CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-6271 Career Section <= 1.7 - Unauthenticated Arbitrary File Upload 14.05.2026 9.8
CVE-2026-6510 InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe' 14.05.2026 9.8
CVE-2026-8181 Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover 14.05.2026 9.8
CVE-2026-44193 OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method 13.05.2026 9.1
CVE-2026-44194 OPNsense: RCE on user managment 13.05.2026 9.1
CVE-2026-45158 OPNsense: Command Injection via Attacker-Controlled DHCP Config 13.05.2026 9.1
CVE-2026-44442 ERPNext: Unauthorised Document modification due to missing validation 13.05.2026 9.9
CVE-2026-44377 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE 13.05.2026 9.1
CVE-2026-44381 MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings 13.05.2026 9.3
CVE-2026-45053 CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API 13.05.2026 9.1
CVE-2026-45714 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE 13.05.2026 9.1
CVE-2026-44351 fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass 13.05.2026 9.1
CVE-2026-44364 misp-modules website - Missing CSRF protection in the website home blueprint 13.05.2026 9.3
CVE-2026-43997 vm2: Sandbox Escape 14.05.2026 10
CVE-2026-43999 vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape 13.05.2026 9.9
CVE-2026-44005 vm2: Sandbox escape 13.05.2026 10
CVE-2026-44006 vm2: Sandbox Escape 13.05.2026 10
CVE-2026-44007 vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution 13.05.2026 9.1
CVE-2026-44008 vm2: Snabox breakout via `neutralizeArraySpeciesBatch` 13.05.2026 9.8
CVE-2026-44009 vm2: Sandbox Breakout Through Null Proto Exception 13.05.2026 9.8
CVE-2026-45411 vm2: Sandbox Breakout Using Async Generator 13.05.2026 9.8
CVE-2020-37168 Ecommerce Systempay 1.0 Production Key Brute Force 13.05.2026 9.3
CVE-2026-42945 NGINX ngx_http_rewrite_module vulnerability 14.05.2026 9.2
CVE-2026-40621 13.05.2026 9.3
CVE-2026-42062 13.05.2026 9.3
CVE-2026-41050 Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering 14.05.2026 9.9
CVE-2025-11159 Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component 13.05.2026 9.1
CVE-2026-32661 13.05.2026 9.3
CVE-2026-41901 Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions 13.05.2026 9
CVE-2026-42288 ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD 12.05.2026 10
CVE-2026-44547 ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2 13.05.2026 9.6
CVE-2026-42854 arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE 13.05.2026 9.8
CVE-2026-42196 django-s3file: Relative path traversal 13.05.2026 9.9
CVE-2026-43948 wger: cross-tenant password reset and plaintext disclosure via gym=None bypass 13.05.2026 9.9
CVE-2026-44257 efw4.X: RCE via zipslip 12.05.2026 9.3
CVE-2026-44258 efw4.X: Path Traversal via Unchecked dst Parameter leads to Remote Code Execution 12.05.2026 9.3
CVE-2026-44262 Scramble: Remote code execution via evaluation of user-controlled input in validation rules 13.05.2026 9.4
CVE-2026-42889 Relay Server WebSocket authentication bypass when token is omitted 13.05.2026 9.1
CVE-2026-44221 ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases 13.05.2026 9
CVE-2026-44225 Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files 12.05.2026 9.3
CVE-2026-45185 14.05.2026 9.8
CVE-2026-34659 Adobe Connect | Deserialization of Untrusted Data (CWE-502) 13.05.2026 9.6
CVE-2026-34660 Adobe Connect | Incorrect Authorization (CWE-863) 13.05.2026 9.3
CVE-2026-8430 SPIP < 4.4.14 Remote Code Execution via nginx 13.05.2026 9.2
CVE-2026-8431 Ops Manager RCE via webhook body 12.05.2026 9.4
CVE-2026-29204 12.05.2026 9.1
CVE-2026-42048 Langflow: Path Traversal in Langflow Knowledge Bases API 13.05.2026 9.6
CVE-2026-42300 DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header 13.05.2026 9.3
CVE-2026-44183 Cleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabled 13.05.2026 9.8
CVE-2026-44196 Pingvin Share X: TOTP Authentication Bypass via Password-only Login 12.05.2026 9.1
CVE-2026-26083 13.05.2026 9.1
CVE-2026-33117 Azure SDK for Java Security Feature Bypass Vulnerability 13.05.2026 9.1
CVE-2026-40379 Microsoft Enterprise Security Token Service (ESTS) Spoofing Vulnerability 13.05.2026 9.3
CVE-2026-40402 Windows Hyper-V Elevation of Privilege Vulnerability 13.05.2026 9.3
CVE-2026-41089 Windows Netlogon Remote Code Execution Vulnerability 13.05.2026 9.8
CVE-2026-41096 Windows DNS Client Remote Code Execution Vulnerability 13.05.2026 9.8
CVE-2026-41103 Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability 13.05.2026 9.1
CVE-2026-42823 Azure Logic Apps Elevation of Privilege Vulnerability 13.05.2026 9.9
CVE-2026-42833 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability 13.05.2026 9.1
CVE-2026-42898 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability 13.05.2026 9.9
CVE-2026-44277 13.05.2026 9.1
