| CVE-2026-3694 |
Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode |
14.05.2026 |
6.4 |
| CVE-2026-3718 |
ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header |
14.05.2026 |
7.2 |
| CVE-2026-3892 |
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter |
14.05.2026 |
8.1 |
| CVE-2026-5193 |
Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user |
14.05.2026 |
6.5 |
| CVE-2026-5365 |
LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route |
14.05.2026 |
4.3 |
| CVE-2026-5395 |
Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter |
14.05.2026 |
8.2 |
| CVE-2026-6225 |
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter |
14.05.2026 |
6.5 |
| CVE-2026-6252 |
Meta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute |
14.05.2026 |
6.4 |
| CVE-2026-6271 |
Career Section <= 1.7 - Unauthenticated Arbitrary File Upload |
14.05.2026 |
9.8 |
| CVE-2026-6506 |
InfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update |
14.05.2026 |
8.8 |
| CVE-2026-6510 |
InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe' |
14.05.2026 |
9.8 |
| CVE-2026-6670 |
Media Sync <= 1.4.9 - Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters |
14.05.2026 |
6.5 |
| CVE-2025-12669 |
Improper Control of Generation of Code ('Code Injection') in GitLab |
14.05.2026 |
5.4 |
| CVE-2025-13874 |
Authorization Bypass Through User-Controlled Key in GitLab |
14.05.2026 |
4.3 |
| CVE-2025-14869 |
Improper Validation of Specified Quantity in Input in GitLab |
14.05.2026 |
7.5 |
| CVE-2025-14870 |
Allocation of Resources Without Limits or Throttling in GitLab |
14.05.2026 |
7.5 |
| CVE-2025-15345 |
MapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter |
14.05.2026 |
6.1 |
| CVE-2026-1184 |
Deserialization of Untrusted Data in GitLab |
14.05.2026 |
6.5 |
| CVE-2026-1322 |
Business Logic Errors in GitLab |
14.05.2026 |
6.8 |
| CVE-2026-1338 |
Authorization Bypass Through User-Controlled Key in GitLab |
14.05.2026 |
4.3 |
| CVE-2026-1659 |
Allocation of Resources Without Limits or Throttling in GitLab |
14.05.2026 |
7.5 |
| CVE-2026-2900 |
Missing Authorization in GitLab |
14.05.2026 |
2.7 |
| CVE-2026-3073 |
Authorization Bypass Through User-Controlled Key in GitLab |
14.05.2026 |
4.3 |
| CVE-2026-3074 |
Authorization Bypass Through User-Controlled Key in GitLab |
14.05.2026 |
4.3 |
| CVE-2026-3160 |
Unintended Proxy or Intermediary ('Confused Deputy') in GitLab |
14.05.2026 |
5.8 |
| CVE-2026-3607 |
Access Control Check Implemented After Asset is Accessed in GitLab |
14.05.2026 |
4.3 |
| CVE-2026-3829 |
WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering |
14.05.2026 |
5.4 |
| CVE-2026-4524 |
Authentication Bypass Using an Alternate Path or Channel in GitLab |
14.05.2026 |
6.5 |
| CVE-2026-4527 |
Cross-Site Request Forgery (CSRF) in GitLab |
14.05.2026 |
6.5 |
| CVE-2026-5243 |
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget |
14.05.2026 |
6.4 |
| CVE-2026-5396 |
Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter |
14.05.2026 |
8.2 |
| CVE-2026-6063 |
Authorization Bypass Through User-Controlled Key in GitLab |
14.05.2026 |
4.3 |
| CVE-2026-6073 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab |
14.05.2026 |
8.7 |
| CVE-2026-6335 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab |
14.05.2026 |
5.4 |
| CVE-2026-6417 |
GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders' |
14.05.2026 |
6.1 |
| CVE-2026-6883 |
Missing Authorization in GitLab |
14.05.2026 |
2.6 |
| CVE-2026-7377 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab |
14.05.2026 |
8.7 |
| CVE-2026-7471 |
Server-Side Request Forgery (SSRF) in GitLab |
14.05.2026 |
3.5 |
| CVE-2026-7481 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab |
14.05.2026 |
