CVE-2026 list

CVE-2026 records published in May 2026

Page five of seven: records 4,001 to 5,000 of the 6,293 published in May 2026, newest first. The first page carries the figures for May 2026.

CVE-2026 records published in May 2026, newest first: records 4,001 to 5,000 of 6,293
CVE Summary CVSS EPSS Published Signals
CVE-2026-25789Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting7.2CNA v4.00.5%2026-05-12Fix
CVE-2026-25787Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting9.3CNA v4.00.5%2026-05-12Fix
CVE-2026-25786Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting9.3CNA v4.00.5%2026-05-12Fix
CVE-2026-25690Fortinet FortiDeceptor argument injection4.0CNA v3.10.3%2026-05-12Fix
CVE-2026-25431Hustle WordPress plugin broken access control5.3CNA v3.10.3%2026-05-12Fix
CVE-2026-25088Fortinet FortiNDR SQL injection5.1CNA v3.10.3%2026-05-12Fix
CVE-2026-23827HPE Aruba Networking Wireless Operating System unauthenticated remote code execution7.5CNA v3.10.5%2026-05-12Fix
CVE-2026-23826HPE Aruba Networking Wireless Operating System (AOS) resource exhaustion7.5CNA v3.10.4%2026-05-12Fix
CVE-2026-23825HPE Aruba Networking Wireless Operating System unauthenticated denial of service7.5CNA v3.10.3%2026-05-12Fix
CVE-2026-23824HPE Aruba Networking Wireless Operating System unauthenticated denial of service7.5CNA v3.10.3%2026-05-12Fix
CVE-2026-23823HPE ArubaOS (AOS) authenticated command injection leads to RCE in AOS-10 CLI command7.2CNA v3.11.0%2026-05-12Fix
CVE-2026-23822HPE ArubaOS unauthenticated XML external entity injection in AOS-8 Instant allows denial of service5.3CNA v3.10.3%2026-05-12Fix
CVE-2026-23821HPE ArubaOS (AOS) inconsistent input filtering allows authenticated command injection in AOS-10 CLI7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-23820ArubaOS command line interface OS command injection7.2CNA v3.10.6%2026-05-12Fix
CVE-2026-23819HPE ArubaOS (AOS) Error in SSID Processing allows stored XSS in Web Management interface8.8CNA v3.10.3%2026-05-12Fix
CVE-2026-22925Siemens SIMATIC CN 4100 resource exhaustion8.7CNA v4.00.3%2026-05-12Fix
CVE-2026-22924Siemens SIMATIC CN 4100 missing authentication8.8CNA v4.00.3%2026-05-12Fix
CVE-2026-21530Windows Rich Text Edit elevation of privilege6.7CNA v3.10.3%2026-05-12Fix
CVE-2026-20914Intel(R) QAT software drivers null pointer dereference6.8CNA v4.00.1%2026-05-12Fix
CVE-2026-20905Intel(R) QAT software drivers improper input validation6.9CNA v4.00.1%2026-05-12Fix
CVE-2026-20887Intel Vision software improper access control8.8CNA v4.00.5%2026-05-12
CVE-2026-20881Intel(R) QAT software drivers divide by zero6.8CNA v4.00.1%2026-05-12Fix
CVE-2026-20879Intel(R) Data Center Graphics Driver for VMware ESXi software out-of-bounds write8.3CNA v4.00.1%2026-05-12Fix
CVE-2026-20794Intel(R) Data Center Graphics Driver for VMware ESXi software buffer overflow9.3CNA v4.00.1%2026-05-12Fix
CVE-2026-20793Intel(R) QAT software drivers unchecked return value4.8CNA v4.00.1%2026-05-12Fix
CVE-2026-20782Intel(R) QAT software drivers buffer overflow6.9CNA v4.00.1%2026-05-12Fix
CVE-2026-20772Intel(R) Connectivity Performance Suite software installers uncontrolled search path5.4CNA v4.00.1%2026-05-12Fix
CVE-2026-20771Intel(R) QAT software drivers null pointer dereference6.9CNA v4.00.1%2026-05-12Fix
CVE-2026-20767Intel(R) QAT software drivers improper input validation8.5CNA v4.00.1%2026-05-12Fix
CVE-2026-20754Intel(R) NPU Drivers improper check for exceptional conditions6.9CNA v4.00.1%2026-05-12Fix
CVE-2026-20753Slim Bootloader UEFI firmware integer overflow8.7CNA v4.00.1%2026-05-12Fix
CVE-2026-20751Intel(R) Data Center Graphics Driver for VMware ESXi software out-of-bounds read8.3CNA v4.00.1%2026-05-12Fix
CVE-2026-20738Intel(R) QuickAssist Adapter 8960 software untrusted pointer dereference8.5CNA v4.00.1%2026-05-12Fix
CVE-2026-20718Intel(R) NPU Driver software installers incorrect default permissions5.4CNA v4.00.1%2026-05-12Fix
CVE-2026-20717Intel(R) QAT software drivers improper input validation6.9CNA v4.00.1%2026-05-12Fix
CVE-2026-20714Intel(R) QAT software drivers out-of-bounds write8.5CNA v4.00.1%2026-05-12Fix
CVE-2026-8431Ops Manager RCE via webhook body9.4CNA v4.00.7%2026-05-12Fix
CVE-2026-8430SPIP remote code execution via nginx9.2CNA v4.00.7%2026-05-12Fix
CVE-2026-8429SPIP remote code execution via Private Space8.7CNA v4.00.9%2026-05-12Fix
CVE-2026-8407Devolutions Server PAM module missing authorization4.3CISA ADP v3.10.3%2026-05-12Fix
CVE-2026-8401Mozilla Firefox sandbox escape in the Profile Backup component9.8CISA ADP v3.10.6%2026-05-12Fix
CVE-2026-8391Mozilla Firefox other issue in the JavaScript Engine component5.3CISA ADP v3.10.6%2026-05-12Fix
CVE-2026-8390Mozilla Firefox use-after-free in the JavaScript: WebAssembly component7.3CISA ADP v3.10.3%2026-05-12Fix
CVE-2026-8389Mozilla Firefox JIT miscompilation in the JavaScript Engine: JIT component8.8CISA ADP v3.10.5%2026-05-12Exploit codeFix
CVE-2026-8388Mozilla Firefox incorrect boundary conditions in the JavaScript Engine: JIT component6.5CISA ADP v3.10.5%2026-05-12Fix
CVE-2026-8368LWP::UserAgent redirect handler information disclosure6.5CISA ADP v3.10.4%2026-05-12Fix
CVE-2026-8349omec-project amf NGAP message memory corruption5.3CNA v4.00.5%2026-05-12Fix
CVE-2026-8346D-Link DIR-816 portForward command injection8.8v3.15.0%2026-05-12
CVE-2026-8162multiparty vulnerable to denial of service via uncaught exception in filename* parameter parsing7.5CNA v3.10.6%2026-05-12Fix
CVE-2026-8161multiparty vulnerable to denial of service via prototype pollution leading to uncaught exception7.5CNA v3.10.5%2026-05-12Exploit codeFix
CVE-2026-8159multiparty vulnerable to ReDoS via filename parsing7.5CNA v3.10.6%2026-05-12Fix
CVE-2026-8111Ivanti Endpoint Manager web console SQL injection8.8CNA v3.11.6%2026-05-12Fix
CVE-2026-8110Ivanti Endpoint Manager agent insecure permissions7.8CNA v3.10.4%2026-05-12Fix
CVE-2026-8109Ivanti Endpoint Manager exposed dangerous method6.5CNA v3.11.1%2026-05-12Fix
CVE-2026-8108Fuji Electric Tellus exposed dangerous method or function7.8CNA v3.10.2%2026-05-12Fix
CVE-2026-8072Insecure generation of SAT access credentials in Ingecon EMS Board9.2CNA v4.00.2%2026-05-12Fix
CVE-2026-8052HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack6.0CNA v3.10.2%2026-05-12Fix
CVE-2026-8051Ivanti Virtual Traffic Manager OS command injection7.2CNA v3.13.0%2026-05-12Fix
CVE-2026-8043Ivanti Xtraction external control of a file path9.6CNA v3.11.2%2026-05-12Fix
CVE-2026-7661Bootstrap Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12
CVE-2026-7659Advanced Social Media Icons WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12
CVE-2026-7626Slek Gateway for WooCommerce WordPress plugin unauthenticated insufficiently protected credentials5.3CNA v3.10.4%2026-05-12
CVE-2026-7616Zawgyi Embed WordPress plugin cross-site request forgery via zawgyi_forceCSS parameter4.3CNA v3.10.2%2026-05-12
CVE-2026-7562WP-Redirection WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-05-12
CVE-2026-7561Tm WordPress Redirection plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.2%2026-05-12
CVE-2026-7474Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution8.8CNA v3.10.7%2026-05-12Fix
CVE-2026-7464WP Google Maps Integration WordPress plugin reflected cross-site scripting via page parameter6.1CNA v3.10.4%2026-05-12
CVE-2026-7437AzonPost WordPress plugin reflected cross-site scripting6.1CNA v3.10.4%2026-05-12
CVE-2026-7432Ivanti Secure Access Client race condition7.8CNA v3.10.4%2026-05-12Fix
CVE-2026-7431Ivanti Secure Access Client incorrect permission assignment4.4CNA v3.10.2%2026-05-12Fix
CVE-2026-7428Insecure default administrative credentials in AlloyDB for PostgreSQL9.2CNA v4.00.4%2026-05-12Fix
CVE-2026-7287Zyxel NWA1100-N firmware buffer overflow7.5CNA v3.10.6%2026-05-12
CVE-2026-7257Zyxel WRE6505 v2 firmware insecure storage of sensitive information4.4CNA v3.10.2%2026-05-12
CVE-2026-7256Zyxel WRE6505 v2 firmware OS command injection8.8CNA v3.12.7%2026-05-12
CVE-2026-7255Zyxel WRE6505 v2 firmware missing brute-force protection6.5CNA v3.10.3%2026-05-12
CVE-2026-7050Forms Rb WordPress plugin missing authorization authenticated arbitrary modification4.3CNA v3.10.5%2026-05-12
CVE-2026-6959Nomad vulnerable to arbitrary file read/write on client host through symlink attack6.0CNA v3.10.2%2026-05-12Fix
CVE-2026-6932Woo Commerce Minimum Weight WordPress plugin cross-site request forgery via settings update form4.3CNA v3.10.2%2026-05-12
CVE-2026-6913Shortcodely WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12
CVE-2026-6866Initialization of a resource with an insecure default vulnerability on EcoStruxure™ Panel Server8.2CNA v4.00.5%2026-05-12Fix
CVE-2026-6865Schneider Electric EasyLogic T150 and Saitel DP remote terminal units path traversal7.1CNA v4.00.4%2026-05-12Fix
CVE-2026-6813Continually WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-05-12
CVE-2026-6808Pricing Tables for WP WordPress plugin reflected cross-site scripting via page parameter6.1CNA v3.10.4%2026-05-12
CVE-2026-6800FastBots WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-05-12Fix
CVE-2026-6710Skysa Text Ticker App WordPress plugin cross-site request forgery to settings modification4.3CNA v3.10.2%2026-05-12
CVE-2026-6709Coinbase Commerce for Contact Form 7 WordPress plugin missing authorization4.3CNA v3.10.4%2026-05-12Fix
CVE-2026-6708HEL Online Classroom: AI-powered Online Classrooms WordPress plugin missing authorization5.3CNA v3.10.5%2026-05-12
CVE-2026-6690LifePress WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-05-12
CVE-2026-6663GWD Connect WordPress plugin unauthenticated limited code execution via update_agent4.8CNA v3.10.4%2026-05-12
CVE-2026-6402webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins5.3CNA v3.10.4%2026-05-12Fix
CVE-2026-6256Credits Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12Fix
CVE-2026-6247scratchblocks for WP WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12
CVE-2026-6237Quick Table WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12
CVE-2026-6001IDOR in ABIS Technology's BAPSİS8.8CNA v3.10.4%2026-05-12Fix
CVE-2026-5715Voyage Plus WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12
CVE-2026-5693Smart Appointment and Booking WordPress plugin unauthorized access5.3CNA v3.10.4%2026-05-12Fix
CVE-2026-5371MonsterInsights WordPress plugin unauthorized access7.1CNA v3.10.4%2026-05-12Fix
CVE-2026-5340Fancy Image Show WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12
CVE-2026-5146Devolutions Server notification management endpoints improper access control4.3CISA ADP v3.10.3%2026-05-12Fix
CVE-2026-5089YAML::Syck versions for Perl has an out-of-bounds read7.3CISA ADP v3.10.4%2026-05-12Fix
CVE-2026-5061HashiCorp consul-template file template helper link following4.7CNA v3.10.1%2026-05-12Fix
CVE-2026-5029RCE in Code Runner MCP Server8.7CNA v4.00.4%2026-05-12
CVE-2026-5028Eight Day Week Print Workflow for WordPress SQL injection6.5CNA v3.10.4%2026-05-12
CVE-2026-4920Next Date WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12
CVE-2026-4859SP Blog Designer WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-12
CVE-2026-4827Schneider Electric Easergy MiCOM C264 insufficient entropy vulnerability on multiple Products8.7CNA v4.00.4%2026-05-12Fix
CVE-2026-4301Rate Star Review Vote WordPress plugin missing authorization4.3CNA v3.10.4%2026-05-12Fix
CVE-2026-3604WP SEO Structured Data Schema WordPress plugin stored cross-site scripting4.9CNA v3.10.3%2026-05-12
CVE-2026-2993AI Chatbot and Workflow Automation by AIWU WordPress plugin SQL injection7.5CNA v3.10.7%2026-05-12Fix
CVE-2026-2465Improper authorization in E-Kalite's Turboard FOR-S8.8CNA v3.10.2%2026-05-12Fix
CVE-2026-2300BJ Lazy Load WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-05-12
CVE-2026-1934StyleMix Motors user profile update function missing authorization4.3CNA v3.10.2%2026-05-12Fix
CVE-2026-1681zephyrproject-rtos Zephyr net: Stack overflow with Ping (to own IP Address) via Shell6.1CNA v3.10.1%2026-05-12
CVE-2026-1250Court Reservation Manage Your Court Bookings Online WordPress plugin unauthenticated SQL injection7.5CNA v3.10.3%2026-05-12Fix
CVE-2026-1185Axis Communications AXIS OS incorrect permission assignment5.4CNA v3.10.2%2026-05-12Fix
CVE-2026-0804Axis Communications AXIS OS path traversal6.7CNA v3.10.1%2026-05-12Fix
CVE-2026-0802Axis Communications AXIS OS improper type validation6.0CNA v3.10.4%2026-05-12Fix
CVE-2026-0541Axis Communications AXIS OS incorrect permission assignment6.7CNA v3.10.1%2026-05-12Fix
CVE-2026-0502Cross-site request forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform5.4CNA v3.10.1%2026-05-12Fix
CVE-2026-45224Crabbox path traversal via Islo Provider Workspace Resolution6.8CNA v4.00.2%2026-05-11Fix
CVE-2026-45223Crabbox authentication bypass via Admin Claim injection7.7CNA v4.00.7%2026-05-11Fix
CVE-2026-45222Summarize Insecure Daemon Configuration File Permissions6.9CNA v4.00.1%2026-05-11Fix
CVE-2026-45026WeGIA: Stored XSS in html/atendido/processo_aceitacao.php6.8CNA v3.10.4%2026-05-11Fix