CVE-2026-44343 WGDashboard: Critical Vulnerability in 4.3.2 12.05.2026 9.3
CVE-2026-20794 13.05.2026 9.3
CVE-2026-43992 JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter 13.05.2026 9.8
CVE-2026-30805 Insecure Default Initialization in API Authentication leads to Authentication Bypass 12.05.2026 9.1
CVE-2026-8043 12.05.2026 9.6
CVE-2026-45091 sealed-env: TOTP secret embedded in unseal token payload (enterprise mode) 12.05.2026 9.1
CVE-2025-6577 SQLi in Akilli Commerce's E-Commerce Website 12.05.2026 9.8
CVE-2026-8072 Insecure generation of SAT access credentials in Ingecon EMS Board 12.05.2026 9.2
CVE-2026-25786 12.05.2026 9.3
CVE-2026-25787 12.05.2026 9.3
CVE-2026-41551 12.05.2026 9.3
CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL 12.05.2026 9.2
CVE-2026-41872 12.05.2026 9.1
CVE-2026-34260 SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP) 12.05.2026 9.6
CVE-2026-34263 Missing authentication check in SAP Commerce cloud configuration 12.05.2026 9.6
CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys 12.05.2026 9.6
CVE-2026-43899 DeepChat: Incomplete Fix for CVE-2025-55733 leads to Remote Code Execution via Markdown Links bypassing `isValidExternalUrl` 12.05.2026 9.6
CVE-2026-43900 DeepChat: Persistent DOM XSS via HTML Entity Encoding in `<antArtifact>` SVG Rendering (Bypass of `svgSanitizer.ts`) 12.05.2026 9.3
CVE-2026-42882 oxyno-zeta/s3-proxy: Security Issues in Resource Path Matching 13.05.2026 9.4
CVE-2026-42869 SOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC tools 12.05.2026 10
CVE-2026-42864 FireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theft 11.05.2026 9.9
CVE-2026-42607 Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature 12.05.2026 9.1
CVE-2026-42613 Grav: Privilege Escalation via Missing Server-Side Validation of groups/access 12.05.2026 9.4
CVE-2026-44643 Angular Expressions - Remote Code Execution using filters 11.05.2026 9.3
CVE-2026-7813 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode 11.05.2026 9.4
CVE-2026-40636 12.05.2026 9.8
CVE-2021-47923 OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie 11.05.2026 9.3
CVE-2021-47932 WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated 11.05.2026 9.3
CVE-2021-47933 WordPress MStore API 2.0.6 Arbitrary File Upload 11.05.2026 9.3
CVE-2021-47936 OpenCATS 0.9.4 Remote Code Execution via Resume Upload 11.05.2026 9.3
CVE-2021-47940 WordPress Download From Files 1.48 Arbitrary File Upload 11.05.2026 9.3
CVE-2026-6722 Use-After-Free in SOAP using Apache map 12.05.2026 9.5
CVE-2026-42569 phpvms: /importer authorization bypass causing full database wipe 12.05.2026 9.4
CVE-2026-42571 Privilege Escalation Attack affecting Pelican Web UI 12.05.2026 9
CVE-2026-42601 ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView 11.05.2026 9.3
CVE-2026-42560 auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation 11.05.2026 9.1
CVE-2026-44313 LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function 11.05.2026 9.1
CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking 11.05.2026 9.1
CVE-2026-42454 Termix: OS Command Injection in Docker Container Management Endpoints 14.05.2026 9.9
CVE-2026-42298 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev 11.05.2026 10
CVE-2026-42302 FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox 12.05.2026 9.8
CVE-2026-42287 Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions 11.05.2026 10
CVE-2026-42193 Plunk: SNS webhook forgery 11.05.2026 9.1
CVE-2026-42160 Data Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backend 11.05.2026 10
CVE-2026-8178 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver 08.05.2026 9.2
CVE-2026-42072 Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access 12.05.2026 9.8
CVE-2026-41070 openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access 08.05.2026 10
CVE-2026-41574 Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass 08.05.2026 9.3
CVE-2026-41583 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling 08.05.2026 9.3
CVE-2026-41584 ZEBRA: rk Identity Point Panic in Transaction Verification 08.05.2026 9.2
CVE-2026-41588 RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key() 08.05.2026 9
CVE-2026-44497 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer 08.05.2026 9.3
CVE-2026-44498 ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops 08.05.2026 9.2
CVE-2026-43376 ksmbd: fix use-after-free by using call_rcu() for oplock_info 11.05.2026 9.8
CVE-2026-43379 ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() 11.05.2026 9.8
CVE-2026-43383 net/tcp-md5: Fix MAC comparison to be constant-time 11.05.2026 9.4
CVE-2026-43384 net/tcp-ao: Fix MAC comparison to be constant-time 11.05.2026 9.8
CVE-2026-43402 kthread: consolidate kthread exit paths to prevent use-after-free 11.05.2026 9.8
CVE-2026-43406 libceph: prevent potential out-of-bounds reads in process_message_header() 11.05.2026 9.1