8.7 |
| CVE-2026-8144 |
Missing Authorization in GitLab |
14.05.2026 |
4.3 |
| CVE-2026-8181 |
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover |
14.05.2026 |
9.8 |
| CVE-2026-8280 |
Allocation of Resources Without Limits or Throttling in GitLab |
14.05.2026 |
6.5 |
| CVE-2026-5361 |
Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter |
14.05.2026 |
6.4 |
| CVE-2026-7525 |
My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter |
14.05.2026 |
4.3 |
| CVE-2026-7648 |
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter |
14.05.2026 |
4.3 |
| CVE-2026-46445 |
|
14.05.2026 |
7.1 |
| CVE-2026-46446 |
|
14.05.2026 |
7.1 |
| CVE-2026-5486 |
Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter |
14.05.2026 |
6.5 |
| CVE-2026-44919 |
|
14.05.2026 |
4.3 |
| CVE-2026-46419 |
|
14.05.2026 |
7.5 |
| CVE-2026-41281 |
|
13.05.2026 |
|
| CVE-2026-29206 |
|
13.05.2026 |
8.1 |
| CVE-2026-32991 |
|
13.05.2026 |
7.1 |
| CVE-2026-8500 |
Web::Passwd versions through 0.03 for Perl is vulnerable to RCE |
14.05.2026 |
|
| CVE-2026-29205 |
|
13.05.2026 |
8.6 |
| CVE-2026-32992 |
|
13.05.2026 |
8.2 |
| CVE-2026-32993 |
|
13.05.2026 |
8.3 |
| CVE-2026-40327 |
|
13.05.2026 |
|
| CVE-2026-40328 |
|
13.05.2026 |
|
| CVE-2026-44193 |
OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method |
13.05.2026 |
9.1 |
| CVE-2026-44194 |
OPNsense: RCE on user managment |
13.05.2026 |
9.1 |
| CVE-2026-44195 |
OPNsense: Authentication lockout bypass |
13.05.2026 |
5.3 |
| CVE-2026-44478 |
hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token |
13.05.2026 |
7.5 |
| CVE-2026-45158 |
OPNsense: Command Injection via Attacker-Controlled DHCP Config |
13.05.2026 |
9.1 |
| CVE-2026-42463 |
SQLBot: Unauthorized Access Vulnerability |
13.05.2026 |
|
| CVE-2026-44369 |
CVAT: Stored XSS via annotation guides |
13.05.2026 |
|
| CVE-2026-44423 |
ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data |
13.05.2026 |
6.5 |
| CVE-2026-44424 |
ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace |
13.05.2026 |
6.5 |
| CVE-2026-44425 |
ShellHub: Crash-DoS via field injection in filter and sort-by parameters |
13.05.2026 |
5.4 |
| CVE-2026-44426 |
ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check |
13.05.2026 |
6.5 |
| CVE-2026-44437 |
Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix |
13.05.2026 |
|
| CVE-2026-44439 |
LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capture |
13.05.2026 |
|
| CVE-2026-44440 |
ERPNext: Path Traversal Leading to Sensitive File Exposure |
13.05.2026 |
6.5 |
| CVE-2026-44441 |
ERPNext: Possible SSRF by any authenticated user |
13.05.2026 |
5 |
| CVE-2026-44442 |
ERPNext: Unauthorised Document modification due to missing validation |
13.05.2026 |
9.9 |
| CVE-2026-44445 |
ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module |
13.05.2026 |
|
| CVE-2026-44446 |
ERPNext: Possibility of SQL Injection due to missing validation |
13.05.2026 |
8.8 |
| CVE-2026-44447 |
ERPNext: Possibility of SQL Injection due to missing validation |
13.05.2026 |
8.8 |
| CVE-2026-44448 |
ERPNext: Unauthorised Document modification due to missing validation |
13.05.2026 |
5.9 |
| CVE-2026-44471 |
gitoxide: Symlink prefix-reuse allows worktree escape during checkout |
13.05.2026 |
7.8 |
| CVE-2026-39358 |
CubeCart: Time-based Blind SQL Injection |
13.05.2026 |
7.2 |
| CVE-2026-39428 |
CubeCart: Stored Cross-Site Scripting (XSS) |
13.05.2026 |
4.8 |
| CVE-2026-42561 |
Python-Multipart: Denial of Service via unbounded multipart part headers |
13.05.2026 |
7.5 |
| CVE-2026-44372 |
Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules |
13.05.2026 |
|
| CVE-2026-44373 |
Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules` |
13.05.2026 |
5.3 |
| CVE-2026-44376 |