CVE-2026-45025WeGIA: Stored XSS in html/atendido/etapa_processo.php6.8CNA v3.10.4%2026-05-11Fix
CVE-2026-45006OpenClaw Unsafe Config Mutation via Gateway Tool Denylist Bypass7.7CNA v4.00.9%2026-05-11Fix
CVE-2026-45005OpenClaw Webhook Route Secret Cache not Invalidated after Rotation5.9CNA v4.00.5%2026-05-11Fix
CVE-2026-45004OpenClaw arbitrary code execution via setup-api.js in Current Working Directory8.4CNA v4.00.2%2026-05-11Fix
CVE-2026-45003OpenClaw Connector endpoint Host Override via Workspace dotenv files4.1CNA v4.00.1%2026-05-11Fix
CVE-2026-45002OpenClaw Hook Session-Key Bypass via Template Mapping6.3CNA v4.00.5%2026-05-11Fix
CVE-2026-45001OpenClaw Gateway Config Mutation Guard Bypass via agent Tool Access6.0CNA v4.00.4%2026-05-11Fix
CVE-2026-45000OpenClaw server-side request forgery via Browser CDP Profile Creation2.3CNA v4.00.4%2026-05-11Fix
CVE-2026-44999OpenClaw Improper Trust Labeling in Isolated Cron Awareness Events6.3CNA v4.00.2%2026-05-11Fix
CVE-2026-44998OpenClaw Tool Policy Bypass via Bundled MCP/LSP tools2.3CNA v4.01.2%2026-05-11Fix
CVE-2026-44997OpenClaw Security Envelope Constraint Bypass in ACP Child Sessions2.3CNA v4.00.4%2026-05-11Fix
CVE-2026-44996OpenClaw arbitrary Local File Read via Webchat Audio Embedding6.3CNA v4.00.4%2026-05-11Fix
CVE-2026-44995OpenClaw arbitrary code execution via MCP stdio Environment variables5.4CNA v4.00.2%2026-05-11Fix
CVE-2026-44994OpenClaw authentication bypass in Gateway Control UI Bootstrap Config endpoint6.3CNA v4.00.6%2026-05-11Fix
CVE-2026-44993OpenClaw Direct Message Misclassification in Feishu Card Actions2.3CNA v4.00.4%2026-05-11Fix
CVE-2026-44992OpenClaw MiniMax API Host Override via Workspace dotenv4.1CNA v4.00.2%2026-05-11Fix
CVE-2026-44991OpenClaw authorization bypass in Owner-Enforced commands via Wildcard Channel Senders2.3CNA v4.00.3%2026-05-11Fix
CVE-2026-44777jq module loader uncontrolled recursion5.4CNA v4.00.2%2026-05-11Fix
CVE-2026-44738Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray7.7CNA v3.10.4%2026-05-11Fix
CVE-2026-44737getgrav grav-plugin-admin grav: Stored XSS via page title (data[header][title]) in admin panel6.2CNA v4.00.4%2026-05-11Fix
CVE-2026-44695Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity5.8CNA v3.10.2%2026-05-11Fix
CVE-2026-44659zen-browser desktop Zen Browser Mac address bar spoofing via Long Subdomain4.7CNA v3.10.3%2026-05-11Fix
CVE-2026-44658Zen Browser RSS live folder improper input validation2.4CNA v3.10.3%2026-05-11Fix
CVE-2026-44643peerigon angular-expressions angular Expressions remote code execution using filters9.3CNA v4.00.7%2026-05-11Fix
CVE-2026-44413JetBrains TeamCity missing authentication8.2CNA v3.10.3%2026-05-11Fix
CVE-2026-44226pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI5.3CNA v3.10.4%2026-05-11Fix
CVE-2026-44201Wagtail: Improper restriction handling on Documents and Images API5.3CNA v3.10.3%2026-05-11Fix
CVE-2026-44200Wagtail: Improper permission handling when copying pages6.5CNA v3.10.3%2026-05-11Fix
CVE-2026-44199Wagtail: Improper permission handling when deleting form submissions6.5CNA v3.10.3%2026-05-11Fix
CVE-2026-44198Wagtail: Improper permission handling when viewing page history4.3CNA v3.10.3%2026-05-11Fix
CVE-2026-44197Wagtail: Improper permission handling when comparing revisions6.5CNA v3.10.3%2026-05-11Fix
CVE-2026-43995Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement failure)5.3CNA v4.00.5%2026-05-11Fix
CVE-2026-43969ninenines cowlib cookie request header injection via Unvalidated Encoder in cow_cookie:cookie/13.2NVD v3.10.2%2026-05-11Fix
CVE-2026-43968ninenines cowlib CR injection in SSE Encoder enables Event Splitting via cow_sse:event/14.0NVD v3.10.5%2026-05-11Fix
CVE-2026-43914Vaultwarden: Brute-force protection bypass7.3CNA v3.10.5%2026-05-11Exploit codeFix
CVE-2026-43913Vaultwarden: Unconfirmed Owner can Purge Entire Organization Vault8.1CNA v3.10.4%2026-05-11Fix
CVE-2026-43912Vaultwarden organization group management improper authorization8.7CNA v3.10.4%2026-05-11Fix
CVE-2026-43911Vaultwarden: Refresh tokens not invalidated on security stamp rotation6.8CNA v3.10.3%2026-05-11Fix
CVE-2026-43901bx33661 Wireshark-MCP wireshark MCP: Arbitrary file write6.8CNA v3.10.4%2026-05-11
CVE-2026-43900DeepChat: Persistent DOM XSS9.3CNA v3.10.5%2026-05-11Fix
CVE-2026-43899DeepChat: Incomplete Fix for leads to remote code execution9.6CNA v3.10.6%2026-05-11Fix
CVE-2026-43897OP-Engineering link-preview-js link Preview JS: Vunerable to IPv6 and internal loopback attacks8.7CNA v4.00.5%2026-05-11Fix
CVE-2026-43896jq object merge operator uncontrolled recursion6.2CNA v3.10.2%2026-05-11Fix
CVE-2026-43895jq module import resolver improper input validation4.4CNA v3.10.2%2026-05-11Fix
CVE-2026-43894jq decimal number parser vulnerability6.2CNA v3.10.2%2026-05-11Fix
CVE-2026-43893photostructure exiftool-vendored.js exiftool-vendored: Argument injection8.2CNA v3.10.5%2026-05-11Exploit codeFix
CVE-2026-43890Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents7.7CNA v3.10.3%2026-05-11Fix
CVE-2026-43889Outline: Unauthorized Document Publication via Mixed collectionId+documentId Share6.5CNA v3.10.4%2026-05-11Fix
CVE-2026-43888Outline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import8.7CNA v3.10.5%2026-05-11Fix
CVE-2026-43887Outline: Stored XSS via Comment Mentions7.3CNA v3.10.4%2026-05-11Fix
CVE-2026-43886Outline: OAuth Scope Validation logic error allows privilege escalation to Wildcard API Access8.2CNA v3.10.3%2026-05-11Fix
CVE-2026-43885WWBN AVideo: Exposure of sensitive information to an unauthorized actor and missing authorization7.7CNA v4.00.4%2026-05-11
CVE-2026-43884WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL7.7CNA v3.10.4%2026-05-11
CVE-2026-43883WWBN AVideo PayPalYPT plugin insecure direct object reference4.2CNA v3.10.3%2026-05-11
CVE-2026-43882WWBN AVideo Scheduler plugin ICS calendar export CRLF injection4.3CNA v3.10.3%2026-05-11
CVE-2026-43881WWBN AVideo users listing endpoint vulnerability5.3CNA v3.10.3%2026-05-11
CVE-2026-43880WWBN AVideo contact email endpoint vulnerability5.3CNA v3.10.4%2026-05-11
CVE-2026-43879WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook5.4CNA v3.10.3%2026-05-11
CVE-2026-43878WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php6.1CNA v3.10.3%2026-05-11
CVE-2026-43877WWBN AVideo profile photo upload endpoint cross-site request forgery5.4CNA v3.10.2%2026-05-11
CVE-2026-43876WWBN AVideo subscriber notification email template HTML injection6.4CNA v3.10.3%2026-05-11
CVE-2026-43875WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL enables account takeover6.8CNA v3.10.4%2026-05-11
CVE-2026-43874WWBN AVideo YPTSocket plugin message relay code injection7.2CNA v3.10.3%2026-05-11
CVE-2026-43873WWBN AVideo CloneSite plugin cloneClient endpoint information disclosure7.5CNA v3.10.4%2026-05-11
CVE-2026-43826Apache Airflow Providers OpenSearch task-log handler vulnerability6.5CISA ADP v3.10.7%2026-05-11Fix
CVE-2026-43668Apple macOS use-after-free7.5CISA ADP v3.10.8%2026-05-11Fix
CVE-2026-43666Apple macOS out-of-bounds write6.2CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-43661Apple macOS stack-based buffer overflow7.5CISA ADP v3.10.7%2026-05-11Fix
CVE-2026-43660Apple Safari protection mechanism failure7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-43659Apple macOS race condition4.7CISA ADP v3.10.1%2026-05-11Fix
CVE-2026-43658Apple Safari buffer overflow7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-43656Apple macOS out-of-bounds write7.3CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-43655Apple macOS out-of-bounds read7.3CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-43654Apple macOS system information disclosure7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-43653Apple macOS denial of service6.2CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-43652Apple macOS insecure permissions7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-43640Bitwarden Server authentication bypass via SCIM API Key8.6CNA v4.00.7%2026-05-11Fix
CVE-2026-43639Bitwarden Server missing authorization via Provider Clients9.1v3.10.8%2026-05-11Fix
CVE-2026-43638Bitwarden Server missing authorization via Organization Cipher Import5.3CNA v4.00.3%2026-05-11Fix
CVE-2026-43500Linux kernel rxrpc DATA and RESPONSE packet handling out-of-bounds write7.8CNA v3.12.6%2026-05-11Reported exploitedExploit codeKCVFix
CVE-2026-42888Audiobookshelf: Path traversal vulnerability in the audiobookshelf project6.9CNA v4.00.5%2026-05-11Fix
CVE-2026-42887Audiobookshelf: Stored cross-site scripting in Login Page Custom message4.5CNA v3.10.4%2026-05-11Fix
CVE-2026-42886Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload4.9CNA v3.10.4%2026-05-11Fix
CVE-2026-42885Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence4.3CNA v3.10.3%2026-05-11Fix
CVE-2026-42884Audiobookshelf: Collection endpoints bypass library access controls exposing restricted library data4.3CNA v3.10.3%2026-05-11Fix
CVE-2026-42883Audiobookshelf: Cross-library file exfiltration via unscoped bulk download endpoint6.5CNA v3.10.3%2026-05-11Fix
CVE-2026-42882Oxyno-zeta/s3-proxy: Security issues in Resource Path Matching9.4CNA v3.10.7%2026-05-11Fix
CVE-2026-42876external-secrets external Secrets Operator: Privilege escalation with secret overwriting4.9CNA v3.10.3%2026-05-11Fix
CVE-2026-42875External Secrets Operator CAProvider ConfigMap resolution improper authorization5.3CNA v4.00.4%2026-05-11Fix
CVE-2026-42874Microdot: HTTP response splitting in Response.set_cookie3.7CNA v3.10.3%2026-05-11Fix
CVE-2026-42873WeGIA: Error Handling Upload DocDependente0.0CNA v3.10.3%2026-05-11Fix
CVE-2026-42872WeGIA: Reflected XSS in listar_arquivos_etapa.php6.1CNA v3.10.3%2026-05-11Fix
CVE-2026-42871WeGIA: Error Handling familiar_docfamiliar6.9CNA v4.00.4%2026-05-11Fix
CVE-2026-42870WeGIA: Cross-site scripting (XSS) Stored endpoint informacao_adicional.php parameter descricao6.4CNA v4.00.4%2026-05-11Fix
CVE-2026-42869SOCFortress CoPilot JWT authentication hard-coded credentials10.0CNA v3.10.8%2026-05-11Fix
CVE-2026-42866Alfredredbird tookie-osint tookie: Arbitrary file write6.7CNA v4.00.2%2026-05-11Fix
CVE-2026-42865elie222 inbox-zero inbox Zero: Cross-account cleaner email stream exposure2.3CNA v4.00.3%2026-05-11Fix
CVE-2026-42864ManoManoTech FireFighter Jira bot endpoint server-side request forgery9.9CNA v3.10.5%2026-05-11Fix
CVE-2026-42860openedx edx-enterprise open edx Enterprise Service: SSRF8.5CNA v3.10.3%2026-05-11Fix
CVE-2026-42859any1 neatvnc neat VNC: Buffer overflow due to oversized RSA public keys8.1CNA v4.00.8%2026-05-11Fix
CVE-2026-42858openedx-platform Open edX Platform: Server-side request forgery in SAML Provider Data Sync endpoint8.5CNA v3.10.4%2026-05-11
CVE-2026-42857openedx-platform Open edX Platform: Stored CSS injection in Email Notifications4.6CNA v3.10.3%2026-05-11
CVE-2026-42856Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls8.7CNA v4.00.5%2026-05-11Fix
CVE-2026-42845Grav form plugin form file upload vulnerability7.7CNA v4.00.4%2026-05-11Fix
CVE-2026-42843getgrav grav-plugin-api Grav API privilege escalation to Super Admin8.8CNA v3.10.5%2026-05-11Fix
CVE-2026-42842Grav vulnerable to XSS via Taxonomy Field Values in Admin Panel5.4CNA v3.10.3%2026-05-11Fix
CVE-2026-42841Grav: Stored XSS via Markdown media attribute action in Grav CMS6.9CNA v4.00.3%2026-05-11Fix
CVE-2026-42613Grav: Privilege escalation via Missing Server-Side Validation of groups/access9.4CNA v3.10.6%2026-05-11Fix
CVE-2026-42612Grav: Publisher-Level stored XSS via Unquoted Event attributes8.5CNA v3.10.3%2026-05-11Fix
CVE-2026-42611Grav: Stored XSS via Tag injection8.9CNA v3.10.4%2026-05-11Fix
CVE-2026-42610Grav: Sensitive information disclosure via Accounts Service Bypass6.5CNA v3.10.4%2026-05-11Fix
CVE-2026-42609Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic8.1CNA v3.10.6%2026-05-11Fix
CVE-2026-42608Grav: Unauthenticated path traversal and arbitrary file write in FormFlash component8.8CNA v4.00.5%2026-05-11Fix
CVE-2026-42607Grav: Remote code execution (RCE) via Malicious Plugin ZIP upload in Direct Install feature9.1CNA v3.12.3%2026-05-11Exploit codeFix
CVE-2026-42603OWASP BLT: Pre-commit-fix.yaml executes untrusted fork code via pull_request_target8.8CNA v3.10.5%2026-05-11Fix
CVE-2026-42600MinIO: Path traversal via msgpack Body in `ReadMultiple` Storage-REST endpoint6.9CNA v4.00.5%2026-05-11Fix
CVE-2026-42565@workos/authkit-session: Open redirect via state-derived redirect target4.3CNA v3.10.3%2026-05-11Fix
CVE-2026-42564jotty app icon file handler path traversal8.2CNA v3.10.4%2026-05-11NucleiFix
CVE-2026-42554Fiber: XSS in AutoFormat Content Negotiation5.3CNA v4.00.3%2026-05-11Fix
CVE-2026-42349Clerk: Authorization bypass when combining organization, billing, or reverification checks7.6CNA v4.00.4%2026-05-11Fix
CVE-2026-42316KQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kusto5.9CNA v3.10.5%2026-05-11Fix
CVE-2026-42315pyLoad: Path traversal via Package Folder Name in set_package_data8.1CNA v3.10.5%2026-05-11Fix