CVE-2026-43407 libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() 11.05.2026 9.1
CVE-2026-43414 scsi: qla2xxx: Completely fix fcport double free 11.05.2026 9.8
CVE-2026-43465 net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ 11.05.2026 9.8
CVE-2026-41497 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI 08.05.2026 9.8
CVE-2026-41507 Remote Code Execution (RCE) via String Literal Injection into math-codegen 08.05.2026 9.8
CVE-2026-41512 Remote code execution via JavaScript injection in `BrowserAutomation::PlaywrightService` 08.05.2026 9.9
CVE-2026-43341 net/ipv6: ioam6: prevent schema length wraparound in trace fill 11.05.2026 9.8
CVE-2026-44126 Insecure deserialization 13.05.2026 9.2
CVE-2026-44336 PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection 11.05.2026 9.4
CVE-2026-43304 libceph: define and enforce CEPH_MAX_KEY_LEN 11.05.2026 9.8
CVE-2026-44125 Missing Authorization in GINAv2 13.05.2026 9.3
CVE-2026-44128 Unauthenticated Remote Code Execution 13.05.2026 9.3
CVE-2022-50994 DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi 08.05.2026 9.2
CVE-2026-8076 Weak credentials vulnerability in the CashDro 3 web administration panel 08.05.2026 9.3
CVE-2026-8153 Command injection in Dashboard Server interface 11.05.2026 9.8
CVE-2026-6213 Remote Spark SparkView RCE 11.05.2026 10
CVE-2026-41500 electerm has Command Injection Vulnerability via runMac function 08.05.2026 9.8
CVE-2026-41501 electerm has Command Injection Vulnerability via runLinux function 08.05.2026 9.8
CVE-2026-42208 LiteLLM: SQL injection in Proxy API key verification 09.05.2026 9.3
CVE-2026-43941 Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click 08.05.2026 9.6
CVE-2026-43944 electerm: dangerous code can be run through links or command line 13.05.2026 9.4
CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction 14.05.2026 9.6
CVE-2026-33109 Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability 13.05.2026 9.9
CVE-2026-33823 Microsoft Team Events Portal Information Disclosure Vulnerability 13.05.2026 9.6
CVE-2026-33844 Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability 13.05.2026 9
CVE-2026-35428 Azure Cloud Shell Spoofing Vulnerability 13.05.2026 9.6
CVE-2026-42826 Azure DevOps Information Disclosure Vulnerability 13.05.2026 10
CVE-2026-7891 08.05.2026 9.3
CVE-2026-41902 FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks 08.05.2026 9.1
CVE-2026-7414 Hardcoded credentials in Yarbo robot firmware 07.05.2026 9.8
CVE-2026-7415 Open MQTT orchestration without read/write ACLs in Yarbo robot firmware 07.05.2026 9.8
CVE-2026-41589 Wish has SCP Path Traversal that allows arbitrary file read/write 07.05.2026 9.6
CVE-2026-6795 Open Redirect in DivvyDrive Information Technologies' DivvyDrive 07.05.2026 9.6
CVE-2026-6508 RCE in TUBITAK BILGEM's Liderahenk 07.05.2026 9.8
CVE-2026-33587 Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) 07.05.2026 9.2

Latest Updates

CVE Title Updated Score
CVE-2026-3694 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode 14.05.2026 6.4
CVE-2026-3718 ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header 14.05.2026 7.2
CVE-2026-3892 Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter 14.05.2026 8.1
CVE-2026-5193 Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user 14.05.2026 6.5
CVE-2026-5365 LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route 14.05.2026 4.3
CVE-2026-5395 Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter 14.05.2026 8.2
CVE-2026-6225 Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter 14.05.2026 6.5
CVE-2026-6252 Meta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute 14.05.2026 6.4
CVE-2026-6271 Career Section <= 1.7 - Unauthenticated Arbitrary File Upload 14.05.2026 9.8
CVE-2026-6506 InfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update 14.05.2026 8.8
CVE-2026-6510 InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe' 14.05.2026 9.8
CVE-2026-6670 Media Sync <= 1.4.9 - Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters 14.05.2026 6.5
CVE-2025-12669 Improper Control of Generation of Code ('Code Injection') in GitLab 14.05.2026 5.4
CVE-2025-13874 Authorization Bypass Through User-Controlled Key in GitLab 14.05.2026 4.3
CVE-2025-14869 Improper Validation of Specified Quantity in Input in GitLab 14.05.2026 7.5
CVE-2025-14870 Allocation of Resources Without Limits or Throttling in GitLab 14.05.2026 7.5
CVE-2025-15345 MapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter 14.05.2026 6.1
CVE-2026-1184 Deserialization of Untrusted Data in GitLab 14.05.2026 6.5
CVE-2026-1322 Business Logic Errors in GitLab 14.05.2026 6.8
CVE-2026-1338 Authorization Bypass Through User-Controlled Key in GitLab 14.05.2026 4.3
CVE-2026-1659 Allocation of Resources Without Limits or Throttling in GitLab 14.05.2026 7.5
CVE-2026-2900 Missing Authorization in GitLab 14.05.2026 2.7