CubeCart: Reflected XSS in Store Search Bar |
13.05.2026 |
6.1 |
| CVE-2026-44377 |
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE |
13.05.2026 |
9.1 |
| CVE-2026-44379 |
MISP: Improper UUID validation in MISP Collections |
13.05.2026 |
|
| CVE-2026-44380 |
MISP: Improper access control in auth key reset allows privilege escalation to site administrator |
13.05.2026 |
|
| CVE-2026-44381 |
MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings |
13.05.2026 |
|
| CVE-2026-44418 |
Incomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm |
13.05.2026 |
|
| CVE-2026-45053 |
CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API |
13.05.2026 |
9.1 |
| CVE-2026-45054 |
CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing |
13.05.2026 |
4.9 |
| CVE-2026-45055 |
CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header |
13.05.2026 |
8.1 |
| CVE-2026-45708 |
CubeCart: Authenticated RCE via Invoice Template → Order Print |
13.05.2026 |
7.2 |
| CVE-2026-45714 |
CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE |
13.05.2026 |
9.1 |
| CVE-2025-27850 |
|
13.05.2026 |
|
| CVE-2025-27851 |
|
13.05.2026 |
|
| CVE-2025-27852 |
|
13.05.2026 |
|
| CVE-2025-27853 |
|
13.05.2026 |
|
| CVE-2026-21821 |
HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery |
13.05.2026 |
8.3 |
| CVE-2026-42304 |
Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains |
13.05.2026 |
7.5 |
| CVE-2026-42602 |
azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay |
13.05.2026 |
8.1 |
| CVE-2026-44368 |
PyQuorum: Timing side‑channel in mul_mod |
13.05.2026 |
|
| CVE-2026-45228 |
Quark Drive < 0.8.5 Stored XSS via System Configuration |
13.05.2026 |
|
| CVE-2026-45229 |
Quark Drive < 0.8.5 Mass Assignment via POST /update |
13.05.2026 |
|
| CVE-2026-8328 |
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address |
13.05.2026 |
|
| CVE-2026-0243 |
Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through IPv6 Crafted Packet |
13.05.2026 |
|
| CVE-2026-28374 |
IDOR in Annotations API allows unprivileged users to DELETE annotation |
13.05.2026 |
4.3 |
| CVE-2026-28376 |
Grafana Live push endpoint allows unbounded memory allocation leading to OOM |
13.05.2026 |
6.5 |
| CVE-2026-28379 |
Viewer-triggered race condition in Grafana Live leads to complete server crash |
13.05.2026 |
6.5 |
| CVE-2026-28380 |
BAC in Snapshot API allows deletion of unauthorized dashboard snapshots |
13.05.2026 |
6.5 |
| CVE-2026-28383 |
Grafana plugin resources can lead to unbounded memory allocation |
13.05.2026 |
6.5 |
| CVE-2026-33376 |
Auth Proxy IPv6 whitelist bypass |
13.05.2026 |
7.4 |
| CVE-2026-33377 |
Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin |
13.05.2026 |
7.1 |
| CVE-2026-33378 |
Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro |
13.05.2026 |
6.5 |
| CVE-2026-33380 |
SQL Expressions Read File From Disk |
13.05.2026 |
6.3 |
| CVE-2026-33381 |
Users can generate Service Account tokens after permissions removal |
13.05.2026 |
5.9 |
| CVE-2026-42548 |
Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() |
13.05.2026 |
|
| CVE-2026-42549 |
Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root |
13.05.2026 |
4.4 |
| CVE-2026-42550 |
Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete |
13.05.2026 |
8.8 |
| CVE-2026-42551 |
Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core |
13.05.2026 |
7.5 |
| CVE-2026-42552 |
Flight: Sensitive information disclosure via default error handler in flightphp/core |
13.05.2026 |
7.5 |
| CVE-2026-44351 |
fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass |
13.05.2026 |
9.1 |
| CVE-2026-44363 |
Unsafe remote resource fetching in expansion misp-modules |
13.05.2026 |
|
| CVE-2026-44364 |