CVE-2026-42314pyLoad: Path traversal via Package Folder Name6.5CNA v3.10.4%2026-05-11Fix
CVE-2026-42313pyLoad proxy settings API vulnerability8.3CNA v3.10.4%2026-05-11Fix
CVE-2026-42312Pyload-ng: Non-admin SETTINGS users can disable outbound TLS peer verification6.8CNA v3.10.2%2026-05-11Fix
CVE-2026-42188Geyser: Server-side request forgery (SSRF) via Player Head Texture URL2.4CNA v3.10.3%2026-05-11Fix
CVE-2026-42050ImageMagick: Stack buffer overflow in XTileImage5.5CNA v3.10.1%2026-05-11Fix
CVE-2026-42046cacalabs libcaca canvas import functions out-of-bounds write7.8CNA v3.10.3%2026-05-11Fix
CVE-2026-41951GROWI path traversal8.6CNA v4.00.6%2026-05-11
CVE-2026-41489Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks8.8CNA v3.10.2%2026-05-11Fix
CVE-2026-41431Zen Browser MAR updater improper signature verification8.0CNA v3.10.3%2026-05-11Fix
CVE-2026-41257jq VM data stack integer overflow6.4CNA v4.00.1%2026-05-11Fix
CVE-2026-41256jq program loader vulnerability5.5CNA v3.10.2%2026-05-11Fix
CVE-2026-41250taiga-front stored cross-site scripting5.7CNA v3.10.4%2026-05-11Fix
CVE-2026-41018Apache Airflow Providers Elasticsearch task log handler information disclosure6.5CISA ADP v3.10.7%2026-05-11Fix
CVE-2026-40636Dell ECS hard-coded credentials9.8CNA v3.10.3%2026-05-11Fix
CVE-2026-40612jq jv_contains function stack exhaustion5.4CNA v4.00.2%2026-05-11Fix
CVE-2026-39871Apple macOS files accessible to external parties7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-39870Apple macOS memory corruption7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-39869Apple macOS buffer overflow4.3CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-38569HireFlow resume and feedback comment fields vulnerability5.4CISA ADP v3.10.3%2026-05-11
CVE-2026-38568HireFlow candidate and interview record endpoints privilege escalation8.1CISA ADP v3.10.4%2026-05-11
CVE-2026-38567HireFlow login and search endpoints SQL injection9.8CISA ADP v3.10.7%2026-05-11
CVE-2026-38566HireFlow cross-site request forgery8.1CISA ADP v3.10.2%2026-05-11
CVE-2026-37630QuickJS-NG js_mapped_arguments_mark function code injection7.3CISA ADP v3.10.4%2026-05-11
CVE-2026-36983D-Link DCS-932L command injection7.3CISA ADP v3.12.3%2026-05-11
CVE-2026-36962MuuCMF T6 v1.9.4.20260115 SQL injection7.3CISA ADP v3.10.5%2026-05-11
CVE-2026-36906iotgateway v.3.0.1 cross-site scripting6.1CISA ADP v3.10.4%2026-05-11
CVE-2026-36734Edimax BR-6428nS WLAN configuration function command injection8.8CISA ADP v3.12.2%2026-05-11
CVE-2026-35157Dell ECS CSV injection5.8CNA v3.10.4%2026-05-11Fix
CVE-2026-34963barebox EFI PE Loader Memory Safety vulnerabilities7.8v3.10.2%2026-05-11Fix
CVE-2026-34962barebox ext4 Directory Parsing infinite loop denial of service5.5v3.10.2%2026-05-11Fix
CVE-2026-34961barebox ext4 Extent Parsing out-of-bounds read7.7v3.10.2%2026-05-11Fix
CVE-2026-34960barebox out-of-bounds read in DHCP Option Parsing7.1CNA v4.00.4%2026-05-11Fix
CVE-2026-34095Wikimedia Foundation MediaWiki action=raw response handling resource exposure0.0CNA v4.00.3%2026-05-11Fix
CVE-2026-34094Wikimedia Foundation MediaWiki page protection help link resource exposure2.0CNA v4.00.2%2026-05-11Fix
CVE-2026-34093Wikimedia Foundation MediaWiki Special:UserRights allows viewing user rights from private wiki1.1CNA v4.00.3%2026-05-11Fix
CVE-2026-34092Wikimedia Foundation MediaWiki information disclosure2.1CNA v4.00.3%2026-05-11Fix
CVE-2026-34091Wikimedia Foundation MediaWiki user localization leaked by AbuseFilter + EventStream5.5CNA v4.00.4%2026-05-11Fix
CVE-2026-34090Wikimedia Foundation CheckUser suggested investigations: Handle suppressed usernames4.8CNA v4.00.4%2026-05-11Fix
CVE-2026-34089Memory leak in Scribunto causes runJobs.php to run out of memory2.3CNA v4.00.4%2026-05-11Fix
CVE-2026-34088Wikimedia Foundation MediaWiki information disclosure1.3CNA v4.00.4%2026-05-11Fix
CVE-2026-34087Wikimedia Foundation OATHAuth information disclosure5.1CNA v4.00.4%2026-05-11Fix
CVE-2026-34086AbuseFilter misuses ::userCanBitfield, exposing access-controlled information2.1CNA v4.00.3%2026-05-11Fix
CVE-2026-33362Meari SDK hard-coded cryptographic keys8.6CNA v3.10.4%2026-05-11
CVE-2026-33361Meari weak XOR obfuscation7.5CNA v3.10.3%2026-05-11
CVE-2026-33359Meari unauthenticated alert image access in cloud object storage7.5CNA v3.10.5%2026-05-11Fix
CVE-2026-33357Meari OpenAPI device status IDOR7.5CNA v3.10.4%2026-05-11
CVE-2026-33356Meari MQTT broker missing per-device subscribe ACL7.7CNA v3.10.4%2026-05-11
CVE-2026-32658Dell Automation Platform missing authorization8.0CNA v3.10.3%2026-05-11Fix
CVE-2026-31254flash-attention Hydra configuration resolver code injection7.3CISA ADP v3.10.4%2026-05-11
CVE-2026-31253flash-attention checkpoint loading deserialization of untrusted data7.3CISA ADP v3.10.4%2026-05-11
CVE-2026-31252CosyVoice web UI model loading deserialization of untrusted data5.7CISA ADP v3.10.3%2026-05-11
CVE-2026-31251CosyVoice gRPC server model loading deserialization of untrusted data7.3CISA ADP v3.10.4%2026-05-11
CVE-2026-31250CosyVoice model averaging tool deserialization of untrusted data7.3CISA ADP v3.10.4%2026-05-11
CVE-2026-31249CosyVoice make_parquet_list data tool deserialization of untrusted data7.3CISA ADP v3.10.4%2026-05-11
CVE-2026-31248Docling's METS GBS backend is vulnerable to XML entity expansion (XXE) attacks7.5CISA ADP v3.10.5%2026-05-11
CVE-2026-31247Docling's JATS XML backend is vulnerable to XML entity expansion (XXE) attacks7.5CISA ADP v3.10.5%2026-05-11
CVE-2026-31246GPT-Pilot contains a command injection vulnerability in the Executor.run method6.5CISA ADP v3.11.1%2026-05-11
CVE-2026-30635Automagik-genie has a command injection8.1CISA ADP v3.11.4%2026-05-11
CVE-2026-28996Apple macOS race condition5.5CISA ADP v3.10.1%2026-05-11Fix
CVE-2026-28995Apple macOS improper privilege management8.8CISA ADP v3.10.2%2026-05-11Exploit codeFix
CVE-2026-28994Apple macOS use-after-free5.3CISA ADP v3.10.3%2026-05-11Fix
CVE-2026-28993Apple macOS improper access control5.5CISA ADP v3.10.1%2026-05-11Fix
CVE-2026-28992Apple macOS race condition4.7CISA ADP v3.10.1%2026-05-11Exploit codeFix
CVE-2026-28991Apple macOS out-of-bounds read7.5CISA ADP v3.10.6%2026-05-11Fix
CVE-2026-28990Apple macOS memory corruption7.5CISA ADP v3.10.5%2026-05-11Exploit codeFix
CVE-2026-28988Apple macOS insecure permissions5.5CISA ADP v3.10.1%2026-05-11Fix
CVE-2026-28987Apple macOS sensitive information in log files7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28986Apple macOS race condition7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28985Apple macOS null pointer dereference6.2CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28983Apple macOS type confusion7.5CISA ADP v3.10.8%2026-05-11Fix
CVE-2026-28978Apple macOS insecure permissions8.8CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28977Apple macOS memory corruption6.2CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28976Apple macOS improper privilege management7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28974Apple macOS unauthorized access7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28972Apple macOS out-of-bounds write6.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28971Apple Safari clickjacking4.3CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28969Apple macOS use-after-free7.5CISA ADP v3.10.6%2026-05-11Fix
CVE-2026-28967Apple iOS and iPadOS denial of service4.9CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28965Apple iOS and iPadOS improper access control7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28964Apple visionOS UI misrepresentation7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28963Apple iOS and iPadOS personal information exposure4.6CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28962Apple Safari information disclosure7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28961Apple macOS insufficiently protected credentials4.6CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28959Apple macOS buffer overflow7.5CISA ADP v3.10.7%2026-05-11Fix
CVE-2026-28958Apple Safari information disclosure5.5CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28957Apple visionOS improper access control3.3CISA ADP v3.10.1%2026-05-11Fix
CVE-2026-28956Apple macOS out-of-bounds read6.5CISA ADP v3.10.5%2026-05-11Exploit codeFix
CVE-2026-28955Apple Safari buffer overflow8.8CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28954Apple macOS authentication bypass by spoofing7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28953Apple Safari buffer overflow7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28952Apple macOS integer overflow7.5CISA ADP v3.10.6%2026-05-11Fix
CVE-2026-28951Apple macOS incorrect authorization7.8CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28947Apple Safari use-after-free8.8CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28946Apple Safari use-after-free6.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28944Apple Safari memory corruption7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28943Apple macOS sensitive information in log files7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28942Apple Safari use-after-free6.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28941Apple macOS denial of service7.1CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28940Apple macOS memory corruption8.8CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28936Apple macOS improper input validation7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28930Apple macOS insecure permissions7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28929Apple macOS logic flaw7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28925Apple macOS buffer overflow7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28924Apple macOS race condition7.5CISA ADP v3.10.3%2026-05-11Fix
CVE-2026-28923Apple macOS sensitive information in log files8.8CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28922Apple macOS information disclosure6.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28920Apple macOS information disclosure6.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28919Apple macOS improper privilege management7.8CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28918Apple macOS out-of-bounds read6.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28917Apple Safari denial of service4.3CISA ADP v3.10.3%2026-05-11Fix
CVE-2026-28915Apple macOS path traversal7.8CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28914Apple macOS improperly implemented security check5.5CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28913Apple Safari web content rendering denial of service7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28910Apple macOS improper access control3.3CISA ADP v3.10.1%2026-05-11Fix
CVE-2026-28908Apple macOS denial of service7.5CISA ADP v3.10.6%2026-05-11Fix
CVE-2026-28907Apple Safari improper output encoding8.1CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28906Apple macOS personal information exposure7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28905Apple Safari buffer overflow7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28904Apple Safari buffer overflow7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28903Apple Safari buffer overflow6.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28902Apple Safari buffer overflow6.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28901Apple Safari buffer overflow4.3CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28897Apple macOS stack-based buffer overflow6.2CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28883Apple Safari use-after-free7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28873Apple iOS and iPadOS incorrect authorization7.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-28872Apple iOS and iPadOS resource exhaustion7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28860Apple macOS improper input validation7.5CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28848Apple macOS stack-based buffer overflow7.5CISA ADP v3.10.6%2026-05-11Fix
CVE-2026-28847Apple Safari buffer overflow8.8CISA ADP v3.10.5%2026-05-11Fix
CVE-2026-28846Apple macOS stack-based buffer overflow7.5CISA ADP v3.10.9%2026-05-11Fix
CVE-2026-28840Apple macOS improper privilege management7.8CISA ADP v3.10.2%2026-05-11Fix
CVE-2026-28830Apple macOS race condition4.7CISA ADP v3.10.1%2026-05-11Fix
CVE-2026-28819Apple macOS out-of-bounds write5.4CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-26946Dell ECS improper privilege management6.7CNA v3.10.2%2026-05-11Fix
CVE-2026-20696Apple macOS missing authorization5.5CISA ADP v3.10.1%2026-05-11Fix
CVE-2026-8345D-Link DIR-816 singlePortForward sub_445E7C command injection8.8v3.15.0%2026-05-11
CVE-2026-8344D-Link DIR-816 formDMZ.cgi sub_445E7C command injection8.8v3.15.0%2026-05-11
CVE-2026-8321inkeep agents runAuth Middleware runAuth.ts createDevContext authentication bypass6.9CNA v4.00.7%2026-05-11