CVE-2026-3073 Authorization Bypass Through User-Controlled Key in GitLab 14.05.2026 4.3
CVE-2026-3074 Authorization Bypass Through User-Controlled Key in GitLab 14.05.2026 4.3
CVE-2026-3160 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab 14.05.2026 5.8
CVE-2026-3607 Access Control Check Implemented After Asset is Accessed in GitLab 14.05.2026 4.3
CVE-2026-3829 WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering 14.05.2026 5.4
CVE-2026-4524 Authentication Bypass Using an Alternate Path or Channel in GitLab 14.05.2026 6.5
CVE-2026-4527 Cross-Site Request Forgery (CSRF) in GitLab 14.05.2026 6.5
CVE-2026-5243 The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget 14.05.2026 6.4
CVE-2026-5396 Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter 14.05.2026 8.2
CVE-2026-6063 Authorization Bypass Through User-Controlled Key in GitLab 14.05.2026 4.3
CVE-2026-6073 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab 14.05.2026 8.7
CVE-2026-6335 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab 14.05.2026 5.4
CVE-2026-6417 GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders' 14.05.2026 6.1
CVE-2026-6883 Missing Authorization in GitLab 14.05.2026 2.6
CVE-2026-7377 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab 14.05.2026 8.7
CVE-2026-7471 Server-Side Request Forgery (SSRF) in GitLab 14.05.2026 3.5
CVE-2026-7481 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab 14.05.2026 8.7
CVE-2026-8144 Missing Authorization in GitLab 14.05.2026 4.3
CVE-2026-8181 Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover 14.05.2026 9.8
CVE-2026-8280 Allocation of Resources Without Limits or Throttling in GitLab 14.05.2026 6.5
CVE-2026-5361 Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter 14.05.2026 6.4
CVE-2026-7525 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter 14.05.2026 4.3
CVE-2026-7648 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter 14.05.2026 4.3
CVE-2026-46445 14.05.2026 7.1
CVE-2026-46446 14.05.2026 7.1
CVE-2026-5486 Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter 14.05.2026 6.5
CVE-2026-44919 14.05.2026 4.3
CVE-2026-46419 14.05.2026 7.5
CVE-2026-41281 13.05.2026
CVE-2026-29206 13.05.2026 8.1
CVE-2026-32991 13.05.2026 7.1
CVE-2026-8500 Web::Passwd versions through 0.03 for Perl is vulnerable to RCE 14.05.2026
CVE-2026-29205 13.05.2026 8.6
CVE-2026-32992 13.05.2026 8.2
CVE-2026-32993 13.05.2026 8.3
CVE-2026-40327 13.05.2026
CVE-2026-40328 13.05.2026
CVE-2026-44193 OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method 13.05.2026 9.1
CVE-2026-44194 OPNsense: RCE on user managment 13.05.2026 9.1
CVE-2026-44195 OPNsense: Authentication lockout bypass 13.05.2026 5.3
CVE-2026-44478 hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token 13.05.2026 7.5
CVE-2026-45158 OPNsense: Command Injection via Attacker-Controlled DHCP Config 13.05.2026 9.1
CVE-2026-42463 SQLBot: Unauthorized Access Vulnerability 13.05.2026
CVE-2026-44369 CVAT: Stored XSS via annotation guides 13.05.2026
CVE-2026-44423 ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data 13.05.2026 6.5
CVE-2026-44424 ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace 13.05.2026 6.5
CVE-2026-44425 ShellHub: Crash-DoS via field injection in filter and sort-by parameters 13.05.2026 5.4
CVE-2026-44426 ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check 13.05.2026 6.5
CVE-2026-44437 Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix 13.05.2026
CVE-2026-44439 LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capture 13.05.2026
CVE-2026-44440 ERPNext: Path Traversal Leading to Sensitive File Exposure 13.05.2026 6.5
CVE-2026-44441 ERPNext: Possible SSRF by any authenticated user 13.05.2026 5
CVE-2026-44442 ERPNext: Unauthorised Document modification due to missing validation 13.05.2026 9.9
CVE-2026-44445 ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module 13.05.2026
CVE-2026-44446 ERPNext: Possibility of SQL Injection due to missing validation 13.05.2026 8.8
CVE-2026-44447 ERPNext: Possibility of SQL Injection due to missing validation 13.05.2026 8.8
CVE-2026-44448 ERPNext: Unauthorised Document modification due to missing validation 13.05.2026 5.9
CVE-2026-44471 gitoxide: Symlink prefix-reuse allows worktree escape during checkout 13.05.2026 7.8
CVE-2026-39358 CubeCart: Time-based Blind SQL Injection 13.05.2026 7.2
CVE-2026-39428 CubeCart: Stored Cross-Site Scripting (XSS) 13.05.2026 4.8
CVE-2026-42561 Python-Multipart: Denial of Service via unbounded multipart part headers 13.05.2026 7.5
CVE-2026-44372 Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules 13.05.2026
CVE-2026-44373 Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules` 13.05.2026 5.3
CVE-2026-44376 CubeCart: Reflected XSS in Store Search Bar 13.05.2026 6.1
CVE-2026-44377 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE 13.05.2026 9.1
CVE-2026-44379 MISP: Improper UUID validation in MISP Collections 13.05.2026
