Vulnerability Summary for the Week of May 18, 2026

Vulnerability Summary for the Week of May 18, 2026 tdouglas May 26, 2026 High Vulnerabilities Primary Vendor – Product Description Published CVSS Score Source Info 10-Strike–Network Inventory Explorer 10-Strike Network Inventory Explorer 8.54 contains a stack-based buffer overflow vulnerability in the registration key input field that allows local attackers to execute arbitrary code by triggering a structured exception handler overwrite. Attackers can craft a malicious registration key string with 4188 bytes of padding followed by SEH chain values and shellcode, then paste it into the registration dialog to achieve code execution with application privileges. 2026-05-23 8.4 CVE-2018-25344 10-Strike–Network Scanner 10-Strike Network Scanner 3.0 contains a local buffer overflow vulnerability in the host name field that allows attackers to bypass SafeSEH protections and execute arbitrary code. Attackers can craft a malicious payload in the host name or address field and trigger the vulnerability through the Trace route or System information functions to achieve code execution. 2026-05-23 8.4 CVE-2018-25345 10Web–Form Maker WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database. 2026-05-23 7.1 CVE-2018-25346 acyba–AcyMailing An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress The AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known. 2026-05-20 8.8 CVE-2026-5200 Alinto–SOGo Webmail SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel. 2026-05-18 8.1 CVE-2026-8851 Audiograbber–Audiograbber Audiograbber 1.83 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attackers can craft malicious input in the Interpret or Album fields that triggers a buffer overflow, overwriting SEH pointers and executing injected shellcode with application privileges. 2026-05-23 8.4 CVE-2018-25355 AWS–Amazon Braket Python SDK Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results. We recommend you upgrade to amazon-braket-sdk version 1.117.0 or later. 2026-05-22 7.1 CVE-2026-9291 AWS–Amazon Redshift connector for Python Unsafe use of Python’s eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should upgrade to version 2.1.14. 2026-05-18 9.8 CVE-2026-8838 AWS–Kiro CLI Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin. We recommend you to upgrade to kiro-cli version 1.28.0 or later. 2026-05-22 7.8 CVE-2026-9255 AWS–RabbitMQ AWS Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the RabbitMQ process. To remediate this issue, customers should upgrade to version 0.2.1 of rabbitmq-aws. If RabbitMQ is configured to use TLS for connections, we also recommend rotating any associated private certificate keys. 2026-05-20 7.7 CVE-2026-9133 baptisteArno–typebot.io Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST /api/v1/typebots/{typebotId}/preview/startChat) allows unauthenticated users to achieve Server-Side Request Forgery (SSRF) by supplying a custom typebot definition with server-side code blocks. The fetch function exposed inside the isolated-vm sandbox calls Node.js native fetch without the SSRF validation (validateHttpReqUrl) that protects the HTTP Request block. This bypasses all SSRF mitigations added after GHSA-8gq9-rw7v-3jpr. Exploitation of this unauthenticated SSRF vulnerability can lead to cloud credential theft, internal network access and data exfiltration for any self-hosted Typebot deployments and hosted services. This issue has been fixed in version 3.16.0. 2026-05-22 10 CVE-2026-33712 baptisteArno–typebot.io Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the RatingButton component in the embed package renders the user-controlled customIcon.svg field directly via Solid’s innerHTML directive without any sanitization, even though DOMPurify is already a dependency and is used elsewhere in the codebase (e.g., StreamingBubble.tsx). Because rating blocks are not flagged as isUnsafe by the import sanitizer and the builder preview renders bots inline on the builder’s own origin (builder.typebot.io) under a CSP permitting ‘unsafe-inline’, a malicious imported or collaborator-crafted typebot can execute arbitrary HTML/JS in the builder’s authenticated context, bypassing the Web Worker sandbox that protects Script blocks during preview. This allows session hijacking and privilege escalation within the builder application. This issue has been fixed in version 3.16.0. 2026-05-22 8.7 CVE-2026-28445 baptisteArno–typebot.io TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostname literals, and literal IP formats. It does not resolve DNS before allowing the request. As a result, a hostname such as ssrf-repro.example that resolves to 127.0.0.1, 169.254.169.254, or RFC1918/private space passes validation and is later fetched by the backend HTTP client. This enables server-side request forgery to loopback, cloud metadata, and private network targets. This issue has been resolved in version 3.16.0. 