CVE-2026-8320jishenghua jshERP getUserByWeixinCode endpoint server-side request forgery5.1CNA v4.00.4%2026-05-11
CVE-2026-8319aiwaves-cn agents cheshire_cat_core resource exhaustion6.9CNA v4.00.6%2026-05-11
CVE-2026-8318VectifyAI PageIndex PDF Table of Contents page_index.py toc_transformer infinite loop6.9CNA v4.00.6%2026-05-11
CVE-2026-8305OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authentication9.8v3.11.1%2026-05-11Fix
CVE-2026-8292Open5GS NRF conv.c yuarel_parse denial of service6.5v3.10.7%2026-05-11
CVE-2026-8291Open5GS NRF nnrf-handler.c ogs_nnrf_nfm_handle_nf_profile denial of service6.5v3.10.7%2026-05-11
CVE-2026-8290Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service6.5v3.10.7%2026-05-11
CVE-2026-8289Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service6.5v3.10.7%2026-05-11
CVE-2026-8288Open5GS SMF gsm-handler.c denial of service6.5v3.10.7%2026-05-11
CVE-2026-8276bettercap MySQL Server mysql_server.go integer coercion6.3CNA v4.00.6%2026-05-11Fix
CVE-2026-8275bettercap zerogod IPP service zerogod_ipp_primitives.go ippReadChunkedBody integer coercion6.3CNA v4.00.6%2026-05-11Fix
CVE-2026-8274npitre cramfs-tools Directory cramfsck.c do_directory path traversal4.8CNA v4.00.2%2026-05-11Fix
CVE-2026-8273D-Link DNS-320 system_mgr.cgi cgi_merge_user os command injection7.2v3.16.1%2026-05-11Emerging Threats
CVE-2026-8272D-Link DNS-320 webfile_mgr.cgi chown os command injection7.2v3.16.0%2026-05-11
CVE-2026-8271D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injection7.2v3.16.1%2026-05-11
CVE-2026-8270Open5GS SMF ogs_nas_parse_qos_rules denial of service6.5v3.10.7%2026-05-11
CVE-2026-8269Open5GS SMF smf_nsmf_handle_create_sm_context denial of service6.5v3.10.7%2026-05-11
CVE-2026-8268Open5GS SMF OpenAPI_list_create denial of service6.5v3.10.7%2026-05-11
CVE-2026-8267Open5GS SMF smf_nsmf_handle_created_data_in_vsmf denial of service6.5v3.10.7%2026-05-11
CVE-2026-8266Open5GS SMF gsm-build.c gsm_build_pdu_session_establishment_accept denial of service6.5v3.10.7%2026-05-11
CVE-2026-8265Tenda AC6 httpd getLogFile get_log_file os command injection7.2v3.18.3%2026-05-11
CVE-2026-8264Tenda AC6 httpd WifiApScan formWifiApScan os command injection8.8v3.16.5%2026-05-11
CVE-2026-8263Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection9.8v3.18.7%2026-05-11
CVE-2026-8262Devs Palace ERP Online chart-save cross-site scripting4.8CNA v4.00.4%2026-05-11
CVE-2026-8261Squirrel sqobject.cpp Load heap-based overflow5.1CNA v4.00.2%2026-05-11
CVE-2026-8260D-Link DCS-935L HNAP service hnap_service SetDeviceSettings buffer overflow8.7CNA v4.01.2%2026-05-11
CVE-2026-8259Tenda AC6 httpd telnet os command injection7.2v3.18.3%2026-05-11
CVE-2026-8258Squirrel sqstdstring.cpp validate_format stack-based overflow4.8CNA v4.00.2%2026-05-11
CVE-2026-8257WebAssembly Binaryen BrOn wasm-ir-builder.cpp makeBrOn assertion5.5v3.10.2%2026-05-11Fix
CVE-2026-8256Devs Palace ERP Online mr-save cross-site scripting4.8CNA v4.00.4%2026-05-11
CVE-2026-8255Devs Palace ERP Online add_new_customer cross-site scripting4.8CNA v4.00.4%2026-05-11
CVE-2026-8254Devs Palace ERP Online sales_save cross-site scripting4.8CNA v4.00.4%2026-05-11
CVE-2026-8253Devs Palace ERP Online purchase_save cross-site scripting4.8CNA v4.00.4%2026-05-11
CVE-2026-8252Open5GS SMF smf_nsmf_handle_create_data_in_hsmf null pointer dereference6.5v3.10.7%2026-05-11
CVE-2026-7820pgAdmin 4: Account-lockout bypass via Flask-Security default /login view6.9CNA v4.00.3%2026-05-11Fix
CVE-2026-7819pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write7.2CNA v4.00.5%2026-05-11Fix
CVE-2026-7818pgAdmin 4: Unsafe deserialization in file-backed session manager leads to remote code execution7.3CNA v4.00.4%2026-05-11Fix
CVE-2026-7817pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints7.1CNA v4.00.3%2026-05-11Fix
CVE-2026-7816pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout8.7CNA v4.02.2%2026-05-11Fix
CVE-2026-7815pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution8.7CNA v4.00.6%2026-05-11Fix
CVE-2026-7814pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer4.8CNA v4.00.2%2026-05-11Fix
CVE-2026-7813pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode9.4CNA v4.00.7%2026-05-11Fix
CVE-2026-7790Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS7.5NVD v3.10.8%2026-05-11Fix
CVE-2026-7308Nexus Repository 3 stored cross-site scripting (XSS) via HTML Browse page5.1CNA v4.00.4%2026-05-11Fix
CVE-2026-7210Python CPython expat XML parser insufficient entropy6.3CNA v4.01.4%2026-05-11Fix
CVE-2026-7010HAARG HTTP::Tiny HTTP response splitting6.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-6956Reflected XSS in ATutor5.1CNA v4.00.6%2026-05-11
CVE-2026-6909Reflected XSS in ATutor5.1CNA v4.00.6%2026-05-11
CVE-2026-6815Casdoor: Arbitrary file write possible through Local File System storage provider5.9CISA ADP v3.10.6%2026-05-11Exploit code
CVE-2026-6433Custom CSS JS PHP WordPress plugin unauthenticated SQL injection to RCE7.3CISA ADP v3.10.8%2026-05-11NucleiExploit code
CVE-2026-6146Amazon::Credentials versions for Perl uses rand to generate encryption keys5.3CISA ADP v3.10.3%2026-05-11Fix
CVE-2026-6093Corteza SQL injection in MSSQL JSON-path meta filter via incorrect T-SQL string escaping6.0CNA v4.00.3%2026-05-11
CVE-2026-5266Wikimedia Foundation Echo information disclosure2.3CNA v4.00.4%2026-05-11Fix
CVE-2026-5172dnsmasq buffer overflow7.3CISA ADP v3.10.7%2026-05-11Exploit codeFix
CVE-2026-5084WebDyne::Session versions for Perl generate the session id insecurely6.5CISA ADP v3.10.4%2026-05-11Fix
CVE-2026-4893dnsmasq An information disclosure5.3CISA ADP v3.10.6%2026-05-11Exploit codeFix
CVE-2026-4892dnsmasq DHCPv6 implementation out-of-bounds write8.4CISA ADP v3.10.3%2026-05-11Fix
CVE-2026-4891dnsmasq DNSSEC validation out-of-bounds read5.3CISA ADP v3.10.8%2026-05-11Fix
CVE-2026-4890dnsmasq DNSSEC validation denial of service7.5CISA ADP v3.11.1%2026-05-11Fix
CVE-2026-4802Red Hat Enterprise Linux 10 cockpit: Cockpit: Arbitrary command execution8.0CNA v3.11.2%2026-05-11Exploit codeFix
CVE-2026-3609XIGNCODE3 xhunter1.sys kernel driver contains a privilege escalation7.8v3.10.2%2026-05-11Exploit code
CVE-2026-3320e-commerce Cradle latest demo version of the reflected cross-site scripting5.1CNA v4.00.4%2026-05-11Fix
CVE-2026-3319e-commerce Cradle latest demo version of the reflected cross-site scripting5.1CNA v4.00.4%2026-05-11Fix
CVE-2026-3048Nexus Repository 3 Improper LDAP Referral Handling5.1CNA v4.00.3%2026-05-11Fix
CVE-2026-2614Arbitrary file read via Prompt Tag Source Validation Bypass in MLflow/MLflow7.5CNA v3.03.2%2026-05-11NucleiFix
CVE-2026-2393Server-side request forgery (SSRF) in MLflow/MLflow7.1CNA v3.00.3%2026-05-11Fix
CVE-2026-2291dnsmasq extract_name DNS parser buffer overflow7.3CISA ADP v3.10.6%2026-05-11Exploit codeFix
CVE-2026-1677zephyrproject-rtos Zephyr net: TLS 1.2 connections allowed on TLS 1.3 sockets5.3CNA v3.10.2%2026-05-11
CVE-2026-45191Net::CIDR::Lite improper input validation6.5CISA ADP v3.10.5%2026-05-10Fix
CVE-2026-45190Net::CIDR::Lite improper input validation6.5CISA ADP v3.10.5%2026-05-10Fix
CVE-2026-45186libexpat algorithmic complexity7.5NVD v3.10.5%2026-05-10Fix
CVE-2026-45180Catalyst::Plugin::Statsd versions for Perl may leak session ids7.5CISA ADP v3.10.4%2026-05-10Fix
CVE-2026-45179Plack::Middleware::Statsd versions for Perl may leak user IP addresses5.3CISA ADP v3.10.3%2026-05-10Fix
CVE-2026-8251Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service6.5v3.10.7%2026-05-10
CVE-2026-8250Open5GS SMF n4-build.c smf_n4_build_qos_flow_to_modify_list denial of service6.5v3.10.7%2026-05-10
CVE-2026-8249Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service6.5v3.10.7%2026-05-10
CVE-2026-8248Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of service6.5v3.10.7%2026-05-10
CVE-2026-8244Industrial Application Software IAS Canias ERP Login RMI improper authentication6.9CNA v4.00.7%2026-05-10
CVE-2026-8243Industrial Application Software IAS Canias ERP JNLP Deployment endpoint hard-coded key6.9CNA v4.00.5%2026-05-10
CVE-2026-8242Industrial Application Software IAS Canias ERP Login RMI doAction response discrepancy6.3CNA v4.00.4%2026-05-10
CVE-2026-8241Industrial Application Software IAS Canias ERP RMI iasGetServerInfoEvent improper authorization6.9CNA v4.00.5%2026-05-10
CVE-2026-82358421bit MiniClaw System kernel.ts resolveSkillScriptPath os command injection5.1CNA v4.03.6%2026-05-10
CVE-2026-8234EFM ipTIME A8004T WifiBasicSet formWifiBasicSet stack-based overflow8.7CNA v4.00.8%2026-05-10
CVE-2026-8233Dotouch XproUPF improper access control2.1CNA v4.00.2%2026-05-10
CVE-2026-8232Dotouch XproUPF UPF Process libvlib.so vlib_worker_loop denial of service5.1CNA v4.00.3%2026-05-10
CVE-2026-8231CodeAstro Online Catering Ordering System deleteorder.php SQL injection5.3CNA v4.00.3%2026-05-10
CVE-2026-8230Wavlink NU516U1 login.cgi sys_login1 os command injection8.8v3.18.5%2026-05-10
CVE-2026-8229Wavlink NU516U1 wireless.cgi WifiBasic os command injection8.8v3.18.5%2026-05-10
CVE-2026-8228Wavlink NU516U1 wireless.cgi advance os command injection8.8v3.18.5%2026-05-10
CVE-2026-8227Wavlink NU516U1 adm.cgi wzdapMesh os command injection8.8v3.18.5%2026-05-10
CVE-2026-8226Open5GS types.c ogs_pcc_rule_install_flow_from_media denial of service7.5v3.10.9%2026-05-10
CVE-2026-8225Open5GS delete endpoint sm-sm.c pcf_npcf_smpolicycontrol_handle_delete denial of service7.5v3.10.9%2026-05-10
CVE-2026-8224Open5GS PCF context.c pcf_sess_set_ipv6prefix denial of service7.5v3.10.9%2026-05-10
CVE-2026-8223Open5GS sm-policies endpoint pcf_sess_sbi_discover_and_send denial of service7.5v3.10.9%2026-05-10
CVE-2026-8222Open5GS sm-policies endpoint nbsf-handler.c pcf_nbsf_management_handle_register denial of service7.5v3.10.9%2026-05-10
CVE-2026-8221Devs Palace ERP Online item-save cross-site scripting4.8CNA v4.00.4%2026-05-10
CVE-2026-8220Devs Palace ERP Online customer-save endpoint cross-site scripting4.8CNA v4.00.4%2026-05-10
CVE-2026-8219Devs Palace ERP Online supplier-save cross-site scripting4.8CNA v4.00.4%2026-05-10
CVE-2026-8218Devs Palace ERP Online purchase_return_save cross-site scripting4.8CNA v4.00.4%2026-05-10
CVE-2026-8217Industrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injection5.3CNA v4.02.4%2026-05-10
CVE-2026-8216Industrial Application Software Canias ERP Java RMI session management improper authentication6.9CNA v4.00.7%2026-05-10
CVE-2026-8215Industrial Application Software IAS Canias ERP RMI iasRequestFileEvent path traversal6.9CNA v4.00.8%2026-05-10
CVE-2026-8214Industrial Application Software IAS Canias ERP RMI doAction improper authentication6.9CNA v4.00.7%2026-05-10
CVE-2026-8177XML::LibXML DOM node-name parser out-of-bounds read7.5CISA ADP v3.10.9%2026-05-10Fix
CVE-2026-7568PHP signed integer overflow in metaphone6.3CNA v4.00.8%2026-05-10Fix
CVE-2026-7263PHP DoS attack via DOMNode::C14N6.3CNA v4.00.6%2026-05-10Fix
CVE-2026-7262PHP SOAP apache:Map decoder null pointer dereference2.9CNA v4.01.0%2026-05-10Fix
CVE-2026-7261PHP SoapServer session-persisted object use-after-free via SOAP header fault6.3CNA v4.00.5%2026-05-10Fix
CVE-2026-7259PHP null pointer dereference in php_mb_check_encoding via mb_ereg_search_init2.1CNA v4.00.3%2026-05-10Fix
CVE-2026-7258PHP out-of-bounds read in urldecode on NetBSD6.3CNA v4.00.4%2026-05-10Fix
CVE-2026-6735PHP XSS within PHP-FPM status endpoint7.3CNA v4.00.3%2026-05-10Fix
CVE-2026-6722PHP use-after-free in SOAP using Apache map9.5CNA v4.01.3%2026-05-10Fix
CVE-2026-6104PHP global buffer over-read in mb_convert_encoding with attacker-supplied encoding6.3CNA v4.00.6%2026-05-10Fix
CVE-2026-45184Kdenlive inclusion of untrusted functionality6.5CNA v3.10.2%2026-05-09Fix
CVE-2026-45182GrapheneOS confused deputy2.2CNA v3.10.1%2026-05-09Fix
CVE-2026-45181Hex-Rays IDA argument injection6.5CNA v3.10.2%2026-05-09Fix
CVE-2026-44313LinkWarden: Server-side request forgery (SSRF) in Link Creation via fetchTitleAndHeaders function9.1CNA v3.10.3%2026-05-09Fix
CVE-2026-42606AzuraCast password reset flow vulnerability8.1CNA v3.10.6%2026-05-09Fix
CVE-2026-42605AzuraCast: Path traversal in `currentDirectory` parameter enables remote code execution8.8CNA v3.11.0%2026-05-09Fix
CVE-2026-42601ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView9.3CNA v4.00.6%2026-05-09
CVE-2026-42576apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery6.5CNA v3.10.5%2026-05-09Fix
CVE-2026-42575apko doesn't verify downloaded apk packages against APKINDEX checksum7.5CNA v3.10.2%2026-05-09Fix
CVE-2026-42574Chainguard apko dirFS build root extraction path traversal7.5CNA v3.10.5%2026-05-09Fix
CVE-2026-42571Privilege escalation Attack affecting Pelican Web UI9.0CNA v4.00.4%2026-05-09Fix
CVE-2026-42569phpVMS has an /importer authorization bypass causing full database wipe9.4CNA v3.11.3%2026-05-09NucleiExploit codeFix
CVE-2026-42562Plainpad: Privilege escalation via Writable Admin field in Profile Update (Access Control)8.3CNA v3.10.5%2026-05-09Fix
CVE-2026-42560auth library Patreon OAuth provider improper authentication9.1CNA v3.10.6%2026-05-09Fix