CVE-2026-44380 MISP: Improper access control in auth key reset allows privilege escalation to site administrator 13.05.2026
CVE-2026-44381 MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings 13.05.2026
CVE-2026-44418 Incomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm 13.05.2026
CVE-2026-45053 CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API 13.05.2026 9.1
CVE-2026-45054 CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing 13.05.2026 4.9
CVE-2026-45055 CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header 13.05.2026 8.1
CVE-2026-45708 CubeCart: Authenticated RCE via Invoice Template → Order Print 13.05.2026 7.2
CVE-2026-45714 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE 13.05.2026 9.1
CVE-2025-27850 13.05.2026
CVE-2025-27851 13.05.2026
CVE-2025-27852 13.05.2026
CVE-2025-27853 13.05.2026
CVE-2026-21821 HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery 13.05.2026 8.3
CVE-2026-42304 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains 13.05.2026 7.5
CVE-2026-42602 azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay 13.05.2026 8.1
CVE-2026-44368 PyQuorum: Timing side‑channel in mul_mod 13.05.2026
CVE-2026-45228 Quark Drive < 0.8.5 Stored XSS via System Configuration 13.05.2026
CVE-2026-45229 Quark Drive < 0.8.5 Mass Assignment via POST /update 13.05.2026
CVE-2026-8328 FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address 13.05.2026
CVE-2026-0243 Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through IPv6 Crafted Packet 13.05.2026
CVE-2026-28374 IDOR in Annotations API allows unprivileged users to DELETE annotation 13.05.2026 4.3
CVE-2026-28376 Grafana Live push endpoint allows unbounded memory allocation leading to OOM 13.05.2026 6.5
CVE-2026-28379 Viewer-triggered race condition in Grafana Live leads to complete server crash 13.05.2026 6.5
CVE-2026-28380 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots 13.05.2026 6.5
CVE-2026-28383 Grafana plugin resources can lead to unbounded memory allocation 13.05.2026 6.5
CVE-2026-33376 Auth Proxy IPv6 whitelist bypass 13.05.2026 7.4
CVE-2026-33377 Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin 13.05.2026 7.1
CVE-2026-33378 Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro 13.05.2026 6.5
CVE-2026-33380 SQL Expressions Read File From Disk 13.05.2026 6.3
CVE-2026-33381 Users can generate Service Account tokens after permissions removal 13.05.2026 5.9
CVE-2026-42548 Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() 13.05.2026
CVE-2026-42549 Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root 13.05.2026 4.4
CVE-2026-42550 Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete 13.05.2026 8.8
CVE-2026-42551 Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core 13.05.2026 7.5
CVE-2026-42552 Flight: Sensitive information disclosure via default error handler in flightphp/core 13.05.2026 7.5
CVE-2026-44351 fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass 13.05.2026 9.1
CVE-2026-44363 Unsafe remote resource fetching in expansion misp-modules 13.05.2026
CVE-2026-44364 misp-modules website - Missing CSRF protection in the website home blueprint 13.05.2026
CVE-2026-0240 Trust Protection Foundation: Sensitive Information Disclosure Vulnerability 13.05.2026
CVE-2026-0241 Trust Protection Foundation: Multiple Authorization Bypass Vulnerabilities 13.05.2026
CVE-2026-0242 Trust Protection Foundation: SQL Injection Vulnerability 13.05.2026
CVE-2026-0244 Prisma SD-WAN: Improper Certificate Validation Vulnerability 13.05.2026
CVE-2026-0245 Prisma Access Agent: Information Disclosure Vulnerabilities 13.05.2026
CVE-2026-0246 Prisma Access Agent: Local Privilege Escalation Vulnerability 13.05.2026
CVE-2026-0247 Prisma Access Agent Endpoint DLP: Authorization Bypass Vulnerabilities 13.05.2026
CVE-2026-0248 Prisma Access Agent: Improper Certificate Validation Vulnerability 13.05.2026
CVE-2026-0249 GlobalProtect App: Certificate Validation Bypass Vulnerabilities 13.05.2026
CVE-2026-22677 Hermes WebUI < 0.51.44 - Release T Path Traversal via Session Import Endpoint 13.05.2026
CVE-2026-33584 Arqit SKA-Platform Enables Access to Debug Information 13.05.2026 5.3
CVE-2026-33585 Arqit SKA-Platform Improper Handling of Parameters Vulnerability 13.05.2026 3.8
CVE-2026-41132 CKAN: No certificate validation on STMP connection 13.05.2026
CVE-2026-41255 CKAN: CSRF exemption primed by anonymous requests 13.05.2026 6.1
CVE-2026-41410 13.05.2026
CVE-2026-42031 CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` 13.05.2026
CVE-2026-42032 CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql` 13.05.2026
CVE-2026-43970 Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame 13.05.2026
CVE-2026-0235 Prisma Browser: Access and Data Rule Bypass 13.05.2026
CVE-2026-0236 Prisma Browser: Code Injection Enables Security Controls Bypass 13.05.2026
