timetics WordPress plugin broken access control8.2CNA v3.10.3%2026-05-12Fix
CVE-2026-35555Subnet Solutions PowerSYSTEM Center incorrect authorization7.0CNA v4.00.2%2026-05-12Fix
CVE-2026-35504Subnet Solutions PowerSYSTEM Center CRLF injection5.1CNA v4.00.3%2026-05-12Fix
CVE-2026-35440Microsoft Word information disclosure5.5CNA v3.10.5%2026-05-12Fix
CVE-2026-35439Microsoft SharePoint server remote code execution8.8CNA v3.12.3%2026-05-12Fix
CVE-2026-35438Microsoft Windows Admin Center elevation of privilege8.3CNA v3.10.6%2026-05-12Fix
CVE-2026-35436Microsoft Office Click-To-Run elevation of privilege8.8CNA v3.10.3%2026-05-12Fix
CVE-2026-35433Microsoft .NET elevation of privilege7.3CNA v3.10.6%2026-05-12Fix
CVE-2026-35429Microsoft Edge (Chromium-based) for Android spoofing4.3CNA v3.10.7%2026-05-12Fix
CVE-2026-35424Microsoft Windows internet Key Exchange (IKE) protocol denial of service7.5CNA v3.11.2%2026-05-12Fix
CVE-2026-35423Microsoft Windows 11 Telnet client information disclosure5.4CNA v3.10.7%2026-05-12Fix
CVE-2026-35422Microsoft Windows TCP/IP driver security feature bypass6.5CNA v3.10.6%2026-05-12Fix
CVE-2026-35421Microsoft Windows GDI remote code execution7.8CNA v3.10.5%2026-05-12Fix
CVE-2026-35420Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-35419Microsoft Windows DWM Core library information disclosure5.5CNA v3.10.4%2026-05-12Fix
CVE-2026-35418Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.8CNA v3.10.2%2026-05-12Fix
CVE-2026-35417Microsoft Windows Win32k elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-35416Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.3%2026-05-12Fix
CVE-2026-35415Microsoft Windows Storage Spaces controller elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-35227Improper resource management in CODESYS Modbus TCP Server8.2CNA v4.00.5%2026-05-12Fix
CVE-2026-35071Dell PowerScale InsightIQ OS command injection8.2CNA v3.10.6%2026-05-12Fix
CVE-2026-34690Adobe After Effects stack-based buffer overflow7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34688Adobe CAI Content Credentials improper input validation6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34687Adobe Illustrator heap-based buffer overflow7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34686Adobe Commerce cross-site scripting (stored XSS)8.7CNA v3.10.7%2026-05-12Fix
CVE-2026-34685Adobe Commerce improper input validation3.4CNA v3.10.6%2026-05-12Fix
CVE-2026-34684Substance3D Designer out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34683Substance3D Designer out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34682Substance3D Designer out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34681Substance3D Designer out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34680Adobe CAI Content Credentials integer overflow or wraparound6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34679Adobe CAI Content Credentials improper input validation6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34678Adobe CAI Content Credentials uncontrolled resource consumption6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34677Adobe CAI Content Credentials uncontrolled resource consumption6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34676Adobe Substance3D Painter out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34675Adobe Substance3D Painter out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34673Adobe CAI Content Credentials uncontrolled resource consumption6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34672Adobe CAI Content Credentials integer underflow (wrap or wraparound)6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34671Adobe CAI Content Credentials integer overflow or wraparound6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34670Adobe CAI Content Credentials improper input validation6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34669Adobe CAI Content Credentials improper input validation6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34668Adobe CAI Content Credentials improper input validation6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34667Adobe CAI Content Credentials integer underflow (wrap or wraparound)6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34666Adobe CAI Content Credentials improper input validation6.2CNA v3.10.3%2026-05-12Fix