CVE-2026-42461Arcane vulnerable to Unauthenticated Disclosure of Custom Compose Template Content8.7CNA v4.01.5%2026-05-09NucleiFix
CVE-2026-42455LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin)8.8CNA v4.00.6%2026-05-09
CVE-2026-42333Quarkiverse Quarkus OpenAPI Generator generated authentication filter information disclosure6.3CNA v4.00.7%2026-05-09Fix
CVE-2026-42311Pillow: OOB write with Invalid PSD Tile Extents (integer overflow)8.6CNA v4.00.2%2026-05-09Fix
CVE-2026-42310Pillow: PDF Parsing Trailer infinite loop (DoS)5.1CNA v4.00.2%2026-05-09Fix
CVE-2026-42309Pillow: Heap buffer overflow with nested list coordinates5.1CNA v4.00.2%2026-05-09Fix
CVE-2026-42308Pillow: Integer overflow when processing fonts5.1CNA v4.00.2%2026-05-09Fix
CVE-2026-42301Improper input validation leading to improper control of generation of code in pyp2spec7.8CNA v3.10.2%2026-05-09Fix
CVE-2026-42297argoproj argo-workflows Argo Workflows is missing authorization in Sync ConfigMap Provider8.5CNA v4.00.5%2026-05-09Fix
CVE-2026-42296Argo Workflows templateReferencing Strict mode vulnerability8.1CNA v3.10.5%2026-05-09Fix
CVE-2026-42295argoproj argo-workflows argo Workflows: Exposure of artifact repository credentials8.5CNA v4.00.4%2026-05-09Fix
CVE-2026-42294argoproj argo-workflows Argo Workflows: Unauthenticated memory exhaustion in Webhook Interceptor8.2CNA v4.00.7%2026-05-09Fix
CVE-2026-42258net-imap vulnerable to command injection via unvalidated Symbol inputs5.8CNA v4.01.3%2026-05-09Fix
CVE-2026-42257net-imap vulnerable to command injection via raw arguments to multiple commands5.8CNA v4.00.5%2026-05-09Fix
CVE-2026-42256net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication6.0CNA v4.00.5%2026-05-09Fix
CVE-2026-42246net-imap vulnerable to STARTTLS stripping via invalid response timing7.6CNA v4.00.3%2026-05-09Fix
CVE-2026-42245net-imap has quadratic complexity when reading response literals2.3CNA v4.00.7%2026-05-09Fix
CVE-2026-42183argoproj argo-workflows Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS2.3CNA v4.00.6%2026-05-09Fix
CVE-2026-42174Kirby: User avatar creation, replacement and deletion are not gated by user update permissions5.3CNA v4.00.3%2026-05-09Fix
CVE-2026-42137Kirby REST API and Panel access permissions missing authorization7.1CNA v4.00.4%2026-05-09Fix
CVE-2026-42069Kirby: Read access to site, user and role information is not gated by permissions7.1CNA v4.00.4%2026-05-09Fix
CVE-2026-42051Kirby: System API endpoint leaks license data and installed version to authenticated users5.3CNA v4.00.3%2026-05-09Fix
CVE-2026-41893Signal K Server WebSocket login endpoint vulnerability8.7CNA v4.00.5%2026-05-09Fix
CVE-2026-41705Spring AI's MilvusVectorStore#doDelete implementation is vulnerable to filter-expression injection8.6CNA v3.10.4%2026-05-09Fix
CVE-2026-41311LiquidJS is vulnerable to denial of service via circular block reference in layout7.5CNA v3.10.6%2026-05-09Fix
CVE-2026-41163bubblewrap vulnerable to privilege escalation in setuid mode via ptrace8.7CNA v4.00.4%2026-05-09Fix
CVE-2026-32683EZVIZ APP cleartext transmission of sensitive information5.3CNA v3.10.1%2026-05-09
CVE-2026-8213OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow5.5v3.10.2%2026-05-09Fix
CVE-2026-8212OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow5.5v3.10.2%2026-05-09Fix
CVE-2026-8211codelibs Fess JSP File AdminDesignAction.java update code injection5.1CNA v4.00.4%2026-05-09
CVE-2026-8210aandrew-me tgpt Update helper.go helper.update command injection4.8CNA v4.01.4%2026-05-09
CVE-2026-8209Adobe Gibbon path traversal6.9CNA v4.00.4%2026-05-09Fix
CVE-2026-8208Adobe Gibbon local file inclusion8.9CNA v4.00.4%2026-05-09Fix
CVE-2026-8207Adobe Gibbon SQL injection7.0CNA v4.00.4%2026-05-09Fix
CVE-2026-8198Activity Logs WordPress plugin authentication bypass5.3CNA v3.10.6%2026-05-09Fix
CVE-2026-8196JeecgBoot mLogin Endpoint LoginController.java authorization6.3CNA v4.00.5%2026-05-09Exploit code
CVE-2026-8195JeecgBoot SVG File CommonController.java cross-site scripting5.3CNA v4.00.4%2026-05-09
CVE-2026-8194osTicket Dispatcher class.dispatcher.php cross-site request forgery5.3CNA v4.00.2%2026-05-09
CVE-2026-8193Akaunting Invoice PDF Rendering dompdf.php server-side request forgery5.3CNA v4.00.3%2026-05-09
CVE-2026-8192Wavlink NU516U1 adm.cgi wzdap os command injection8.8v3.18.5%2026-05-09
CVE-2026-8191Wavlink NU516U1 adm.cgi wifi_region os command injection8.8v3.18.5%2026-05-09
CVE-2026-8190Wavlink NU516U1 adm.cgi wan os command injection8.8v3.18.5%2026-05-09
CVE-2026-8189Wavlink NU516U1 adm.cgi wzdrepeater os command injection8.8v3.18.5%2026-05-09
CVE-2026-8188Wavlink NU516U1 adm.cgi change_wifi_password os command injection8.8v3.18.5%2026-05-09
CVE-2026-8187Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption7.5v3.10.9%2026-05-09
CVE-2026-8186Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-bounds7.5v3.10.9%2026-05-09
CVE-2026-8185UGREEN CM933 Administrative missing authentication5.3CNA v4.00.4%2026-05-09
CVE-2026-7652LatePoint WordPress plugin unauthenticated account takeover via weak password recovery Mechanism5.3CNA v3.10.7%2026-05-09Fix
CVE-2026-6667PgBouncer missing authorization check in KILL_CLIENT admin command4.3CNA v3.10.3%2026-05-09Fix
CVE-2026-6666PgBouncer crash in kill_pool_logins_server_error5.9CNA v3.10.4%2026-05-09Fix
CVE-2026-6665PgBouncer buffer overflow in SCRAM8.1CNA v3.10.4%2026-05-09Fix
CVE-2026-6664PgBouncer integer overflow in PgBouncer network packet parsing7.5CNA v3.10.7%2026-05-09Exploit codeFix
CVE-2026-3828Hikvision DS-3E1310P-SI OS command injection7.2CNA v3.11.1%2026-05-09
CVE-2026-1749Hikvision HikCentral Professional some improper access control6.8CNA v3.10.3%2026-05-09
CVE-2026-45130Vim: Heap buffer overflow in spell file loading6.6CNA v3.10.2%2026-05-08Fix
CVE-2026-44987SysReptor: Privilege escalation from User Admin to Superuser3.8CNA v3.10.3%2026-05-08Fix
CVE-2026-44928uriparser incorrect control flow5.3v3.10.2%2026-05-08Fix
CVE-2026-44927uriparser numeric truncation5.3v3.10.2%2026-05-08Fix
CVE-2026-44916OpenStack Ironic server-side template injection3.0CNA v3.10.4%2026-05-08Fix
CVE-2026-44694n8n-MCP: Authenticated SSRF in N8n-mcp webhook and API client paths7.2CNA v4.00.3%2026-05-08Fix
CVE-2026-44656Vim: OS command injection via path completion4.6CNA v4.00.8%2026-05-08Exploit codeFix
CVE-2026-44500ZEBRA: Allocation Amplification in Inbound Network Deserializers5.3CNA v3.10.4%2026-05-08Fix
CVE-2026-44499ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning8.7CNA v4.00.5%2026-05-08Fix
CVE-2026-44498ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops9.2CNA v4.00.4%2026-05-08Fix
CVE-2026-44497ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer9.3CNA v4.00.3%2026-05-08Fix
CVE-2026-44400MailEnable Enterprise Premium authorization bypass via WebAdmin9.8v3.10.6%2026-05-08Fix
CVE-2026-44340PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`8.7CNA v4.00.5%2026-05-08Fix
CVE-2026-44339PraisonAI tool execution resolution unsafe reflection8.6CNA v3.10.4%2026-05-08Fix
CVE-2026-44338PraisonAI legacy API server missing authentication7.3CNA v3.10.8%2026-05-08NucleiExploit codeFix
CVE-2026-44337PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries6.3CNA v3.10.3%2026-05-08Fix
CVE-2026-44336PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection9.4CNA v4.00.7%2026-05-08Fix
CVE-2026-44335SSRF bypass in PraisonAI7.7CNA v4.00.6%2026-05-08Fix
CVE-2026-44334PraisonAI: Unauthenticated RCE via `tool_override.py`8.4CNA v3.10.2%2026-05-08Fix
CVE-2026-44298Kimai: Arbitrary file read in invoice PDF renderer (admin)4.1CNA v3.10.4%2026-05-08Fix
CVE-2026-44286FastGPT: SSRF vulnerability in Laf Workflow Node via Missing Internal Address Validation2.3CNA v4.00.4%2026-05-08Fix
CVE-2026-44284FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution6.3CNA v3.10.4%2026-05-08Fix
CVE-2026-44129SEPPmail Secure Email Gateway server-side template injection8.3CNA v4.00.7%2026-05-08Fix
CVE-2026-44128SEPPmail Secure Email Gateway unauthenticated remote code execution9.3CNA v4.00.7%2026-05-08Emerging ThreatsFix
CVE-2026-44127SEPPmail Secure Email Gateway local file inclusion (LFI) and arbitrary file deletion8.8CNA v4.00.5%2026-05-08Emerging ThreatsFix
CVE-2026-44126SEPPmail Secure Email Gateway insecure deserialization9.2CNA v4.00.8%2026-05-08Fix
CVE-2026-44125SEPPmail Secure Email Gateway missing authorization in GINAv29.3CNA v4.00.5%2026-05-08Fix
CVE-2026-43967Quadratic fragment-name uniqueness check causes denial of service in absinthe8.7CNA v4.00.8%2026-05-08Fix
CVE-2026-43944Electerm users can run dangrous code through link or command line9.4CNA v4.00.6%2026-05-08Fix
CVE-2026-43943Electerm Security vulnerability: RCE via malicious SSH server filename in openFileWithEditor7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43942Electerm's full process.env exposed to renderer via window.pre.env5.5CNA v3.10.1%2026-05-08Fix
CVE-2026-43941electerm terminal hyperlink handler argument injection9.6CNA v3.10.5%2026-05-08Fix
CVE-2026-43940Electerm runWidget has a path traversal that leads to arbitrary code execution8.4CNA v3.10.2%2026-05-08Fix
CVE-2026-43475Linux kernel storvsc Hyper-V storage driver vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43474Linux kernel fs uninitialized resource use5.5v3.10.1%2026-05-08Fix
CVE-2026-43473Linux kernel mpi3mr storage controller driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43472Linux kernel namespace unsharing vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43471Linux kernel UFS storage driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43470In the Linux kernel, the following vulnerability has been resolved: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir If we found an alias through nfs3_do_create/nfs_add_or_obtain /d_splice_alias which happens to be a dir dentry, we don't return any error, and simply forget about this ali5.5v3.10.1%2026-05-08Fix
CVE-2026-43469In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decrement re_receiving on the early exit paths In the event that rpcrdma_post_recvs() fails to create a work request (due to memory allocation failure, say) or otherwise exits early, we should decrement ep->re_receiving7.5CNA v3.10.5%2026-05-08Fix
CVE-2026-43468Linux kernel mlx5 eswitch driver deadlock5.5v3.10.1%2026-05-08Fix
CVE-2026-43467Linux kernel net/mlx5 crash5.5v3.10.1%2026-05-08Fix
CVE-2026-43466Linux kernel mlx5e DMA FIFO recovery vulnerability8.2CNA v3.10.6%2026-05-08Fix
CVE-2026-43465Linux kernel mlx5e XDP multi-buffer handling vulnerability9.8CNA v3.10.4%2026-05-08Fix
CVE-2026-43464Linux kernel mlx5e XDP multi-buffer handling vulnerability7.5CNA v3.10.8%2026-05-08Fix
CVE-2026-43463Linux kernel AFS RxRPC peer lookup null pointer dereference5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43462Linux kernel spacemit EMAC driver vulnerability7.5CNA v3.10.6%2026-05-08Fix
CVE-2026-43461Linux kernel spifc-a4 SPI driver vulnerability7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43460Linux kernel rockchip-sfc SPI driver double free7.8v3.10.1%2026-05-08Fix
CVE-2026-43459Linux kernel ASoC sound card core use-after-free7.3CNA v3.10.2%2026-05-08Fix
CVE-2026-43458Linux kernel CAIF serial line discipline use-after-free7.8v3.10.1%2026-05-08Fix
CVE-2026-43457Linux kernel MCTP I2C driver memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43456Linux kernel bonding driver type confusion7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43455Linux kernel MCTP routing race condition5.5v3.10.1%2026-05-08Fix
CVE-2026-43454Linux kernel nftables netdev hooks vulnerability7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43453Linux kernel nftables pipapo set out-of-bounds read7.1v3.10.1%2026-05-08Fix
CVE-2026-43452Linux kernel x_tables option parsing vulnerability8.2CNA v3.10.6%2026-05-08Fix
CVE-2026-43451Linux kernel netfilter queue bridge verdict handling memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43450Linux kernel netfilter conntrack helper netlink interface out-of-bounds read7.1v3.10.1%2026-05-08Fix
CVE-2026-43449Linux kernel NVMe PCI doorbell buffer out-of-bounds read7.1v3.10.1%2026-05-08Fix
CVE-2026-43448Linux kernel NVMe PCI driver race condition4.7v3.10.1%2026-05-08Fix
CVE-2026-43447Linux kernel iavf PTP driver use-after-free7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43446Linux kernel amdxdna accelerator driver deadlock5.5NVD v3.10.1%2026-05-08Fix
CVE-2026-43445Linux kernel e1000/e1000e Ethernet driver memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43444Linux kernel amdkfd driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43443Linux kernel ACP audio driver null pointer dereference5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43442Linux kernel io_uring SQE ring vulnerability7.1CNA v3.10.2%2026-05-08Fix
CVE-2026-43441Linux kernel bonding driver IPv6 neighbor discovery null pointer dereference7.5CNA v3.10.7%2026-05-08Fix
CVE-2026-43440Linux kernel net/mana use-after-free7.8v3.10.1%2026-05-08Fix