CVE-2026-0238 Broker VM: Improper Input Validation in Broker VM Certificate and Key Fields 13.05.2026
CVE-2026-0239 Chronosphere Chronocollector Information Disclosure Vulnerability 13.05.2026
CVE-2026-0250 GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway 14.05.2026
CVE-2026-0251 GlobalProtect App: Local Privilege Escalation Vulnerabilities 14.05.2026
CVE-2026-0256 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface 13.05.2026
CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities 13.05.2026
CVE-2026-0258 PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching 13.05.2026
CVE-2026-0259 WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B) 13.05.2026
CVE-2026-0261 PAN-OS: Authenticated Admin Command Injection Vulnerability 14.05.2026
CVE-2026-0262 PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing 13.05.2026
CVE-2026-30904 13.05.2026 1.8
CVE-2026-30905 13.05.2026 7.8
CVE-2026-30906 13.05.2026 7.8
CVE-2026-33583 Arqit SKA-Platform Vulnerable to Key Exposure 13.05.2026 8.7
CVE-2026-42577 Netty: epoll transport denial of service via RST on half-closed TCP connection 13.05.2026 7.5
CVE-2026-42578 Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation 13.05.2026
CVE-2026-42579 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) 13.05.2026 7.5
CVE-2026-42580 Netty: HTTP Request Smuggling due to incorrect chunk size parsing 13.05.2026 6.5
CVE-2026-42581 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization 13.05.2026 5.8
CVE-2026-42582 Netty: HTTP/3 QPACK literal unbounded allocation 13.05.2026 7.5
CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion 13.05.2026 7.5
CVE-2026-42584 Netty: HttpClientCodec response desynchronization 13.05.2026 7.3
CVE-2026-42585 Netty: HTTP Request Smuggling due to malformed Transfer-Encoding 13.05.2026 6.5
CVE-2026-42586 Netty: CRLF Injection in Netty Redis Codec Encoder 13.05.2026 6.8
CVE-2026-42587 Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS 13.05.2026 7.5
CVE-2026-44248 Netty: Resource exhaustion in MqttDecoder 13.05.2026 5.3
CVE-2026-8466 Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy 14.05.2026
CVE-2026-8496 A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7 13.05.2026
CVE-2026-0237 Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass 14.05.2026
CVE-2026-0263 PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing 14.05.2026
CVE-2026-0264 PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution 14.05.2026
CVE-2026-0265 PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled 14.05.2026
CVE-2026-43997 vm2: Sandbox Escape 14.05.2026 10
CVE-2026-43998 vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape 13.05.2026 8.5
CVE-2026-43999 vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape 13.05.2026 9.9
CVE-2026-44000 vm2: sandbox boundary bypass via host Promise resolution preserving host object identity 13.05.2026 6.5
CVE-2026-44001 vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) 13.05.2026 8.6
CVE-2026-44002 vm2: Host File Path Disclosure via Stack Trace Information Leak 13.05.2026 5.8
CVE-2026-44003 vm2: Transformer Fast-Path Bypass Exposes Internal State Variable 13.05.2026 5.3
CVE-2026-44004 vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass) 13.05.2026 7.5
CVE-2026-44005 vm2: Sandbox escape 13.05.2026 10
CVE-2026-44006 vm2: Sandbox Escape 13.05.2026 10
CVE-2026-44007 vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution 13.05.2026 9.1
CVE-2026-44008 vm2: Snabox breakout via `neutralizeArraySpeciesBatch` 13.05.2026 9.8
CVE-2026-44009 vm2: Sandbox Breakout Through Null Proto Exception 13.05.2026 9.8
CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades 13.05.2026 8.6
CVE-2026-44579 Next.js: Denial of Service via connection exhaustion in applications using Cache Components 13.05.2026 7.5
CVE-2026-44580 Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input 13.05.2026 6.1
CVE-2026-44581 Next.js: Cross-site scripting in App Router applications using CSP nonces 13.05.2026 4.7
CVE-2026-44582 Next.js: Cache poisoning via collisions in React Server Component cache-busting 13.05.2026 3.7
CVE-2026-45109 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes 13.05.2026 7.5
CVE-2026-45411 vm2: Sandbox Breakout Using Async Generator 13.05.2026 9.8
CVE-2024-48519 13.05.2026
CVE-2026-2695 Lack of Server-side validation in Instruction Input in TeamViewer DEX Platform (On-Premises) 13.05.2026 6.3
CVE-2026-44573 Next.js: Middleware / Proxy bypass in Pages Router applications using i18n 13.05.2026 7.5
CVE-2026-44574 Next.js: Middleware / Proxy bypass through dynamic route parameter injection 14.05.2026 8.1
CVE-2026-44575 Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes 13.05.2026 7.5
CVE-2026-44576 Next.js: Cache poisoning in React Server Component responses 13.05.2026 5.4
CVE-2026-44577 Next.js: Denial of Service in the Image Optimization API 13.05.2026 5.9
CVE-2024-51395 13.05.2026