CVE-2026-34665Adobe CAI Content Credentials uncontrolled resource consumption7.5CNA v3.10.9%2026-05-12Fix
CVE-2026-34664Substance3D Designer improper limitation of a pathname to a restricted directory (path traversal)6.3CNA v3.10.3%2026-05-12Fix
CVE-2026-34663Adobe Illustrator out-of-bounds read5.5CNA v3.10.3%2026-05-12Fix
CVE-2026-34662Adobe Illustrator null pointer dereference5.5CNA v3.10.2%2026-05-12Fix
CVE-2026-34661Adobe Illustrator out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34660Adobe Connect incorrect authorization9.3CNA v3.11.0%2026-05-12Fix
CVE-2026-34659Adobe Connect deserialization of untrusted data9.6CNA v3.11.9%2026-05-12Fix
CVE-2026-34658Adobe Commerce cross-site scripting (stored XSS)4.8CNA v3.10.4%2026-05-12Fix
CVE-2026-34656Adobe Commerce improper authorization4.3CNA v3.10.6%2026-05-12Fix
CVE-2026-34655Adobe Commerce cross-site scripting (stored XSS)4.8CNA v3.10.4%2026-05-12Fix
CVE-2026-34654Adobe Commerce dependency on vulnerable third-party component5.3CNA v3.10.8%2026-05-12Fix
CVE-2026-34653Adobe Commerce improper limitation of a pathname to a restricted directory (path traversal)8.7CNA v3.11.0%2026-05-12Fix
CVE-2026-34652Adobe Commerce dependency on vulnerable third-party component7.5CNA v3.10.9%2026-05-12Fix
CVE-2026-34651Adobe Commerce uncontrolled resource consumption7.5CNA v3.10.9%2026-05-12Fix
CVE-2026-34650Adobe Commerce uncontrolled resource consumption7.5CNA v3.10.9%2026-05-12Fix
CVE-2026-34649Adobe Commerce uncontrolled resource consumption7.5CNA v3.10.9%2026-05-12Fix
CVE-2026-34648Adobe Commerce uncontrolled resource consumption7.5CNA v3.11.0%2026-05-12Fix
CVE-2026-34647Adobe Commerce server-side request forgery (SSRF)7.4CNA v3.10.9%2026-05-12Fix
CVE-2026-34646Adobe Commerce incorrect authorization7.5CNA v3.10.7%2026-05-12Fix
CVE-2026-34645Adobe Commerce incorrect authorization7.5CNA v3.10.7%2026-05-12Fix
CVE-2026-34644Adobe After Effects integer overflow or wraparound7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34643Adobe After Effects out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34642Adobe After Effects heap-based buffer overflow7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34640Media Encoder integer overflow or wraparound7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34639Media Encoder out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34638Adobe Premiere Pro use-after-free7.8CNA v3.10.4%2026-05-12Fix
CVE-2026-34637Adobe Premiere Pro out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34636Adobe Premiere Pro out-of-bounds write7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34351Microsoft Windows TCP/IP elevation of privilege7.8CNA v3.10.2%2026-05-12Fix
CVE-2026-34350Microsoft Windows Storport Miniport driver denial of service6.5CNA v3.10.9%2026-05-12Fix
CVE-2026-34347Microsoft Windows Win32k elevation of privilege7.0CNA v3.10.3%2026-05-12Fix
CVE-2026-34345Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.0CNA v3.10.2%2026-05-12Fix
CVE-2026-34344Microsoft Windows Ancillary function driver for WinSock elevation of privilege7.8CNA v3.10.3%2026-05-12Exploit codeFix
CVE-2026-34343Microsoft Windows Application Identity (AppID) subsystem elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34342Microsoft Windows Print Spooler elevation of privilege7.0CNA v3.10.2%2026-05-12Fix
CVE-2026-34341Microsoft Windows Link-Layer Discovery Protocol (LLDP) elevation of privilege7.0CNA v3.10.3%2026-05-12Fix
CVE-2026-34340Microsoft Windows Projected File System elevation of privilege7.0CNA v3.10.3%2026-05-12Fix
CVE-2026-34339Microsoft Windows Lightweight Directory Access Protocol (LDAP) denial of service5.5CNA v3.10.4%2026-05-12Fix