CVE-2026-43439Linux kernel cgroup task iteration race condition4.7v3.10.1%2026-05-08Fix
CVE-2026-43438Linux kernel sched_ext cgroup initialization use-after-free7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43437Linux kernel ALSA PCM drain use-after-free7.8CNA v3.10.1%2026-05-08Fix
CVE-2026-43436Linux kernel Scarlett2 USB-audio mixer driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43435Linux kernel Rust Binder oneway transaction throttling vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43434Linux kernel Rust Binder VMA handling vulnerability7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43433Linux kernel Rust Binder offsets array race condition7.8CNA v3.10.1%2026-05-08Fix
CVE-2026-43432Linux kernel xHCI driver slot handling memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43431Linux kernel xHCI portli debugfs null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43430Linux kernel yurex driver probe race condition4.7v3.10.1%2026-05-08Fix
CVE-2026-43429Linux kernel usbtmc driver denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43428Linux kernel USB core synchronous I/O denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43427Linux kernel cdc-wdm driver out-of-bounds read7.1v3.10.1%2026-05-08Fix
CVE-2026-43426Linux kernel Renesas USBHS driver use-after-free7.8v3.10.1%2026-05-08Fix
CVE-2026-43425Linux kernel mdc800 camera driver vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43424Linux kernel USB TCM gadget driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43421Linux kernel USB NCM gadget driver null pointer dereference5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43420Linux kernel Ceph client race condition4.7v3.10.1%2026-05-08Fix
CVE-2026-43419Linux kernel Ceph client memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43418Linux kernel scheduler mm_cid tracking denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43417Linux kernel scheduler mm_cid tracking denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43416Linux kernel powerpc perf callchain handling null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43415Linux kernel UFS host controller driver race condition4.7v3.10.1%2026-05-08Fix
CVE-2026-43414Linux kernel qla2xxx double free9.8CNA v3.10.5%2026-05-08Fix
CVE-2026-43413Linux kernel hisi_sas null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43412Linux kernel qdsp6 crash5.5v3.10.1%2026-05-08Fix
CVE-2026-43411Linux kernel TIPC socket connection handling division by zero5.5v3.10.1%2026-05-08Fix
CVE-2026-43410Linux kernel Stratix10 remote system update driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43409Linux kernel kprobes crash5.5v3.10.1%2026-05-08Fix
CVE-2026-43408Linux kernel Ceph client path handling null pointer dereference7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43407Linux kernel libceph messenger out-of-bounds read9.1CNA v3.10.5%2026-05-08Fix
CVE-2026-43406Linux kernel libceph messenger out-of-bounds read9.1CNA v3.10.7%2026-05-08Fix
CVE-2026-43405Linux kernel libceph uninitialized resource use7.5CNA v3.10.7%2026-05-08Fix
CVE-2026-43404Linux kernel hmm_range_fault device-private memory migration denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43403Linux kernel nsfs namespace iteration ioctls information disclosure8.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43402Linux kernel kthread subsystem use-after-free9.8CNA v3.10.7%2026-05-08Fix
CVE-2026-43401Linux kernel intel_pstate CPU frequency driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43400Linux kernel AMDGPU user queue signal ioctl vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43399Linux kernel AMDGPU user queue wait ioctl vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43398Linux kernel AMDGPU user queue wait ioctl vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43397Linux kernel samsung-dsim memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43396Linux kernel Xe graphics driver sync fences memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43395Linux kernel Xe graphics driver sync objects vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43394Linux kernel nfsd memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43393Linux kernel Btrfs chunk mapping memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43392Linux kernel sched_ext scheduler class denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43391Linux kernel nsfs namespace handles information disclosure8.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43390Linux kernel nstree namespace listing information disclosure5.5v3.10.1%2026-05-08Fix
CVE-2026-43389Linux kernel memfd_luo folio preservation vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43388Linux kernel DAMON monitoring use-after-free7.8v3.10.1%2026-05-08Fix
CVE-2026-43387Linux kernel rtl8723bs Wi-Fi driver out-of-bounds read5.5v3.10.1%2026-05-08Fix
CVE-2026-43386Linux kernel rtl8723bs Wi-Fi driver out-of-bounds read7.1v3.10.1%2026-05-08Fix
CVE-2026-43385In the Linux kernel, the following vulnerability has been resolved: net: Fix rcu_tasks stall in threaded busypoll I was debugging a NIC driver when I noticed that when I enable threaded busypoll, bpftrace hangs when starting up. dmesg showed: rcu_tasks_wait_gp: rcu_tasks grace period number 85 (7.5CNA v3.10.5%2026-05-08Fix
CVE-2026-43384Linux kernel TCP authentication option vulnerability9.8CNA v3.10.7%2026-05-08Fix
CVE-2026-43383Linux kernel TCP MD5 signature option vulnerability9.4CNA v3.10.4%2026-05-08Fix
CVE-2026-43382Linux kernel batman-adv ELP metric worker deadlock5.5v3.10.1%2026-05-08Fix
CVE-2026-43381Linux kernel nouveau DPCD aux transfer denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43380Linux kernel pmbus q54sj108a2 debugfs out-of-bounds write7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43379Linux kernel ksmbd lease break handling use-after-free9.8CNA v3.10.7%2026-05-08Fix
CVE-2026-43378Linux kernel ksmbd SMB2 open handler use-after-free9.8CNA v3.10.4%2026-05-08Fix
CVE-2026-43377Linux kernel ksmbd SMB3 key generation information disclosure8.1CNA v3.10.3%2026-05-08Fix
CVE-2026-43376Linux kernel ksmbd oplock handling use-after-free9.8CNA v3.10.7%2026-05-08Fix
CVE-2026-43375Linux kernel MCTP driver memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43374Linux kernel nexthop routing use-after-free7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43373Linux kernel NCSI driver memory leak7.5CNA v3.10.7%2026-05-08Fix
CVE-2026-43372Linux kernel Microchip DSA switch PTP driver vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43371Linux kernel macb Ethernet driver memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43370Linux kernel amdgpu VM manager use-after-free7.8CNA v3.10.1%2026-05-08Fix
CVE-2026-43369Linux kernel AMD GPU driver device cleanup null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43368Linux kernel i915 GPU driver shmem scatterlist vulnerability7.8CNA v3.10.1%2026-05-08Fix
CVE-2026-43367Linux kernel AMD GPU driver device cleanup null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43366Linux kernel io_uring buffer recycling vulnerability7.8CNA v3.10.1%2026-05-08Fix
CVE-2026-43365Linux kernel log stripe unit roundoff calculation vulnerability8.2CNA v3.10.6%2026-05-08Fix
CVE-2026-43364Linux kernel ublk device size control null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43363Linux kernel x2apic resume handling denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43362Linux kernel SMB client SMB2 write encryption vulnerability8.1CNA v3.10.3%2026-05-08Fix
CVE-2026-43361Linux kernel btrfs received subvolume snapshotting vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43360Linux kernel btrfs directory item hash collision handling vulnerability5.5v3.10.2%2026-05-08Fix
CVE-2026-43359Linux kernel btrfs received UUID ioctl handling vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43358Linux kernel btrfs extent buffer release error path improper locking5.5v3.10.1%2026-05-08Fix
CVE-2026-43357Linux kernel mpu3050 gyroscope PM runtime improper error handling5.5v3.10.1%2026-05-08Fix
CVE-2026-43356Linux kernel ADIS IMU driver initialization null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43355Linux kernel bh1780 PM runtime error path vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43354Linux kernel hx9023s sampling frequency configuration divide-by-zero5.5v3.10.1%2026-05-08Fix
CVE-2026-43353Linux kernel I3C HCI DMA ring dequeue race condition7.8CNA v3.10.1%2026-05-08Fix
CVE-2026-43352Linux kernel I3C HCI DMA ring abort handling vulnerability7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43351Linux kernel vGIC distributor and redistributor initialization vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43350In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS mode SID and reads sid.sub_auth[2] to recover the mode bits. That assumes the ACE carries three7.6CNA v3.10.3%2026-05-08Fix
CVE-2026-43349Linux kernel f2fs node footer validation vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43348In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER When registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, the kernel computes pgmap->vmemmap_shift as the number of trailing zeros in the OR of start_pfn and last_pfn, intending t5.5v3.10.1%2026-05-08Fix
CVE-2026-43347Linux kernel monaco crash7.5CNA v3.10.6%2026-05-08Fix
CVE-2026-43346Linux kernel ice driver PTP controlling PF check reachable assertion5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43345Linux kernel IPA GSI event ring handling denial of service7.5CNA v3.10.6%2026-05-08Fix
CVE-2026-43344Linux kernel perf/x86/intel/uncore reachable assertion5.5v3.10.1%2026-05-08Fix
CVE-2026-43343Linux kernel USB Ethernet gadget driver vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43342Linux kernel RNDIS USB gadget driver race condition4.7v3.10.1%2026-05-08Fix
CVE-2026-43341Linux kernel IOAM6 trace filling vulnerability9.8CNA v3.10.8%2026-05-08Fix
CVE-2026-43340Linux kernel comedi device spinlock handling vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43339Linux kernel IPv6 address configuration use-after-free7.8CNA v3.10.1%2026-05-08Fix
CVE-2026-43338Linux kernel Btrfs qgroup ioctl handling vulnerability5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43337Linux kernel AMD display DCN401 hardware init null pointer dereference5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43336In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha: Zeroize permuted_state before it leaves scope Since the ChaCha permutation is invertible, the local variable 'permuted_state' is sufficient to compute the original 'state', and thus the key, even after the perm7.5CNA v3.10.6%2026-05-08Fix
CVE-2026-43335Linux kernel SM8450 interconnect driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43334Linux kernel Bluetooth SMP pairing vulnerability8.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43333Linux kernel BPF map iterator context null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43332Linux kernel thermal zone device registration vulnerability7.8CNA v3.10.1%2026-05-08Fix
CVE-2026-43331Linux kernel kexec KCOV instrumentation denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43330Linux kernel CAAM crypto HMAC key handling out-of-bounds write7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43329Linux kernel netfilter flowtable hardware offload resource exhaustion7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43328Linux kernel cpufreq governor initialization double free7.8v3.10.1%2026-05-08Fix
CVE-2026-43327Linux kernel USB dummy-hcd reset handling vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43326Linux kernel sched_ext CPU kick handling deadlock5.5v3.10.1%2026-05-08Fix
CVE-2026-43325Linux kernel iwlwifi 6E command handling denial of service5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43324Linux kernel USB dummy-hcd interrupt handling vulnerability7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43323In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix zero_vruntime tracking fix John reported that stress-ng-yield could make his machine unhappy and managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking"). The combination of yield and5.5v3.10.1%2026-05-08Fix
CVE-2026-43322Linux kernel Bluetooth HCI feature read handling use-after-free8.8CNA v3.10.3%2026-05-08Fix
CVE-2026-43321Linux kernel BPF verifier register tracking vulnerability7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43320Linux kernel DSC eDP display handling vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43319Linux kernel spidev driver locking deadlock5.5v3.10.1%2026-05-08Fix
CVE-2026-43318Linux kernel amdgpu DMA-buf synchronization vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43317Linux kernel MOST driver core memory leak5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43316Linux kernel solo6x10 undefined behavior5.5v3.10.1%2026-05-08Fix