CVE-2025-28343 13.05.2026
CVE-2025-28344 13.05.2026
CVE-2025-32425 AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS 13.05.2026
CVE-2026-36738 13.05.2026
CVE-2026-36741 13.05.2026
CVE-2026-36742 13.05.2026
CVE-2026-44431 urllib3: Sensitive headers forwarded across origins in proxied low-level redirects 13.05.2026
CVE-2026-44432 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API 13.05.2026
CVE-2026-44467 Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions 13.05.2026
CVE-2026-44470 Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService 13.05.2026
CVE-2026-44479 Vercel: Non-interactive mode includes CLI arguments in suggested command output 13.05.2026 5.5
CVE-2026-44572 Next.js: Middleware / Proxy redirects can be cache-poisoned 13.05.2026 3.7
CVE-2026-44664 fast-xml-builder: Comment Value bypass regex 13.05.2026 6.1
CVE-2026-44665 fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes 13.05.2026 6.1
CVE-2026-45028 Astro: Server island encrypted parameters vulnerable to cross-component replay 13.05.2026
CVE-2026-45033 GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor 13.05.2026
CVE-2020-37168 Ecommerce Systempay 1.0 Production Key Brute Force 13.05.2026
CVE-2020-37169 WordPress Plugin ultimate-member 2.1.3 Local File Inclusion 13.05.2026
CVE-2020-37174 WOOF Products Filter for WooCommerce 1.2.3 Persistent XSS 13.05.2026
CVE-2020-37217 Easy2Pilot 7 Cross-Site Request Forgery via admin.php 13.05.2026
CVE-2020-37218 Joomla com_hdwplayer 4.2 SQL Injection via search.php 13.05.2026
CVE-2020-37219 Joomla com_fabrik 3.9.11 Directory Traversal via image.php 13.05.2026
CVE-2020-37220 Huawei HG630 V2 Router Authentication Bypass via Serial Number 13.05.2026
CVE-2020-37221 Atomic Alarm Clock 6.3 Stack Overflow via SEH Unicode 13.05.2026
CVE-2020-37222 Kuicms Php EE 2.0 Persistent Cross-Site Scripting via bbs reply 13.05.2026
CVE-2020-37223 IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation 13.05.2026
CVE-2020-37224 Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby 13.05.2026
CVE-2020-37225 Powie's WHOIS Domain Check 0.9.31 Persistent Cross-Site Scripting 13.05.2026
CVE-2020-37226 Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby 13.05.2026
CVE-2024-51394 13.05.2026
CVE-2024-55045 13.05.2026
CVE-2025-29338 13.05.2026
CVE-2026-20916 BIG-IQ iControl REST vulnerability 13.05.2026 8.1
CVE-2026-24464 Appliance mode iControl REST vulnerability 13.05.2026 6.8
CVE-2026-28758 BIG-IP iControl REST vulnerability 13.05.2026 4.4
CVE-2026-31156 13.05.2026
CVE-2026-32643 BIG-IP and BIG-IQ privilege escalation vulnerability 14.05.2026 8.7
CVE-2026-32673 BIG-IP scripted monitor vulnerability 14.05.2026 6.5
CVE-2026-34019 BIG-IP BFD vulnerability 13.05.2026
CVE-2026-34176 Knowledge Appliance mode iControl REST vulnerability 14.05.2026 8.7
CVE-2026-35062 iControl SOAP vulnerability 13.05.2026 6.5
CVE-2026-39455 BIG-IP Configuration utility vulnerability 13.05.2026 7.5
CVE-2026-39458 BIG-IP DNS Cache vulnerability 13.05.2026 7.5
CVE-2026-39459 iControl REST and tmsh vulnerability 14.05.2026 7.2
CVE-2026-40060 BIG-IP Advanced WAF and ASM vulnerability 13.05.2026 7.5
CVE-2026-40061 iControl REST and tmsh vulnerability 14.05.2026 6.5
CVE-2026-40067 BIG-IP APM Vulnerability 13.05.2026 7.5
CVE-2026-40423 BIG-IP SIP profile vulnerability 13.05.2026 7.5
CVE-2026-40435 BIG-IP httpd access control vulnerability 13.05.2026 5.3
CVE-2026-40460 NGINX ngx_quic_module vulnerability 13.05.2026 6.5
CVE-2026-40462 iControl REST and tmsh vulnerability 13.05.2026 6.5
CVE-2026-40618 BIG-IP SSL/TLS vulnerability 13.05.2026 7.5
CVE-2026-40629 BIG-IP SSL/TLS vulnerability 13.05.2026 7.5
CVE-2026-40631 BIG-IP iControl SOAP vulnerability 14.05.2026 8.7
CVE-2026-40698 iControl REST and TMSH vulnerability 14.05.2026 8.7
CVE-2026-40699 BIG-IP Configuration utility vulnerability 13.05.2026 6.5
CVE-2026-40701 NGINX ngx_http_ssl_module vulnerability 13.05.2026 4.8
CVE-2026-40703 BIG-IP Configuration utility CSRF vulnerability 13.05.2026 5.4
CVE-2026-41217 BIG-IP tmsh vulnerability 13.05.2026 6
CVE-2026-41218 BIG-IP PEM iRules vulnerability 13.05.2026 7.5
CVE-2026-41219 BIG-IP QKView vulnerability 13.05.2026 6.5
CVE-2026-41225 iControl REST vulnerability 14.05.2026 7.2
CVE-2026-41227 BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability 13.05.2026 7.5
CVE-2026-41953 BIG-IP Privilege Escalation vulnerability 14.05.2026 8.7
CVE-2026-41954 iControl REST and tmsh vulnerability 13.05.2026 4.9
CVE-2026-41956 BIG-IP TMM Vulnerability 13.05.2026 7.5
CVE-2026-41957 BIG-IP and BIG-IQ Configuration utility vulnerability 14.05.2026 8.8
CVE-2026-41959 iControl and tmsh REST vulnerability 13.05.2026 6.5
CVE-2026-42058 BIG-IP iControl REST vulnerability 14.05.2026 4.3
CVE-2026-42063 iControl SOAP vulnerability 13.05.2026 4.9
CVE-2026-42266 jupyterlab: Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request. 14.05.2026 8.8