misp-modules website - Missing CSRF protection in the website home blueprint |
13.05.2026 |
|
| CVE-2026-0240 |
Trust Protection Foundation: Sensitive Information Disclosure Vulnerability |
13.05.2026 |
|
| CVE-2026-0241 |
Trust Protection Foundation: Multiple Authorization Bypass Vulnerabilities |
13.05.2026 |
|
| CVE-2026-0242 |
Trust Protection Foundation: SQL Injection Vulnerability |
13.05.2026 |
|
| CVE-2026-0244 |
Prisma SD-WAN: Improper Certificate Validation Vulnerability |
13.05.2026 |
|
| CVE-2026-0245 |
Prisma Access Agent: Information Disclosure Vulnerabilities |
13.05.2026 |
|
| CVE-2026-0246 |
Prisma Access Agent: Local Privilege Escalation Vulnerability |
13.05.2026 |
|
| CVE-2026-0247 |
Prisma Access Agent Endpoint DLP: Authorization Bypass Vulnerabilities |
13.05.2026 |
|
| CVE-2026-0248 |
Prisma Access Agent: Improper Certificate Validation Vulnerability |
13.05.2026 |
|
| CVE-2026-0249 |
GlobalProtect App: Certificate Validation Bypass Vulnerabilities |
13.05.2026 |
|
| CVE-2026-22677 |
Hermes WebUI < 0.51.44 - Release T Path Traversal via Session Import Endpoint |
13.05.2026 |
|
| CVE-2026-33584 |
Arqit SKA-Platform Enables Access to Debug Information |
13.05.2026 |
5.3 |
| CVE-2026-33585 |
Arqit SKA-Platform Improper Handling of Parameters Vulnerability |
13.05.2026 |
3.8 |
| CVE-2026-41132 |
CKAN: No certificate validation on STMP connection |
13.05.2026 |
|
| CVE-2026-41255 |
CKAN: CSRF exemption primed by anonymous requests |
13.05.2026 |
6.1 |
| CVE-2026-41410 |
|
13.05.2026 |
|
| CVE-2026-42031 |
CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` |
13.05.2026 |
|
| CVE-2026-42032 |
CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql` |
13.05.2026 |
|
| CVE-2026-43970 |
Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame |
13.05.2026 |
|
| CVE-2026-0235 |
Prisma Browser: Access and Data Rule Bypass |
13.05.2026 |
|
| CVE-2026-0236 |
Prisma Browser: Code Injection Enables Security Controls Bypass |
13.05.2026 |
|
| CVE-2026-0238 |
Broker VM: Improper Input Validation in Broker VM Certificate and Key Fields |
13.05.2026 |
|
| CVE-2026-0239 |
Chronosphere Chronocollector Information Disclosure Vulnerability |
13.05.2026 |
|
| CVE-2026-0250 |
GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway |
14.05.2026 |
|
| CVE-2026-0251 |
GlobalProtect App: Local Privilege Escalation Vulnerabilities |
14.05.2026 |
|
| CVE-2026-0256 |
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface |
13.05.2026 |
|
| CVE-2026-0257 |
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities |
13.05.2026 |
|
| CVE-2026-0258 |
PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching |
13.05.2026 |
|
| CVE-2026-0259 |
WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B) |
13.05.2026 |
|
| CVE-2026-0261 |
PAN-OS: Authenticated Admin Command Injection Vulnerability |
14.05.2026 |
|
| CVE-2026-0262 |
PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing |
13.05.2026 |
|
| CVE-2026-30904 |
|
13.05.2026 |
1.8 |
| CVE-2026-30905 |
|
13.05.2026 |
7.8 |
| CVE-2026-30906 |
|
13.05.2026 |
7.8 |
| CVE-2026-33583 |
Arqit SKA-Platform Vulnerable to Key Exposure |
13.05.2026 |
8.7 |
| CVE-2026-42577 |
Netty: epoll transport denial of service via RST on half-closed TCP connection |
13.05.2026 |
7.5 |
| CVE-2026-42578 |
Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation |
13.05.2026 |
|
| CVE-2026-42579 |
Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) |
13.05.2026 |
7.5 |
| CVE-2026-42580 |
Netty: HTTP Request Smuggling due to incorrect chunk size parsing |
13.05.2026 |
6.5 |
| CVE-2026-42581 |
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization |
13.05.2026 |
5.8 |
| CVE-2026-42582 |
Netty: HTTP/3 QPACK literal unbounded allocation |
13.05.2026 |