CVE-2026-43315Linux kernel KVM nested SVM CR3 loading vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43314Linux kernel device-mapper request timeout handling vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43313Linux kernel ACPI processor PIIX4 errata handling null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43312In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5647: Initialize subdev before controls In ov5647_init_controls() we call v4l2_get_subdevdata, but it is initialized by v4l2_i2c_subdev_init() in the probe, which currently happens after init_controls(). This can res5.5v3.10.1%2026-05-08Fix
CVE-2026-43311Linux kernel Tegra PMC wake interrupt handling vulnerability5.5NVD v3.10.1%2026-05-08Fix
CVE-2026-43310Linux kernel Verisilicon Hantro VPU driver vulnerability5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43309Linux kernel dm-raid array shutdown vulnerability5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43308Linux kernel Btrfs delayed reference processing vulnerability5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43307Linux kernel ADXL380 accelerometer FIFO driver vulnerability7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43306Linux kernel BPF crypto destructor kfunc vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43305Linux kernel AMD display DMUB hardware lock improper locking5.5v3.10.1%2026-05-08Fix
CVE-2026-43304Linux kernel Ceph client key decoding vulnerability9.8CNA v3.10.7%2026-05-08Fix
CVE-2026-43303Linux kernel page allocator free path use-after-free7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43302Linux kernel V3D DMA mapping incorrect buffer size calculation5.5v3.10.1%2026-05-08Fix
CVE-2026-43301Linux kernel Wave5 codec PM runtime integer underflow5.5v3.10.1%2026-05-08Fix
CVE-2026-43300Linux kernel JDI DSI panel driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43299Linux kernel Btrfs I/O failure repair denial of service5.5NVD v3.10.1%2026-05-08Fix
CVE-2026-43298Linux kernel AMDGPU VCN poison interrupt handling vulnerability5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43297Linux kernel Rockchip RGA driver null pointer dereference5.5v3.10.1%2026-05-08Fix
CVE-2026-43296Linux kernel OcteonTX2 NIX SQ manager deadlock7.5CNA v3.10.6%2026-05-08Fix
CVE-2026-43295In the Linux kernel, the following vulnerability has been resolved: rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() When idtab allocation fails, net is not registered with rio_add_net() yet, so kfree(net) is sufficient to release the memory. Set mport->net to NULL to avoid da5.5v3.10.1%2026-05-08Fix
CVE-2026-43294Linux kernel RZ/DU MIPI DSI host driver denial of service5.5NVD v3.10.2%2026-05-08Fix
CVE-2026-43293Linux kernel Wave5 codec kthread worker race condition5.5v3.10.1%2026-05-08Fix
CVE-2026-43292Linux kernel vmalloc KASAN shadow cleanup denial of service5.5v3.10.1%2026-05-08Fix
CVE-2026-43291Linux kernel NFC NCI protocol vulnerability8.3CNA v3.10.4%2026-05-08Fix
CVE-2026-43290Linux kernel UVC video driver vulnerability7.8CNA v3.10.2%2026-05-08Fix
CVE-2026-43289Linux kernel kexec purgatory loader vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43288Linux kernel ext4 filesystem vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43287Linux kernel DRM property blob allocation memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43286Linux kernel hugetlb subpool accounting memory leak5.5v3.10.1%2026-05-08Fix
CVE-2026-43285Linux kernel slab allocator vulnerability5.5v3.10.1%2026-05-08Fix
CVE-2026-43284Linux kernel xfrm ESP write-what-where condition8.8CNA v3.194.2%2026-05-08Reported exploitedExploit codeKCVFix
CVE-2026-42794Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug6.1NVD v3.10.4%2026-05-08Fix
CVE-2026-42793Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe8.2CNA v4.00.7%2026-05-08Fix
CVE-2026-42556Postiz stored XSS in public preview page8.9CNA v3.10.4%2026-05-08Fix
CVE-2026-42456mintplex-labs anything-llm AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)4.3CNA v3.10.3%2026-05-08Fix
CVE-2026-42454Termix: OS command injection in Docker Container Management endpoints9.9CNA v3.10.9%2026-05-08Fix
CVE-2026-42453Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass8.7CNA v4.01.6%2026-05-08Fix
CVE-2026-42452Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTP8.1CNA v3.10.4%2026-05-08Fix
CVE-2026-42451Grimmory: Stored XSS via Malicious EPUB enables Session Token Theft6.3CNA v3.10.1%2026-05-08Fix
CVE-2026-42354Sentry: Improper authentication on SAML SSO process allows user identity linking9.1CNA v3.10.7%2026-05-08Fix
CVE-2026-42353Path traversal / SSRF in i18next-http-middleware8.2CNA v3.10.4%2026-05-08Fix
CVE-2026-42352geopython pygeoapi pygeoapi.x: Unauthenticated SSRF via OGC API Processes Subscriber8.6CNA v3.10.6%2026-05-08Fix
CVE-2026-42351geopython pygeoapi pygeoapi.x: Path traversal in STAC FileSystemProvider7.5CNA v3.10.6%2026-05-08Fix
CVE-2026-42350Kargo: Open redirect in UI OIDC Login Flow via redirectTo Query parameter5.1CNA v4.00.4%2026-05-08Fix
CVE-2026-42346gitroomhq postiz-app postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths6.5CNA v3.10.4%2026-05-08Fix
CVE-2026-42345FastGPT: Cloud metadata endpoint SSRF protection bypass7.7CNA v3.10.4%2026-05-08
CVE-2026-42344FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints6.3CNA v3.10.2%2026-05-08
CVE-2026-42343FastGPT: Uncontrolled resource consumption leading to Sandbox Exhaustion6.3CNA v4.00.5%2026-05-08
CVE-2026-42339QuantumNous new-api New API: SSRF Filter Bypass via7.1CNA v4.00.3%2026-05-08
CVE-2026-42307Vim: OS command injection in netrw4.4CNA v3.11.2%2026-05-08Fix
CVE-2026-42302FastGPT: Unauthenticated remote code execution9.8CNA v3.11.3%2026-05-08Fix
CVE-2026-42298Postiz: Arbitrary code execution and Token Exfiltration in pr-docker-build.yml10.0CNA v3.10.8%2026-05-08Exploit codeFix
CVE-2026-42291Syslifters SysReptor personal notes sharing links missing authorization6.8CNA v3.10.3%2026-05-08Fix
CVE-2026-42287Emlog: SQL injection vulnerability in log_model.php within addLog and updateLog functions10.0CNA v4.00.4%2026-05-08Fix
CVE-2026-42286Emlog: Cross-site request forgery in Admin functions8.4CNA v4.00.2%2026-05-08Fix
CVE-2026-42282n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode4.3CNA v3.10.4%2026-05-08Fix
CVE-2026-42279solidtime time entry update API insecure direct object reference5.8CNA v3.10.4%2026-05-08Fix
CVE-2026-42278UltraDAGcom core UltraDAG: Smart Account Spending Policy Bypass via Pockets8.8CNA v4.00.5%2026-05-08
CVE-2026-42277Onyx chat file download endpoint insecure direct object reference6.5CNA v3.10.3%2026-05-08Fix
CVE-2026-42276Onyx chat session stop endpoint insecure direct object reference4.3CNA v3.10.4%2026-05-08Fix
CVE-2026-42275NetFoundry zrok WebDAV drive backend path traversal8.7CNA v3.10.5%2026-05-08Fix
CVE-2026-42274Heimdall: Authorization bypass via path normalization mismatch7.8CNA v4.00.5%2026-05-08Fix
CVE-2026-42273Heimdall: Case-sensitive host matching may lead to policy bypass7.8CNA v4.00.5%2026-05-08Fix
CVE-2026-42272dadrus Heimdall URL path decoding authorization bypass7.8CNA v4.00.6%2026-05-08Fix
CVE-2026-42271BerriAI LiteLLM command injection8.7CNA v4.092.6%2026-05-08KEVNucleiMetasploitExploit codeKCVFix
CVE-2026-42267Kimai: Formula injection via tag names in XLSX export5.4CNA v4.00.3%2026-05-08Fix
CVE-2026-42264Axios HTTP adapter configuration handling prototype pollution7.4CNA v3.11.0%2026-05-08Fix
CVE-2026-42261PromptHub: Authenticated SSRF via IPv6 filter bypass in `POST /API/skills/fetch-remote`7.1CNA v3.10.3%2026-05-08Fix
CVE-2026-42224Icinga ipl-web ipl/web is vulnerable to reflected XSS by malformed search requests7.6CNA v3.10.5%2026-05-08Fix
CVE-2026-42213SolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak5.1CNA v4.00.6%2026-05-08Fix
CVE-2026-42212SolidCAM-GPPL-IDE: XML external entity (XXE) and billion-laughs DoS in VMID parser7.1CNA v4.00.5%2026-05-08Fix
CVE-2026-42209FlashMQ: Division by zero crash when using non-default deferred retained message setting6.5CNA v3.10.6%2026-05-08Fix
CVE-2026-42208BerriAI LiteLLM SQL injection9.3CNA v4.05.8%2026-05-08KEVNucleiMetasploitExploit codeFix
CVE-2026-42206Roadiz OpenID Connect nonce generated but never validated ID token replay attack5.7CNA v4.00.2%2026-05-08Fix
CVE-2026-42205Avo: Broken access control: Unauthorized Execution of arbitrary Action Classes across Resources8.8CNA v3.10.5%2026-05-08Fix
CVE-2026-42203LiteLLM: Server-side template injection in /prompts/test endpoint8.6CNA v4.00.7%2026-05-08Fix
CVE-2026-42202almirhodzic nova-toggle-5 toggle endpoint improper authorization6.5CNA v3.10.3%2026-05-08Fix
CVE-2026-42199Grid: Integer overflow in Grid::expand_rows leads to Safe-API undefined behavior6.2CNA v3.10.2%2026-05-08Fix
CVE-2026-42195JGraph draw.io GitLab OAuth authorize flow open redirect3.4CNA v3.10.3%2026-05-08Fix
CVE-2026-42193Plunk: SNS webhook forgery9.1CNA v3.10.2%2026-05-08Fix
CVE-2026-42192Plunk: Stored XSS in campaign view5.4CNA v3.10.2%2026-05-08Fix
CVE-2026-42190RedwoodSDK: Same-site CSRF in in server actions5.3CNA v3.10.2%2026-05-08Fix
CVE-2026-42189Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth7.5CNA v3.10.8%2026-05-08Fix
CVE-2026-42185People: Privilege escalation via Missing Role Ceiling in Mail Domain Invitation5.5CNA v3.10.5%2026-05-08Fix
CVE-2026-42181Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image6.5CNA v3.10.4%2026-05-08Fix
CVE-2026-42180Lemmy: SSRF in /API/v3/post via Webmention dispatch6.3CNA v3.10.3%2026-05-08Fix
CVE-2026-42176Scoold: Persistent Admin takeover by Overwriting the admins Configuration setting6.7CNA v3.10.4%2026-05-08Fix
CVE-2026-42160sovity Data Space Portal self-registered account incorrect authorization10.0CNA v4.00.4%2026-05-08Fix
CVE-2026-42150Weblate wlc print_html API output cross-site scripting5.1CNA v3.10.3%2026-05-08Fix
CVE-2026-42072NornicDB: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access9.8CNA v3.10.6%2026-05-08Fix
CVE-2026-42030MapServer: Improper neutralization of script-related HTML tags in a web page in OpenLayers viewer6.1CNA v3.10.3%2026-05-08Fix
CVE-2026-42028novafacile novaGallery album and cached image routes path traversal5.3CNA v3.10.5%2026-05-08Fix
CVE-2026-41900OpenLearnX has critical remote code execution8.8CNA v3.11.1%2026-05-08Exploit codeFix
CVE-2026-41889pgx simple query protocol SQL injection2.3CNA v4.00.5%2026-05-08Fix
CVE-2026-41887Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for)4.9CNA v3.10.5%2026-05-08Fix
CVE-2026-41886locize Client SDK: Cross-origin DOM XSS and Handler Hijack7.5CNA v3.10.1%2026-05-08Fix
CVE-2026-41885Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend6.5CNA v3.10.3%2026-05-08Fix
CVE-2026-41883OmniFaces: EL injection via crafted resource name in wildcard CDN mapping8.1CNA v3.10.6%2026-05-08Fix
CVE-2026-41693i18next-fs-backend translation file loader path traversal8.2CNA v3.10.4%2026-05-08Fix
CVE-2026-41690Prototype pollution and path traversal in i18next-http-middleware8.6CNA v3.10.5%2026-05-08Fix
CVE-2026-41683HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header8.6CNA v3.10.4%2026-05-08Fix
CVE-2026-41682pupnp parse_uri function server-side request forgery6.9CNA v4.00.5%2026-05-08Fix
CVE-2026-41646Nuclei: Local File Read via require Module Loader Bypass5.5CNA v3.10.2%2026-05-08Fix
CVE-2026-41645Nuclei: Environment variable disclosure via Response-Derived DSL Expressions5.3CNA v3.10.4%2026-05-08Fix
CVE-2026-41591Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping6.4CNA v3.10.3%2026-05-08Fix
CVE-2026-41588RELATE: Timing Attack vulnerability in course/auth.py check_sign_in_key9.0CNA v3.10.5%2026-05-08Fix
CVE-2026-41585ZEBRA: Denial of service via Interrupted JSON-RPC requests from Authenticated Clients6.9CNA v4.00.4%2026-05-08Fix
CVE-2026-41584ZEBRA: Rk Identity Point panic in Transaction Verification9.2CNA v4.00.5%2026-05-08Fix
CVE-2026-41583ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling9.3CNA v4.00.5%2026-05-08Fix
CVE-2026-41576Ajax30/BraveCMS-2.0: Stored HTML injection in Contact Email via nl2br and Unescaped Blade template7.1CNA v3.10.4%2026-05-08
CVE-2026-41575Th30d4y/IP: DOM-based cross-site scripting (XSS)6.1CNA v3.10.3%2026-05-08Fix
CVE-2026-41574Nhost vulnerable to account takeover via OAuth Email Verification Bypass9.3CNA v4.00.9%2026-05-08Fix
CVE-2026-41570PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes7.8CNA v3.10.3%2026-05-08Fix
CVE-2026-41524Ajax30/BraveCMS-2.0: Stored XSS in page / Article Content8.7CNA v3.10.4%2026-05-08
CVE-2026-41520cilium cillium exposes sensitive information included in the cilium-bugtool debug archive7.9CNA v3.10.1%2026-05-08Fix
CVE-2026-41517Emlog: Remote code execution via Malicious plugin upload0.0CNA v4.00.4%2026-05-08Fix
CVE-2026-415120din-ai ai-scanner remote code execution9.9CNA v3.10.8%2026-05-08Fix
CVE-2026-41511OpenMcdf has an infinite loop DoS via crafted CFB directory cycle6.2CNA v3.10.2%2026-05-08Fix
CVE-2026-41509CROSS-signature CROSS-implementation integer underflow in crypto_sign_open leads to buffer overflow6.9CNA v4.00.6%2026-05-08Fix