2026-05-22 7.6 CVE-2026-34207 baptisteArno–typebot.io TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain an SSRF via Open Redirect Bypass as the HTTP Request block and Code block validate the initial request URL via validateHttpReqUrl() to block private IPs and cloud metadata hostnames. However, the HTTP clients (ky and fetch) follow 302 redirects without re-validating the redirect destination. An authenticated user can point a bot block to an attacker-controlled server that responds with a redirect to an internal IP, causing the Typebot server to reach internal services. An authenticated Typebot user can reach AWS metadata (169.254.169.254), private subnets, and container-internal services. Exploitable to extract cloud IAM credentials or probe internal APIs inaccessible from the internet. This issue has been fixed in version 3.16.0. 2026-05-22 7.7 CVE-2026-39965 baptisteArno–typebot.io TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 (“Credential Theft via Client-Side Script Execution and API Authorization Bypass”) is incomplete. While the builder’s getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine’s getCredentials() utility function uses a falsy check (if (workspaceId && …)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: “” to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach. 2026-05-22 7.1 CVE-2026-39968 Basamak Information Technology Consulting and Organization Trade Ltd. Co.–DernekWeb Improper neutralization of input during web page generation (‘cross-site scripting’) vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd. Co. DernekWeb allows Stored XSS. This issue affects DernekWeb: through 30122025. 2026-05-18 8.8 CVE-2026-7498 Behance–Smartshop Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to category.php with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames and other data. 2026-05-23 8.2 CVE-2018-25340 Behance–Smartshop Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to product.php with union-based SQL injection payloads in the id parameter to extract sensitive database information including usernames and database names. 2026-05-23 8.2 CVE-2018-25341 Behance–Smartshop Smartshop 1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the ‘searched’ parameter in search.php. Attackers can send GET requests with malicious SQL payloads like SLEEP commands to extract sensitive database information including product details and system data. 2026-05-23 8.2 CVE-2018-25342 BerriAI–litellm LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user’s own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin. 2026-05-21 8.8 CVE-2026-47101 BerriAI–litellm LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this vulnerability without chaining any additional flaw. 2026-05-21 8.8 CVE-2026-47102 Besen–BS20 EV Charging Station A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. Affected by this issue is some unknown functionality of the component OTA Update Installation Handler. This manipulation causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The original disclosure mentions, that “[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.” 2026-05-24 8.1 CVE-2026-9397 bestpractical–rt RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by restricting RT account access to trusted users. 2026-05-22 8.8 CVE-2026-41075 bestpractical–rt RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication bypass vulnerability in RT installations that use LDAP/AD for user authentication. Under certain LDAP server configurations, an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by reviewing their LDAP server’s authentication policy to ensure it rejects unauthenticated bind attempts. Upgrading RT remains the recommended fix. 2026-05-22 8.1 CVE-2026-41076 bestpractical–rt RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user’s behalf. This issue has been fixed in version 6.0.3. 2026-05-22 7.1 CVE-2026-41074 Beyaz Computer Software Design Industry and Trade Ltd. Co.–CityPLus Improper neutralization of input during web page generation (‘cross-site scripting’) vulnerability in Beyaz Computer Software Design Industry and Trade Ltd. Co. CityPLus allows Reflected XSS. This issue affects CityPLus: before V24.29750.1.0. 2026-05-20 7.6 CVE-2026-5783 beycanpress–Account Switcher The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the rememberLogin REST API endpoint using a loose comparison (!= instead of !==) for secret validation at app/RestAPI.php:111, combined with no validation that the secret is non-empty. When a target user has never used the “Remember me” feature, their asSecret user meta does not exist, causing get_user_meta() to return an empty string. An attacker can send an empty secret parameter, which passes the comparison ('' != '' is false), and the endpoint then calls wp_set_auth_cookie() for the target user. Additionally, all REST routes use permission_callback => '__return_true' with no capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to switch to any user account including Administrator, ultimately granting themselves full administrative privileges. 