CVE-2026-34338Microsoft Windows Telephony service elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34337Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.8CNA v3.10.2%2026-05-12Fix
CVE-2026-34336Microsoft Windows DWM Core library elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34334Microsoft Windows TCP/IP elevation of privilege7.8CNA v3.10.2%2026-05-12Fix
CVE-2026-34333Microsoft Windows Win32k elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34332Microsoft Windows Kernel-Mode driver remote code execution8.0CNA v3.10.8%2026-05-12Fix
CVE-2026-34331Microsoft Windows win32k elevation of privilege7.0CNA v3.10.2%2026-05-12Fix
CVE-2026-34330Microsoft Windows win32k elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-34329Microsoft Message Queuing (MSMQ) remote code execution8.8CNA v3.10.5%2026-05-12Fix
CVE-2026-34263Missing authentication check in SAP Commerce cloud configuration9.6CNA v3.10.6%2026-05-12Fix
CVE-2026-34260SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)9.6CNA v3.10.4%2026-05-12Fix
CVE-2026-34259OS command injection vulnerability in SAP Forecasting and Replenishment8.2CNA v3.10.2%2026-05-12Fix
CVE-2026-34258Content spoofing vulnerability in SAPUI5 (Search UI)4.7CNA v3.10.3%2026-05-12Fix
CVE-2026-34187Pandora FMS SQL injection in Graph Container parameter7.6CNA v4.00.4%2026-05-12Fix
CVE-2026-33893Siemens Teamcenter V2312 hard-coded credentials8.7CNA v4.00.4%2026-05-12Fix
CVE-2026-33862Siemens Teamcenter V2312 cross-site scripting8.5CNA v4.00.3%2026-05-12Fix
CVE-2026-33841Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-33840Microsoft Windows win32k elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-33839Microsoft Windows win32k elevation of privilege7.0CNA v3.10.2%2026-05-12Fix
CVE-2026-33838Microsoft Windows Message Queuing (MSMQ) elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-33837Microsoft Windows TCP/IP local elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-33835Microsoft Windows Cloud Files Mini Filter driver elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-33834Microsoft Windows Event Logging service elevation of privilege7.8CNA v3.10.3%2026-05-12Fix
CVE-2026-33833Microsoft Azure Machine Learning Notebook spoofing8.2CNA v3.10.5%2026-05-12Fix
CVE-2026-33821Microsoft Dynamics 365 improper privilege management7.7CNA v3.10.8%2026-05-12Fix
CVE-2026-33603Open-Xchange OX Dovecot Pro resource injection6.8CNA v3.10.2%2026-05-12Fix
CVE-2026-33570Subnet Solutions PowerSYSTEM Center incorrect authorization6.9CNA v4.00.2%2026-05-12Fix
CVE-2026-33117Microsoft Azure SDK for Java security feature bypass9.1CNA v3.10.5%2026-05-12Fix
CVE-2026-33112Microsoft SharePoint server remote code execution8.8CNA v3.12.3%2026-05-12Fix
CVE-2026-33110Microsoft SharePoint server remote code execution8.8CNA v3.12.3%2026-05-12Fix
CVE-2026-32687elixir-ecto postgrex SQL injection7.5CNA v4.00.2%2026-05-12Fix
CVE-2026-32684Hikvision Hik-Connect APP incorrect permission assignment2.9CNA v3.10.1%2026-05-12
CVE-2026-32209Microsoft Windows Filtering Platform (WFP) security feature bypass4.4CNA v3.10.3%2026-05-12Fix
CVE-2026-32204Microsoft Azure Monitor Agent elevation of privilege7.8CNA v3.10.4%2026-05-12Fix
CVE-2026-32185Microsoft Teams spoofing5.5CNA v3.10.5%2026-05-12Fix
CVE-2026-32177Microsoft .NET elevation of privilege7.3CNA v3.10.6%2026-05-12Fix
CVE-2026-32175Microsoft .NET Core tampering4.3CNA v3.10.6%2026-05-12Fix
CVE-2026-32170Microsoft Windows Rich Text Edit elevation of privilege6.7CNA v3.10.3%2026-05-12Fix
CVE-2026-32161Microsoft Windows Native WiFi Miniport driver remote code execution7.5CNA v3.10.3%2026-05-12Fix
CVE-2026-31245mem0 server lacks authentication and authorization controls for its memory creation API endpoint5.3CISA ADP v3.10.5%2026-05-12
CVE-2026-31244mem0 missing authentication6.5CISA ADP v3.10.6%2026-05-12
CVE-2026-31243mem0 missing authentication6.5CISA ADP v3.10.5%2026-05-12
CVE-2026-31242mem0 missing authentication9.1CISA ADP v3.10.7%2026-05-12
CVE-2026-31241mem0 server lacks authentication and authorization controls for its memory deletion API endpoint6.5CISA ADP v3.10.6%2026-05-12