CVE-2026-42290 protobufjs-cli: OS Command Injection 13.05.2026 7.8
CVE-2026-42406 BIG-IP and BIG-IQ privilege escalation vulnerability 14.05.2026 8.7
CVE-2026-42408 BIG-IP DNS tmsh vulnerability 13.05.2026 4.4
CVE-2026-42409 BIG-IP HTTP/2 vulnerability 13.05.2026 7.5
CVE-2026-42557 jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content 13.05.2026
CVE-2026-42780 BIG-IP SSL Orchestrator vulnerability 13.05.2026 4.9
CVE-2026-42781 BIG-IP FastL4 virtual server vulnerability 13.05.2026 6.5
CVE-2026-42919 F5 BIG-IP Appliance Mode Vulnerability 14.05.2026 6.7
CVE-2026-42920 BIG-IP DTLS Vulnerability 13.05.2026 7.5
CVE-2026-42924 BIG-IP iControl SOAP vulnerability 14.05.2026 8.7
CVE-2026-42926 NGINX ngx_http_proxy_v2_module vulnerability 13.05.2026 5.8
CVE-2026-42930 Appliance mode iControl REST vulnerability 14.05.2026 8.7
CVE-2026-42934 NGINX ngx_http_charset_module vulnerability 13.05.2026 4.8
CVE-2026-42937 iControl REST and tmsh vulnerability 13.05.2026 6.5
CVE-2026-42945 NGINX ngx_http_rewrite_module vulnerability 14.05.2026 8.1
CVE-2026-42946 NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability 13.05.2026 6.5
CVE-2026-43476 iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() 13.05.2026
CVE-2026-43477 drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL 13.05.2026
CVE-2026-43478 ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put 13.05.2026
CVE-2026-43479 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect 13.05.2026
CVE-2026-43480 ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition 13.05.2026
CVE-2026-43481 net-shapers: don't free reply skb after genlmsg_reply() 13.05.2026
CVE-2026-43482 sched_ext: Disable preemption between scx_claim_exit() and kicking helper work 13.05.2026
CVE-2026-43483 KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated 13.05.2026
CVE-2026-43484 mmc: core: Avoid bitfield RMW for claim/retune flags 13.05.2026
CVE-2026-43485 nouveau/gsp: drop WARN_ON in ACPI probes 13.05.2026
CVE-2026-43486 arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults 13.05.2026
CVE-2026-43487 ata: libata-core: Disable LPM on ST1000DM010-2EP102 13.05.2026
CVE-2026-43488 usb: xhci: Prevent interrupt storm on host controller error (HCE) 13.05.2026
CVE-2026-43489 liveupdate: luo_file: remember retrieve() status 13.05.2026
CVE-2026-44288 protobufjs: Overlong UTF-8 decoding 13.05.2026 5.3
CVE-2026-44289 protobufjs: Denial of service through unbounded protobuf recursion 13.05.2026 7.5
CVE-2026-44290 protobufjs: Process-wide denial of service through unsafe option paths 13.05.2026 7.5
CVE-2026-44291 protobufjs: Code generation gadget after prototype pollution 13.05.2026 8.1
CVE-2026-44292 protobufjs: Prototype injection in generated message constructors 13.05.2026 5.3
CVE-2026-44293 protobufjs: Code injection through bytes field defaults in generated toObject code 13.05.2026
CVE-2026-44294 protobufjs: Denial of service from crafted field names in generated code 13.05.2026 5.3
CVE-2026-44295 protobufjs-cli: Code injection in pbjs static output from crafted schema names 13.05.2026 8.7
CVE-2026-44455 Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection 13.05.2026 4.7
CVE-2026-44456 Hono: bodyLimit() can be bypassed for chunked / unknown-length requests 13.05.2026 6.5
CVE-2026-44457 Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage 13.05.2026 5.3
CVE-2026-44458 Hono: CSS Declaration Injection via Style Object Values in JSX SSR 13.05.2026 4.3
CVE-2026-44459 Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() 13.05.2026 3.8
CVE-2026-45740 protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion 13.05.2026 5.3
CVE-2026-6281 13.05.2026
CVE-2026-6282 13.05.2026
CVE-2026-8367 aria2c Improper Certificate Validation 13.05.2026 4.8
CVE-2026-37428 13.05.2026
CVE-2026-37429 13.05.2026
CVE-2026-37430 13.05.2026
CVE-2026-39803 HTTP/1 chunked body reader ignores length cap in bandit 13.05.2026
CVE-2026-39806 HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit 13.05.2026
CVE-2026-4607 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification 13.05.2026 4.3
CVE-2026-4608 ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter 13.05.2026 6.5
CVE-2026-4609 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining 13.05.2026 7.1
CVE-2026-8369 Improper Input Validation in OpenThread NAT64 Translator 13.05.2026
CVE-2026-8463 Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input 13.05.2026
CVE-2026-25107 13.05.2026
CVE-2026-35506 13.05.2026
CVE-2026-3425 RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path' 13.05.2026 8.8
CVE-2026-3426 RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification 13.05.2026 4.3
CVE-2026-40621 13.05.2026
CVE-2026-42062 13.05.2026
CVE-2026-42948 13.05.2026
CVE-2026-42950 13.05.2026
CVE-2026-42961 13.05.2026
CVE-2026-6177 Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text 13.05.2026 7.2