2026-05-20 8.8 CVE-2026-6456 Cisco–Cisco Secure Workload A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role. This vulnerability is due to insufficient validation and authentication when accessing REST API endpoints. An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint. A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user. 2026-05-20 10 CVE-2026-20223 ConnectWise–Automate The ConnectWise Automateâ„¢ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5. 2026-05-21 8.8 CVE-2026-9089 constantcontact–Creative Mail Easier WordPress & WooCommerce Email Marketing The Creative Mail - Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the ‘checkout_uuid’ parameter in all versions up to, and including, 1.6.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the has_checkout_consent() method. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-05-20 7.5 CVE-2026-3985 contest-gallery–Contest Gallery Upload & Vote Photos, Media, Sell with PayPal & Stripe The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the ‘form_input’ parameter in versions up to, and including, 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated ‘post_cg_gallery_form_upload’ AJAX action (specifically the ‘cb’ branch of the included users-upload-check.php, where $f_input_id is concatenated unquoted into ‘SELECT Field_Content FROM … WHERE id = $f_input_id’). The endpoint is gated only by a public frontend nonce (‘cg1l_action’ / ‘cg_nonce’) that is exposed in the page source of any public gallery page. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-05-19 7.5 CVE-2026-8912 cssigniterteam–AudioIgniter Music Player The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check - only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status. 2026-05-22 7.5 CVE-2026-8679 Ctrlpanel-gg–panel CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass unsanitized user input directly into shell commands, allowing an attacker to submit crafted requests that execute arbitrary commands on the server. The vulnerability stems from two combined weaknesses: (1) premature form handler execution before the lock file gate, and (2) unsafe use of user input in shell command construction. This issue is reported to be actively exploited in the wild. The issue has been fixed in version 1.2.0. 2026-05-19 10 CVE-2026-34234 Ctrlpanel-gg–panel CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade’s {!! !!} syntax in the recipient’s browser. The flaw exists in both App\Notifications\Ticket\Admin\AdminReplyNotification (triggered when a user replies, targeting admins) and App\Notifications\Ticket\User\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim’s session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim’s behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0. 2026-05-19 8.7 CVE-2026-34241 Ctrlpanel-gg–panel CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corresponding write methods, allowing any authenticated user to bypass RBAC via direct POST/PATCH requests. Controllers missing checks on write methods store() and update() include ApplicationApiController (admin.api.write), CouponController (admin.coupons.write), PartnerController (admin.partners.write), ShopProductController (admin.store.write), UsefulLinkController (admin.useful_links.write), and VoucherController (admin.voucher.write); ProductController (admin.products.edit), ServerController (write/change_owner/change_identifier), and UserController (write/change_email/change_credits/change_username/change_password/change_role/change_referral/change_ptero/change_serverlimit) are missing checks on update() only, and ActivityLogController exposed empty stub store()/update() methods that silently accepted any request. An authenticated attacker without admin write privileges can issue API credentials, generate unlimited coupons and vouchers, assign arbitrary partner commission and discount rates, alter shop product pricing and limits, reassign server ownership or identifiers, and modify user accounts including roles, credits, passwords, and linked Pterodactyl IDs to achieve full privilege escalation, as well as abuse logBackIn() without the login_as permission to interfere with admin impersonation sessions. This issue has been fixed in version 1.2.0. 2026-05-19 8.1 CVE-2026-34358 D-Link–DIR-601 D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the table_name parameter in POST requests. Attackers can send requests to /my_cgi.cgi with table_name values like admin_user, wireless_settings, and wireless_security to extract administrative credentials and wireless network keys in clear text. 2026-05-23 7.5 CVE-2018-25358 Dell–PowerFlex Manager (Appliance) Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. 2026-05-20 7.5 CVE-2025-32750 Digital Operations Services Inc.–WifiBurada Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass. This issue affects WifiBurada: through 21052026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-21 7.1 CVE-2025-13477 Divi Engine–Divi Form Builder The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled ‘role’ parameter from POST data during user registration without validating it against the form’s configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration. 