7.5 |
| CVE-2026-42583 |
Netty: Lz4FrameDecoder resource exhaustion |
13.05.2026 |
7.5 |
| CVE-2026-42584 |
Netty: HttpClientCodec response desynchronization |
13.05.2026 |
7.3 |
| CVE-2026-42585 |
Netty: HTTP Request Smuggling due to malformed Transfer-Encoding |
13.05.2026 |
6.5 |
| CVE-2026-42586 |
Netty: CRLF Injection in Netty Redis Codec Encoder |
13.05.2026 |
6.8 |
| CVE-2026-42587 |
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS |
13.05.2026 |
7.5 |
| CVE-2026-44248 |
Netty: Resource exhaustion in MqttDecoder |
13.05.2026 |
5.3 |
| CVE-2026-8466 |
Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy |
14.05.2026 |
|
| CVE-2026-8496 |
A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7 |
13.05.2026 |
|
| CVE-2026-0237 |
Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass |
14.05.2026 |
|
| CVE-2026-0263 |
PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing |
14.05.2026 |
|
| CVE-2026-0264 |
PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution |
14.05.2026 |
|
| CVE-2026-0265 |
PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled |
14.05.2026 |
|
| CVE-2026-43997 |
vm2: Sandbox Escape |
14.05.2026 |
10 |
| CVE-2026-43998 |
vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape |
13.05.2026 |
8.5 |
| CVE-2026-43999 |
vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape |
13.05.2026 |
9.9 |
| CVE-2026-44000 |
vm2: sandbox boundary bypass via host Promise resolution preserving host object identity |
13.05.2026 |
6.5 |
| CVE-2026-44001 |
vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) |
13.05.2026 |
8.6 |
| CVE-2026-44002 |
vm2: Host File Path Disclosure via Stack Trace Information Leak |
13.05.2026 |
5.8 |
| CVE-2026-44003 |
vm2: Transformer Fast-Path Bypass Exposes Internal State Variable |
13.05.2026 |
5.3 |
| CVE-2026-44004 |
vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass) |
13.05.2026 |
7.5 |
| CVE-2026-44005 |
vm2: Sandbox escape |
13.05.2026 |
10 |
| CVE-2026-44006 |
vm2: Sandbox Escape |
13.05.2026 |
10 |
| CVE-2026-44007 |
vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution |
13.05.2026 |
9.1 |
| CVE-2026-44008 |
vm2: Snabox breakout via `neutralizeArraySpeciesBatch` |
13.05.2026 |
9.8 |
| CVE-2026-44009 |
vm2: Sandbox Breakout Through Null Proto Exception |
13.05.2026 |
9.8 |
| CVE-2026-44578 |
Next.js: Server-side request forgery in applications using WebSocket upgrades |
13.05.2026 |
8.6 |
| CVE-2026-44579 |
Next.js: Denial of Service via connection exhaustion in applications using Cache Components |
13.05.2026 |
7.5 |
| CVE-2026-44580 |
Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input |
13.05.2026 |
6.1 |
| CVE-2026-44581 |
Next.js: Cross-site scripting in App Router applications using CSP nonces |
13.05.2026 |
4.7 |
| CVE-2026-44582 |
Next.js: Cache poisoning via collisions in React Server Component cache-busting |
13.05.2026 |
3.7 |
| CVE-2026-45109 |
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes |
13.05.2026 |
7.5 |
| CVE-2026-45411 |
vm2: Sandbox Breakout Using Async Generator |
13.05.2026 |
9.8 |
| CVE-2024-48519 |
|
13.05.2026 |
|
| CVE-2026-2695 |
Lack of Server-side validation in Instruction Input in TeamViewer DEX Platform (On-Premises) |
13.05.2026 |
6.3 |
| CVE-2026-44573 |
Next.js: Middleware / Proxy bypass in Pages Router applications using i18n |
13.05.2026 |
7.5 |
| CVE-2026-44574 |
Next.js: Middleware / Proxy bypass through dynamic route parameter injection |
14.05.2026 |
8.1 |
| CVE-2026-44575 |
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes |
13.05.2026 |
7.5 |
| CVE-2026-44576 |
Next.js: Cache poisoning in React Server Component responses |
13.05.2026 |
5.4 |
| CVE-2026-44577 |
Next.js: Denial of Service in the Image Optimization API |