CVE-2026-41507Remote code execution (RCE) via String Literal injection into math-codegen9.8CNA v3.10.7%2026-05-08Fix
CVE-2026-41506go-git credential leak via cross-host redirect in smart HTTP transport4.7CNA v3.10.3%2026-05-08Fix
CVE-2026-41501electerm has command injection vulnerability via runLinux function9.8CNA v3.12.5%2026-05-08Fix
CVE-2026-41500electerm has command injection vulnerability via runMac function9.8CNA v3.12.5%2026-05-08Fix
CVE-2026-41498Kimai: Team API Missing Object-Level Authorization3.3CNA v3.10.2%2026-05-08Fix
CVE-2026-41497Incomplete fix for command injection in MervinPraison/PraisonAI9.8CNA v3.10.8%2026-05-08Fix
CVE-2026-41496PraisonAI: SQL injection8.1CNA v3.10.4%2026-05-08Fix
CVE-2026-41495n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp requests5.3CNA v3.10.4%2026-05-08Fix
CVE-2026-41493YARD yard server path traversal6.9CNA v4.00.5%2026-05-08Fix
CVE-2026-41491Dapr: Service Invocation path traversal ACL bypass8.1CNA v3.10.5%2026-05-08Fix
CVE-2026-41487Langfuse LLM connection management improper access control5.3CNA v4.00.3%2026-05-08Fix
CVE-2026-41486Ray: Remote code execution via Parquet Arrow Extension Type deserialization8.9CNA v4.00.7%2026-05-08Fix
CVE-2026-41432New API Stripe webhook handler vulnerability7.1CNA v3.10.8%2026-05-08NucleiFix
CVE-2026-41423Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server8.7CNA v4.00.5%2026-05-08Fix
CVE-2026-41308Password Pusher JSON API authentication bypass6.5CNA v3.10.5%2026-05-08Fix
CVE-2026-41161Sync-in server Username Enumeration via Timing Attack6.9CNA v4.00.5%2026-05-08Fix
CVE-2026-41070openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access10.0CNA v3.10.6%2026-05-08Fix
CVE-2026-39816Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService7.5CNA v4.00.9%2026-05-08Exploit codeFix
CVE-2026-38361Fohrloop Dash-uploader incorrect control flow7.5NVD v3.12.8%2026-05-08NucleiFix
CVE-2026-38360Dash-uploader has a directory traversal9.8CISA ADP v3.16.1%2026-05-08Nuclei
CVE-2026-37431Beauty Parlour Management System appointment-detail.php SQL injection9.8CISA ADP v3.10.5%2026-05-08
CVE-2026-34354Akamai Guardicore Platform Agent time-of-check time-of-use race condition7.4CNA v3.10.4%2026-05-08
CVE-2026-32803Dell PowerScale OneFS tampering3.3CNA v3.10.1%2026-05-08Fix
CVE-2026-29975lwjson streaming JSON parser infinite loop7.5CISA ADP v3.10.8%2026-05-08
CVE-2026-29974minmea NMEA field parsing stack-based buffer overflow7.5CISA ADP v3.10.5%2026-05-08
CVE-2026-29972nanoMODBUS Modbus register response parsing stack-based buffer overflow8.2CISA ADP v3.10.9%2026-05-08
CVE-2026-29203WebPros cPanel symlink following8.8CISA ADP v3.10.5%2026-05-08Fix
CVE-2026-29202WebPros cPanel code injection8.8CISA ADP v3.10.7%2026-05-08Fix
CVE-2026-29201WebPros cPanel `feature::LOADFEATUREFILE` adminbin call improper input validation4.3CISA ADP v3.10.3%2026-05-08Fix
CVE-2026-25199Apache CloudStack: Proxmox extension allows Unauthorized Cross-Tenant Instance Access9.1CISA ADP v3.10.5%2026-05-08Fix
CVE-2026-25077Apache CloudStack: Unauthenticated command injection in Direct Download templates8.8CISA ADP v3.10.7%2026-05-08Fix
CVE-2026-8178Remote code execution via Unsafe Class Loading in Amazon Redshift JDBC Driver9.2CNA v4.00.7%2026-05-08Fix
CVE-2026-8153Universal Robots PolyScope 5 command injection in Dashboard Server interface9.8CNA v3.13.0%2026-05-08Fix
CVE-2026-8149Legion of the Bouncy Castle BC-LTS GCM chunking can lead to bad tag exception on decryption5.1CNA v4.00.2%2026-05-08Fix
CVE-2026-8148NAVER MYBOX Explorer incorrect privilege assignment7.8CISA ADP v3.10.1%2026-05-08Fix
CVE-2026-8138Tenda CX12L SetPptpServerCfg” formSetPPTPServer stack-based overflow8.7CNA v4.01.0%2026-05-08
CVE-2026-8137Totolink X5000R formDdns sub_458E40 buffer overflow8.7CNA v4.00.8%2026-05-08
CVE-2026-8136SourceCodester Pharmacy Sales and Inventory System index.php users cross-site scripting4.8CNA v4.00.4%2026-05-08
CVE-2026-8133zyx0814 FilePress Shares Filelist API admin.php SQL injection6.9CNA v4.00.4%2026-05-08
CVE-2026-8132CodeAstro Leave Management System login.php SQL injection6.9CNA v4.00.4%2026-05-08
CVE-2026-8131SourceCodester SUP Online Shopping replymsg.php SQL injection6.9CNA v4.00.4%2026-05-08
CVE-2026-8130SourceCodester SUP Online Shopping message.php SQL injection6.9CNA v4.00.4%2026-05-08
CVE-2026-8129SourceCodester SUP Online Shopping wishlist.php SQL injection6.9CNA v4.00.4%2026-05-08
CVE-2026-8128SourceCodester SUP Online Shopping viewmsg.php SQL injection6.9CNA v4.00.4%2026-05-08
CVE-2026-8127eladmin Users API Endpoint UserController.java checkLevel access control5.3CNA v4.00.3%2026-05-08
CVE-2026-8126SourceCodester Comment System post_comment.php SQL injection6.9CNA v4.00.4%2026-05-08
CVE-2026-8125code-projects Simple Chat System sendMessage.php SQL injection5.3CNA v4.00.3%2026-05-08
CVE-2026-8124GPAC box_code_base.c sidx_box_read allocation of resources5.5v3.10.2%2026-05-08
CVE-2026-8123Open5GS NSSF message.c ogs_sbi_discovery_option_add_snssais denial of service6.5v3.10.7%2026-05-08
CVE-2026-8122Open5GS NSSF message.c ogs_sbi_discovery_option_add_service_names denial of service6.5v3.10.7%2026-05-08
CVE-2026-8121Open5GS NSSF conv.c ogs_sbi_parse_plmn_list denial of service6.5v3.10.7%2026-05-08
CVE-2026-8120Open5GS NSSF nnssf-handler.c denial of service6.5v3.10.7%2026-05-08
CVE-2026-8119Open5GS NSSF nghttp2-server.c ogs_sbi_stream_find_by_id denial of service5.5v3.10.2%2026-05-08
CVE-2026-8117SourceCodester Pizzafy Ecommerce System index.php cross-site scripting5.3CNA v4.00.4%2026-05-08
CVE-2026-8116huangjunsen0406 xiaozhi-mcphub dxtController.ts path traversal5.3CNA v4.00.4%2026-05-08
CVE-2026-8077Weak credentials vulnerability in the CashDro 3 web administration panel8.6CNA v4.00.4%2026-05-08Fix
CVE-2026-8076Weak credentials vulnerability in the CashDro 3 web administration panel9.3CNA v4.00.6%2026-05-08Fix
CVE-2026-8069PredatorSense V3: Local privilege escalation (LPE)8.5CNA v4.00.2%2026-05-08Exploit codeFix
CVE-2026-7864SEPPmail Secure Email Gateway exposure of sensitive information to an unauthorized actor6.9CNA v4.00.5%2026-05-08Emerging ThreatsFix
CVE-2026-7807SmarterTools SmarterMail report summary API path traversal8.8v3.10.3%2026-05-08Fix
CVE-2026-7650E2Pdf Export Pdf Tool for WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-08Fix
CVE-2026-7475Sky Addons WordPress plugin authenticated (Author+) stored cross-site scripting via Custom Script6.4CNA v3.10.3%2026-05-08Fix
CVE-2026-7330Auto Affiliate Links WordPress plugin unauthenticated stored cross-site scripting via URL parameter7.2CNA v3.10.5%2026-05-08Fix
CVE-2026-6737AsusPTPFilter An exposed IOCTL without access control2.0CNA v4.00.1%2026-05-08
CVE-2026-6659Crypt::PasswdMD5 versions for Perl generates insecure random values for salts7.5CISA ADP v3.10.5%2026-05-08Fix
CVE-2026-6213Remote Spark SparkView RCE10.0CNA v4.00.6%2026-05-08Fix
CVE-2026-5341NMR Strava activities WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-08Fix
CVE-2026-5127User Frontend: AI Powered Frontend Posting WordPress plugin deserialization of untrusted data8.8CNA v3.11.3%2026-05-08Fix
CVE-2026-4935OttoKit: All-in-One Automation Platform WordPress plugin SureTriggers unauthenticated SQLi8.6CISA ADP v3.10.4%2026-05-08Fix
CVE-2026-3508ASUS System Control Interface IOCTL handler out-of-bounds read6.8CNA v4.00.1%2026-05-08
CVE-2026-3318Cradle e-commerce latest demo version of the open redirect5.3CNA v4.00.4%2026-05-08
CVE-2026-44742Postorius is vulnerable to XSS6.1NVD v3.10.3%2026-05-07Fix
CVE-2026-44603torproject Tor off-by-one error9.1v3.10.3%2026-05-07Fix
CVE-2026-44602torproject Tor null pointer dereference7.5v3.10.3%2026-05-07Fix
CVE-2026-44601torproject Tor crash7.5v3.10.3%2026-05-07Fix
CVE-2026-44600torproject Tor incorrect behavior order5.3v3.10.4%2026-05-07Fix
CVE-2026-44599torproject Tor incorrect resource transfer5.3v3.10.3%2026-05-07Fix
CVE-2026-44597torproject Tor incorrect behavior9.1v3.10.5%2026-05-07Fix
CVE-2026-44407Remote denial of service vulnerability Exists in ZTE Cloud PC client uSmartview4.7CNA v3.10.3%2026-05-07Fix
CVE-2026-44406DLL hijacking vulnerability in ZTE Cloud PC client uSmartview5.7CNA v3.10.2%2026-05-07Fix
CVE-2026-44349Daptin fuzzy search injects unvalidated column name into raw SQL7.1CNA v4.00.4%2026-05-07Fix
CVE-2026-44264Weblate is vulnerable to XSS via crafted Markdown4.3CNA v3.10.4%2026-05-07Fix
CVE-2026-44263Weblate: Private Translation Enumeration via Screenshot API4.3CNA v3.10.4%2026-05-07Fix
CVE-2026-44244GitPython: Newline injection in config_writer.set_value enables RCE via core.hooksPath7.8CNA v3.10.2%2026-05-07Fix
CVE-2026-44243GitPython reference APIs path traversal7.8CNA v4.00.4%2026-05-07Fix
CVE-2026-43510CISA manage.get.gov insecure portfolio administrative privileges5.1CNA v4.00.6%2026-05-07Fix
CVE-2026-42880argoproj argo-cd ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction9.6CNA v3.10.6%2026-05-07Emerging ThreatsFix
CVE-2026-42826Microsoft Azure DevOps information disclosure10.0CNA v3.11.2%2026-05-07Fix
CVE-2026-42501Malicious module proxy can bypass checksum database in cmd/go7.5CISA ADP v3.10.3%2026-05-07Fix
CVE-2026-42499Quadratic string concatenation in consumePhrase in net/mail7.5CISA ADP v3.10.8%2026-05-07Fix
CVE-2026-42449n8n-MCP SSRF protection server-side request forgery8.5CNA v3.10.3%2026-05-07Fix
CVE-2026-42285GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)7.5CNA v3.10.6%2026-05-07Fix
CVE-2026-42284GitPython: Unsafe option check validates multi_options before shlex.split transforms it8.1CNA v3.10.7%2026-05-07Fix
CVE-2026-42259Saltcorn: Open redirect in `POST /auth/login` due to incomplete `is_relative_url` validation5.1CNA v4.00.4%2026-05-07Fix
CVE-2026-42241ParquetSharp: Possible stack overflow when Reading a ParquetFile with Large Decimal Type Width5.3CNA v3.10.5%2026-05-07Fix
CVE-2026-42239Budibase auth session cookies are set with httpOnly:false any XSS can lead to full account takeover8.1CNA v3.10.4%2026-05-07Fix
CVE-2026-42225Teluu PJSIP SIP TLS transport GnuTLS backend improper certificate validation8.2CNA v4.00.3%2026-05-07Fix
CVE-2026-42217OpenEXR: Shift exponent overflow in `readVariableLengthInteger` (`ImfIDManifest.cpp`)6.3CNA v4.00.7%2026-05-07Fix
CVE-2026-42216OpenEXR: Out-of-bounds read in `IDManifest::init` during prefix expansion8.8CNA v4.00.7%2026-05-07Fix
CVE-2026-42215GitPython: Command injection via Git options bypass8.8CNA v3.10.9%2026-05-07Fix
CVE-2026-42214Improper control of generation of code (code injection) in dail8859/NotepadNext7.8CNA v3.10.3%2026-05-07Fix
CVE-2026-42194Incomplete fix for SSRF in Admidio6.8CNA v3.10.4%2026-05-07Fix
CVE-2026-42047Inngest TypeScript SDK exposes environment variables via serve handler on unhandled HTTP methods8.6CNA v3.10.5%2026-05-07Fix
CVE-2026-42011Red Hat Enterprise Linux 10 improper certificate validation7.4CNA v3.10.5%2026-05-07Fix
CVE-2026-42010GnuTLS: GnuTLS: Authentication bypass via nul character in username9.8NVD v3.10.9%2026-05-07Fix
CVE-2026-41929Vvveb Unauthenticated reflected XSS via Visual Editor5.1CNA v4.00.3%2026-05-07Fix
CVE-2026-41928Vvveb information disclosure via Cron controller6.9CNA v4.00.5%2026-05-07Fix
CVE-2026-41906FreeScout conversation customer assignment insecure direct object reference7.1CNA v3.10.3%2026-05-07Fix
CVE-2026-41905FreeScout vulnerable to SSRF7.7CNA v3.10.4%2026-05-07Fix
CVE-2026-41904FreeScout mailbox auto-reply stored cross-site scripting7.6CNA v3.10.3%2026-05-07Fix
CVE-2026-41903FreeScout IDOR vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions5.4CNA v3.10.4%2026-05-07Fix
CVE-2026-41902FreeScout user invitation link insufficient session expiration9.1CNA v3.10.4%2026-05-07Fix
CVE-2026-41891CI4MS: Deactivated User Session Bypass (active=0)5.3CNA v4.00.4%2026-05-07Fix
CVE-2026-41890CI4MS: Arbitrary Database Table Drop via theme deleteProcess6.9CNA v4.00.4%2026-05-07Fix
CVE-2026-41692i18nextify is vulnerable to DOM XSS4.7CNA v3.10.2%2026-05-07Fix
CVE-2026-41691i18next-http-backend has path traversal and URL injection via Unsanitised lng/ns6.5CNA v3.10.4%2026-05-07Fix
CVE-2026-41689Wallos webhook notifications server-side request forgery6.0CNA v3.10.3%2026-05-07
CVE-2026-41688Incomplete fix for SSRF in Wallos7.7CNA v3.10.4%2026-05-07
CVE-2026-41687Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL is_cgnat_ip not Used in Inline Checks4.3CNA v3.10.3%2026-05-07Fix
CVE-2026-41685Incus: Unbounded binary import disk exhaustion4.3CNA v3.10.4%2026-05-07Fix
CVE-2026-41684Incus: Nil Dereferences on Restore via Malformed YAML6.5CNA v3.10.5%2026-05-07Fix
CVE-2026-41675xmldom has XML node injection through unvalidated processing instruction serialization8.7CNA v4.00.6%2026-05-07Fix
CVE-2026-41674xmldom has XML injection through unvalidated DocumentType serialization8.7CNA v4.00.7%2026-05-07Fix
CVE-2026-41673xmldom XML serialization uncontrolled recursion8.7CNA v4.00.9%2026-05-07Fix
CVE-2026-41672xmldom has XML node injection through unvalidated comment serialization8.7CNA v4.00.7%2026-05-07Fix