2026-05-21 9.8 CVE-2026-5118 Docker–Docker Desktop The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary Python files included in any model pulled from an OCI registry, resulting in arbitrary code execution on the Docker host as the Docker Desktop user when inference is triggered. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model and request inference. 2026-05-22 8.2 CVE-2026-5817 Docker–Docker Desktop The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model’s config.json specifies a model_file pointing to a Python file, MLX-LM uses importlib to load and execute it with no trust_remote_code gate or equivalent safety check. The MLX backend runs without sandboxing, resulting in arbitrary code execution on the Docker host as the Docker Desktop user. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model from an attacker-controlled OCI registry and request inference. 2026-05-22 8.2 CVE-2026-5843 Docker–Docker Desktop The Docker CLI –use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containers are denied unless explicitly allowed via the admin-settings configuration. However, the –use-api-socket flag adds the Docker socket mount via the HostConfig.Mounts field rather than the HostConfig.Binds field. The ECI enforcement in the Docker Desktop API proxy only inspected Binds, allowing the mount to pass unchecked. This grants a container full access to the Docker Engine socket and, if the host user has logged in to container registries, their authentication credentials. A local attacker with the ability to run Docker CLI commands can exploit this to escape ECI restrictions, access the Docker Engine, and potentially escalate privileges. 2026-05-22 8.8 CVE-2026-6406 Dokploy–dokploy Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName parameter. 3 chained issues cause this problem: inadequate input sanitization, lack of schema validation and direct shell interpolation. User-controlled application names are passed through inadequate sanitization (cleanAppName function only replaces spaces and converts to lowercase) before being interpolated directly into shell commands executed via execAsync() and execAsyncRemote(). An authenticated attacker can inject shell metacharacters (e.g., ;, $(), backticks, , &) in the appName field during application creation, which are then executed with server-level privileges when service operations (start, stop, remove, scale) are triggered. This issue has been resolved in version 0.26.7. 2026-05-18 9.9 CVE-2026-27130 Dolibarr–Dolibarr ERP CRM Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter. 2026-05-23 9.8 CVE-2018-25357 Drupal–Drupal core Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10. 2026-05-20 9.8 CVE-2026-9082 DumbWareio–DumbAssets DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of service. 2026-05-18 9.1 CVE-2026-45230 Eclipse Foundation–Eclipse Glassfish An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish’s Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. 2026-05-19 9.1 CVE-2026-2586 Eclipse Foundation–Eclipse Glassfish A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression Language (EL) “expressions” are processed without proper sanitization or escaping. By injecting expressions such as #{77}, the server returns 49, confirming server-side EL evaluation. This issue allows a remote attacker to fully compromise the underlying host, enabling capabilities as reading/modifying data, executing arbitrary commands, persistence, and lateral movement. 2026-05-19 9.6 CVE-2026-2587 Edimax–BR-6428NS A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-18 8.8 CVE-2026-8775 Edimax–BR-6428NS A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Such manipulation of the argument pptpUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-18 8.8 CVE-2026-8776 Edimax–BR-6428NS A vulnerability was identified in Edimax BR-6428NS 1.10. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-23 8.8 CVE-2026-9294 Edimax–BR-6428NS A security flaw has been discovered in Edimax BR-6428NS 1.10. This affects the function formWirelessTbl of the file /goform/formWirelessTbl of the component POST Request Handler. Performing a manipulation of the argument vapurl results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-23 8.8 CVE-2026-9295 Edimax–BR-6675nD A security vulnerability has been detected in Edimax BR-6675nD 1.12. Affected is the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. Such manipulation of the argument L2TPUserName leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9380 Edimax–BR-6675nD A vulnerability was detected in Edimax BR-6675nD 1.12. Affected by this vulnerability is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9381 Edimax–BR-6675nD A flaw has been found in Edimax BR-6675nD 1.12. Affected by this issue is the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Executing a manipulation of the argument pptpUserName can lead to buffer overflow. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9382 Edimax–BR-6675nD A vulnerability was detected in Edimax BR-6675nD 1.12. This vulnerability affects the function formsetPPPoE of the file /goform/formsetPPPoE of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9399 Edimax–BR-6675nD A vulnerability has been found in Edimax BR-6675nD 1.12. Impacted is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. The manipulation of the argument pppUserName leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9401 Edimax–BR-6675nD A vulnerability was determined in Edimax BR-6675nD 1.12. The impacted element is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component POST Request Handler. This manipulation of the argument selSSID causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9403 Edimax–EW-7438RPn A security vulnerability has been detected in Edimax EW-7438RPn up to 1.31. The impacted element is an unknown function of the file /goform/formWpsStart of the component webs. Such manipulation of the argument pinCode/wlan-url leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9344 Edimax–EW-7438RPn A vulnerability was detected in Edimax EW-7438RPn up to 1.31. This affects the function formWizSurvey of the file /goform/formWizSurvey of the component webs. Performing a manipulation of the argument ssid/manualssid/ip/mask/gateway results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9345 Edimax–EW-7438RPn A flaw has been found in Edimax EW-7438RPn up to 1.31. This impacts the function formWirelessTbl of the file /goform/formWirelessTbl of the component webs. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9346 Edimax–EW-7438RPn A vulnerability was found in Edimax EW-7438RPn up to 1.31. Affected by this vulnerability is an unknown functionality of the file /goform/mp of the component webs. The manipulation of the argument webs results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9348 Edimax–EW-7438RPn A security flaw has been discovered in Edimax EW-7438RPn 1.28a. Affected by this issue is the function formwlencrypt24g of the file /goform/formwlencrypt24g of the component POST Request Handler. The manipulation of the argument key1 results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9360 edmonparker–Read More & Accordion The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the ‘RadMoreAjax::importData’ function not restricting which database tables can be written to during import and not properly validating the imported data. This makes it possible for authenticated attackers, with permission granted by the site owner through the plugin’s role settings, to insert arbitrary rows into the ‘wp_users’ and ‘wp_usermeta’ tables, including the ‘wp_capabilities’ field, allowing them to create a new administrator account and gain administrator access to the site. 2026-05-20 8.8 CVE-2026-7467 F5–NGINX JavaScript NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_, $arg_, $cookie_) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. 2026-05-19 8.1 CVE-2026-8711 F5–NGINX Plus NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. 2026-05-22 8.1 CVE-2026-9256 FunnelKit–Funnel Builder for WooCommerce Checkout Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin’s External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors. 2026-05-19 7.5 CVE-2026-47100 Gmission–Web Fax Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects Web Fax: from 3.0 before 3.1. 2026-05-21 8.4 CVE-2026-9157 GNU–GNU SASL In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c. 2026-05-24 7.5 CVE-2026-48829 goauthentik–authentik authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Injection. Due to how authentik extracted the NameID value from a SAML assertion, it was possible for an attacker to trick authentik into only seeing a part of the NameID value, potentially allowing an attacker to gain access to other accounts. This issue could be exploited on an authentik instance with a SAML Source, where the attacker had an account on the SAML Source and the ability to modify their NameID value (commonly username or E-mail), and XML Signing was enabled. The attacker could modify the SAML assertion given to authentik by injecting a comment within the NameID value, which effectively truncated the NameID value to the snippet before the comment, and gave the attacker access to any user account. This issue has been fixed in versions 2025.12.5 and 2026.2.3. 2026-05-20 8.7 CVE-2026-40165 goauthentik–authentik authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/{pk}/ API allows a caller with change_user on a target user to assign arbitrary groups through UserSerializer, including groups with is_superuser=True, without requiring enable_group_superuser, leading to privilege escalation. This bypasses the stricter permission model enforced in group-management paths and enables delegated user-management permissions to escalate target users to administrator-equivalent privilege. Users with permissions to update groups or permissions to update users are able to add themselves or other users they have permissions on to users which have superuser permissions. This issue has been fixed in versions 22025.12.5 and 2026.2.3. 