13.05.2026 |
5.9 |
| CVE-2024-51395 |
|
13.05.2026 |
|
| CVE-2025-28343 |
|
13.05.2026 |
|
| CVE-2025-28344 |
|
13.05.2026 |
|
| CVE-2025-32425 |
AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS |
13.05.2026 |
|
| CVE-2026-36738 |
|
13.05.2026 |
|
| CVE-2026-36741 |
|
13.05.2026 |
|
| CVE-2026-36742 |
|
13.05.2026 |
|
| CVE-2026-44431 |
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects |
13.05.2026 |
|
| CVE-2026-44432 |
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API |
13.05.2026 |
|
| CVE-2026-44467 |
Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions |
13.05.2026 |
|
| CVE-2026-44470 |
Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService |
13.05.2026 |
|
| CVE-2026-44479 |
Vercel: Non-interactive mode includes CLI arguments in suggested command output |
13.05.2026 |
5.5 |
| CVE-2026-44572 |
Next.js: Middleware / Proxy redirects can be cache-poisoned |
13.05.2026 |
3.7 |
| CVE-2026-44664 |
fast-xml-builder: Comment Value bypass regex |
13.05.2026 |
6.1 |
| CVE-2026-44665 |
fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes |
13.05.2026 |
6.1 |
| CVE-2026-45028 |
Astro: Server island encrypted parameters vulnerable to cross-component replay |
13.05.2026 |
|
| CVE-2026-45033 |
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor |
13.05.2026 |
|
| CVE-2020-37168 |
Ecommerce Systempay 1.0 Production Key Brute Force |
13.05.2026 |
|
| CVE-2020-37169 |
WordPress Plugin ultimate-member 2.1.3 Local File Inclusion |
13.05.2026 |
|
| CVE-2020-37174 |
WOOF Products Filter for WooCommerce 1.2.3 Persistent XSS |
13.05.2026 |
|
| CVE-2020-37217 |
Easy2Pilot 7 Cross-Site Request Forgery via admin.php |
13.05.2026 |
|
| CVE-2020-37218 |
Joomla com_hdwplayer 4.2 SQL Injection via search.php |
13.05.2026 |
|
| CVE-2020-37219 |
Joomla com_fabrik 3.9.11 Directory Traversal via image.php |
13.05.2026 |
|
| CVE-2020-37220 |
Huawei HG630 V2 Router Authentication Bypass via Serial Number |
13.05.2026 |
|
| CVE-2020-37221 |
Atomic Alarm Clock 6.3 Stack Overflow via SEH Unicode |
13.05.2026 |
|
| CVE-2020-37222 |
Kuicms Php EE 2.0 Persistent Cross-Site Scripting via bbs reply |
13.05.2026 |
|
| CVE-2020-37223 |
IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation |
13.05.2026 |
|
| CVE-2020-37224 |
Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby |
13.05.2026 |
|
| CVE-2020-37225 |
Powie's WHOIS Domain Check 0.9.31 Persistent Cross-Site Scripting |
13.05.2026 |
|
| CVE-2020-37226 |
Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby |
13.05.2026 |
|
| CVE-2024-51394 |
|
13.05.2026 |
|
| CVE-2024-55045 |
|
13.05.2026 |
|
| CVE-2025-29338 |
|
13.05.2026 |
|
| CVE-2026-20916 |
BIG-IQ iControl REST vulnerability |
13.05.2026 |
8.1 |
| CVE-2026-24464 |
Appliance mode iControl REST vulnerability |
13.05.2026 |
6.8 |
| CVE-2026-28758 |
BIG-IP iControl REST vulnerability |
13.05.2026 |
4.4 |
| CVE-2026-31156 |
|
13.05.2026 |
|
| CVE-2026-32643 |
BIG-IP and BIG-IQ privilege escalation vulnerability |
14.05.2026 |
8.7 |
| CVE-2026-32673 |
BIG-IP scripted monitor vulnerability |
14.05.2026 |
6.5 |
| CVE-2026-34019 |
BIG-IP BFD vulnerability |
13.05.2026 |
|
| CVE-2026-34176 |
Knowledge Appliance mode iControl REST vulnerability |
14.05.2026 |
8.7 |
| CVE-2026-35062 |
iControl SOAP vulnerability |
13.05.2026 |
6.5 |
| CVE-2026-39455 |
BIG-IP Configuration utility vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-39458 |
BIG-IP DNS Cache vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-39459 |
iControl REST and tmsh vulnerability |
14.05.2026 |
7.2 |
| CVE-2026-40060 |
BIG-IP Advanced WAF and ASM vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-40061 |
iControl REST and tmsh vulnerability |
14.05.2026 |
6.5 |
| CVE-2026-40067 |