CVE-2026-31240Mem0 server lacks authentication and authorization controls for its memory management API endpoints7.5CISA ADP v3.10.5%2026-05-12
CVE-2026-31239mamba pretrained model loader deserialization of untrusted data9.8CISA ADP v3.10.6%2026-05-12
CVE-2026-31238Ludwig framework is vulnerable to insecure deserialization in its model serving component9.8CISA ADP v3.10.7%2026-05-12
CVE-2026-31237Ludwig framework is vulnerable to insecure deserialization through its predict method9.8CISA ADP v3.10.9%2026-05-12
CVE-2026-31236Llm CLI tool contains a code injection vulnerability via `--functions` command-line argument9.8CISA ADP v3.10.5%2026-05-12
CVE-2026-31235imgaug BackgroundAugmenter worker queue deserialization of untrusted data9.8CISA ADP v3.10.7%2026-05-12
CVE-2026-31234Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component9.8CISA ADP v3.11.0%2026-05-12
CVE-2026-31233Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism9.8CISA ADP v3.10.9%2026-05-12
CVE-2026-31232CosyVoice model loading deserialization of untrusted data8.8CISA ADP v3.10.7%2026-05-12
CVE-2026-31231Cognee notebook cell execution endpoint code injection9.8CISA ADP v3.10.9%2026-05-12
CVE-2026-31230Adversarial Robustness Toolbox Kubeflow FGSM evaluation script code injection9.8CISA ADP v3.10.8%2026-05-12Fix
CVE-2026-31229Adversarial Robustness Toolbox Kubeflow model loading deserialization of untrusted data9.8CISA ADP v3.10.9%2026-05-12
CVE-2026-31228Adversarial Robustness Toolbox Kubeflow robustness evaluation function code injection9.8CISA ADP v3.11.1%2026-05-12
CVE-2026-31226TinyZero HDFS file operation utilities OS command injection9.8CISA ADP v3.12.1%2026-05-12
CVE-2026-31225Superduper: Remote code execution via unsafe eval in superduper query parsing8.8CISA ADP v3.10.7%2026-05-12
CVE-2026-31224Snorkel MultitaskClassifier.load uses an unsafe torch.load8.8CISA ADP v3.10.7%2026-05-12
CVE-2026-31223Snorkel BaseLabeler.load uses an unsafe pickle.load8.8v3.10.4%2026-05-12
CVE-2026-31222Snorkel Trainer.load uses an unsafe torch.load8.8v3.10.4%2026-05-12
CVE-2026-31221lightning-ai pytorch-lightning deserialization of untrusted data7.8v3.10.4%2026-05-12
CVE-2026-31220PySyft server-side arbitrary Python execution after code approval9.8CISA ADP v3.11.2%2026-05-12
CVE-2026-31219optimate neural_magic_training.py load_model function deserialization of untrusted data8.8CISA ADP v3.10.8%2026-05-12
CVE-2026-31218optimate neural_magic_training.py state_dict.pt loader deserialization of untrusted data8.8CISA ADP v3.10.8%2026-05-12
CVE-2026-31217Nebuly Optimate code injection9.8CISA ADP v3.10.7%2026-05-12
CVE-2026-31216nexent files accessible to external parties9.1CISA ADP v3.10.7%2026-05-12
CVE-2026-31215nexent files accessible to external parties9.1CISA ADP v3.10.7%2026-05-12
CVE-2026-31214ml-engineering torch-checkpoint-shrink.py checkpoint loader deserialization of untrusted data9.8CISA ADP v3.10.9%2026-05-12
CVE-2026-30810Pandora FMS server-side request forgery in API Checker leads to privilege escalation7.1CNA v4.00.4%2026-05-12Fix
CVE-2026-30808Pandora FMS session fixation in Authentication leads to session hijacking7.6CNA v4.00.4%2026-05-12Fix
CVE-2026-30807Pandora FMS cross-site request forgery on extension pages7.1CNA v4.00.2%2026-05-12Fix
CVE-2026-30805Pandora FMS insecure default initialization in API Authentication leads to authentication bypass9.1CNA v4.00.5%2026-05-12Fix
CVE-2026-29204WebPros WHMCS insecure direct object reference9.1CNA v3.10.5%2026-05-12Fix
CVE-2026-27851Open-Xchange OX Dovecot Pro LDAP injection7.4CNA v3.10.6%2026-05-12Fix
CVE-2026-27682Reflected cross-site scripting vulnerability in SAP NetWeaver Application Server ABAP4.7CNA v3.10.3%2026-05-12Fix
CVE-2026-27662Siemens SIMATIC HMI MTP1000 Unified Comfort Panel insecure default initialization7.0CNA v4.00.2%2026-05-12Fix
CVE-2026-26289Subnet Solutions PowerSYSTEM Center incorrect authorization8.4CNA v4.00.2%2026-05-12Fix
CVE-2026-26083Fortinet FortiSandbox missing authorization9.1CNA v3.10.5%2026-05-12Fix