BIG-IP APM Vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-40423 |
BIG-IP SIP profile vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-40435 |
BIG-IP httpd access control vulnerability |
13.05.2026 |
5.3 |
| CVE-2026-40460 |
NGINX ngx_quic_module vulnerability |
13.05.2026 |
6.5 |
| CVE-2026-40462 |
iControl REST and tmsh vulnerability |
13.05.2026 |
6.5 |
| CVE-2026-40618 |
BIG-IP SSL/TLS vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-40629 |
BIG-IP SSL/TLS vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-40631 |
BIG-IP iControl SOAP vulnerability |
14.05.2026 |
8.7 |
| CVE-2026-40698 |
iControl REST and TMSH vulnerability |
14.05.2026 |
8.7 |
| CVE-2026-40699 |
BIG-IP Configuration utility vulnerability |
13.05.2026 |
6.5 |
| CVE-2026-40701 |
NGINX ngx_http_ssl_module vulnerability |
13.05.2026 |
4.8 |
| CVE-2026-40703 |
BIG-IP Configuration utility CSRF vulnerability |
13.05.2026 |
5.4 |
| CVE-2026-41217 |
BIG-IP tmsh vulnerability |
13.05.2026 |
6 |
| CVE-2026-41218 |
BIG-IP PEM iRules vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-41219 |
BIG-IP QKView vulnerability |
13.05.2026 |
6.5 |
| CVE-2026-41225 |
iControl REST vulnerability |
14.05.2026 |
7.2 |
| CVE-2026-41227 |
BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-41953 |
BIG-IP Privilege Escalation vulnerability |
14.05.2026 |
8.7 |
| CVE-2026-41954 |
iControl REST and tmsh vulnerability |
13.05.2026 |
4.9 |
| CVE-2026-41956 |
BIG-IP TMM Vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-41957 |
BIG-IP and BIG-IQ Configuration utility vulnerability |
14.05.2026 |
8.8 |
| CVE-2026-41959 |
iControl and tmsh REST vulnerability |
13.05.2026 |
6.5 |
| CVE-2026-42058 |
BIG-IP iControl REST vulnerability |
14.05.2026 |
4.3 |
| CVE-2026-42063 |
iControl SOAP vulnerability |
13.05.2026 |
4.9 |
| CVE-2026-42266 |
jupyterlab: Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request. |
14.05.2026 |
8.8 |
| CVE-2026-42290 |
protobufjs-cli: OS Command Injection |
13.05.2026 |
7.8 |
| CVE-2026-42406 |
BIG-IP and BIG-IQ privilege escalation vulnerability |
14.05.2026 |
8.7 |
| CVE-2026-42408 |
BIG-IP DNS tmsh vulnerability |
13.05.2026 |
4.4 |
| CVE-2026-42409 |
BIG-IP HTTP/2 vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-42557 |
jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content |
13.05.2026 |
|
| CVE-2026-42780 |
BIG-IP SSL Orchestrator vulnerability |
13.05.2026 |
4.9 |
| CVE-2026-42781 |
BIG-IP FastL4 virtual server vulnerability |
13.05.2026 |
6.5 |
| CVE-2026-42919 |
F5 BIG-IP Appliance Mode Vulnerability |
14.05.2026 |
6.7 |
| CVE-2026-42920 |
BIG-IP DTLS Vulnerability |
13.05.2026 |
7.5 |
| CVE-2026-42924 |
BIG-IP iControl SOAP vulnerability |
14.05.2026 |
8.7 |
| CVE-2026-42926 |
NGINX ngx_http_proxy_v2_module vulnerability |
13.05.2026 |
5.8 |
| CVE-2026-42930 |
Appliance mode iControl REST vulnerability |
14.05.2026 |
8.7 |
| CVE-2026-42934 |
NGINX ngx_http_charset_module vulnerability |
13.05.2026 |
4.8 |
| CVE-2026-42937 |
iControl REST and tmsh vulnerability |
13.05.2026 |
6.5 |
| CVE-2026-42945 |
NGINX ngx_http_rewrite_module vulnerability |
14.05.2026 |
8.1 |
| CVE-2026-42946 |
NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability |
13.05.2026 |
6.5 |
| CVE-2026-43476 |
iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() |
13.05.2026 |
|
| CVE-2026-43477 |
drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL |
13.05.2026 |
|
| CVE-2026-43478 |
ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put |
13.05.2026 |
|
| CVE-2026-43479 |
net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect |
13.05.2026 |
|
| CVE-2026-43480 |
ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition |
13.05.2026 |
|
| CVE-2026-43481 |
net-shapers: don't free reply skb after genlmsg_reply() |
13.05.2026 |
|
| CVE-2026-43482 |
sched_ext: Disable preemption between scx_claim_exit() and kicking helper work |
13.05.2026 |
|
| CVE-2026-43483 |
KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated |
13.05.2026 |
|
| CVE-2026-43484 |
mmc: core: Avoid bitfield RMW for claim/retune flags |
13.05.2026 |
|
| CVE-2026-43485 |
nouveau/gsp: drop WARN_ON in ACPI probes |
13.05.2026 |
|
| CVE-2026-43486 |
arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults |
13.05.2026 |
|
| CVE-2026-43487 |
ata: libata-core: Disable LPM on ST1000DM010-2EP102 |
13.05.2026 |
|
| CVE-2026-43488 |
usb: xhci: Prevent interrupt storm on host controller error (HCE) |
13.05.2026 |
|
| CVE-2026-43489 |
liveupdate: luo_file: remember retrieve() status |
13.05.2026 |
|
| CVE-2026-44288 |
protobufjs: Overlong UTF-8 decoding |
13.05.2026 |
5.3 |
| CVE-2026-44289 |
protobufjs: Denial of service through unbounded protobuf recursion |
13.05.2026 |
7.5 |
| CVE-2026-44290 |
protobufjs: Process-wide denial of service through unsafe option paths |
13.05.2026 |
7.5 |
| CVE-2026-44291 |
protobufjs: Code generation gadget after prototype pollution |
13.05.2026 |
8.1 |
| CVE-2026-44292 |
protobufjs: Prototype injection in generated message constructors |
13.05.2026 |
5.3 |
| CVE-2026-44293 |
protobufjs: Code injection through bytes field defaults in generated toObject code |
13.05.2026 |
|
| CVE-2026-44294 |
protobufjs: Denial of service from crafted field names in generated code |
13.05.2026 |
5.3 |
| CVE-2026-44295 |
protobufjs-cli: Code injection in pbjs static output from crafted schema names |
13.05.2026 |
8.7 |
| CVE-2026-44455 |
Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection |
13.05.2026 |
4.7 |
| CVE-2026-44456 |
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests |
13.05.2026 |
6.5 |
| CVE-2026-44457 |
Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage |
13.05.2026 |
5.3 |
| CVE-2026-44458 |
Hono: CSS Declaration Injection via Style Object Values in JSX SSR |
13.05.2026 |
4.3 |
| CVE-2026-44459 |
Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() |
13.05.2026 |
3.8 |
| CVE-2026-45740 |
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion |
13.05.2026 |
5.3 |
| CVE-2026-6281 |
|
13.05.2026 |
|
| CVE-2026-6282 |
|
13.05.2026 |
|
| CVE-2026-8367 |
aria2c Improper Certificate Validation |
13.05.2026 |
4.8 |
| CVE-2026-37428 |
|
13.05.2026 |
|
| CVE-2026-37429 |
|
13.05.2026 |
|
| CVE-2026-37430 |
|
13.05.2026 |
|
| CVE-2026-39803 |
HTTP/1 chunked body reader ignores length cap in bandit |
13.05.2026 |
|
| CVE-2026-39806 |
HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit |
13.05.2026 |
|
| CVE-2026-4607 |
ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification |
13.05.2026 |
4.3 |
| CVE-2026-4608 |
ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter |
13.05.2026 |
6.5 |
| CVE-2026-4609 |
ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining |
13.05.2026 |
7.1 |
| CVE-2026-8369 |
Improper Input Validation in OpenThread NAT64 Translator |
13.05.2026 |
|
| CVE-2026-8463 |
Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input |
13.05.2026 |
|
| CVE-2026-25107 |
|
13.05.2026 |
|
| CVE-2026-35506 |
|
13.05.2026 |
|
| CVE-2026-3425 |
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path' |
13.05.2026 |
8.8 |
| CVE-2026-3426 |
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification |
13.05.2026 |
4.3 |
| CVE-2026-40621 |
|
13.05.2026 |
|
| CVE-2026-42062 |
|
13.05.2026 |
|
| CVE-2026-42948 |
|
13.05.2026 |
|
| CVE-2026-42950 |
|
13.05.2026 |
|
| CVE-2026-42961 |
|
13.05.2026 |
|
| CVE-2026-6177 |
Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text |
13.05.2026 |
7.2 |