2026-05-22 8.1 CVE-2026-40172 H3C–Magic B0 A vulnerability was found in H3C Magic B0 up to 100R002. This affects the function Edit_BasicSSID_5G of the file /goform/aspForm. Performing a manipulation of the argument param results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 8.8 CVE-2026-9393 harmistechnology–Ek Rishta Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter. Attackers can send GET requests to the user_detail view with malicious cid values containing SQL commands to extract sensitive database information. 2026-05-23 8.2 CVE-2018-25348 harmistechnology–EkRishta Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the username parameter. Attackers can submit POST requests to the login endpoint with SQL injection payloads in the username field to extract database information including user credentials and system details. 2026-05-23 8.2 CVE-2018-25351 hestiacp–hestiacp HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled. 2026-05-19 10 CVE-2026-43633 hestiacp–hestiacp HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare’s network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request. 2026-05-19 7.5 CVE-2026-43634 Honeywell International Inc.–Control Network Module (CNM) Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE). 2026-05-21 9.1 CVE-2026-5433 iina–iina IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that passes unvalidated mpv_options/input-commands parameters into the mpv runtime, causing arbitrary command execution as the current macOS user upon approval of the browser protocol prompt without requiring a valid media file. 2026-05-21 8.8 CVE-2026-47114 ISC–BIND 9 BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1. 2026-05-20 7.5 CVE-2026-3039 ISC–BIND 9 A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.0 through 9.18.48 and 9.18.11-S1 through 9.18.48-S1 are NOT affected. 2026-05-20 7.4 CVE-2026-3593 ISC–BIND 9 Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet (IN) - for example, CHAOS or HESIOD, or DNS messages that specify meta-classes (ANY or NONE) in the question section. Specially crafted requests reaching the affected code paths - recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or processing of IN-specific record types in non-IN data - can cause assertion failures in named. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1. 2026-05-20 7.5 CVE-2026-5946 ISC–BIND 9 Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the “recursive-clients” limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected. 2026-05-20 7.5 CVE-2026-5947 itsourcecode–Electronic Judging System A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/admin/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. 2026-05-24 7.3 CVE-2026-9383 ItzCrazyKns–Vane A flaw has been found in ItzCrazyKns Vane up to 1.12.1. This vulnerability affects unknown code of the file src/app/api/providers/route.ts of the component Model Provider API. This manipulation of the argument baseURL causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-24 7.3 CVE-2026-9372 ivanti–Secure Access Client An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code. 2026-05-22 8.8 CVE-2026-8992 jarrodwatts–claude-hud Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by manipulating the COMSPEC environment variable. Attackers can set COMSPEC to an arbitrary binary path before claude-hud performs its version check, causing execFile() to execute the attacker-supplied executable with cmd.exe arguments, resulting in arbitrary code execution on Windows systems. 2026-05-18 7.8 CVE-2026-47092 kovidgoyal–kitty Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0. 2026-05-19 9.9 CVE-2026-33642 kovidgoyal–kitty Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal’s stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0. 2026-05-19 7.5 CVE-2026-33633 langgenius–dify Dify version 1.14.1 and prior contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. Attackers can exploit missing tenant ownership checks in the trace configuration endpoints to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker. 2026-05-18 7.4 CVE-2026-41947 langgenius–dify Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon’s internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant’s UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker. 2026-05-18 7.7 CVE-2026-41948 laurent22–joplin Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows overwriting arbitrary files on disk. The OneNote converter does not sanitize the names of embedded files before writing them to disk. As a result, it’s possible for an attacker to create a malicious .one file that includes file names containing ../../, that are then interpreted as part of the target path when extracting attachments from the .one file. This issue has been patched in version 3.5.7. 2026-05-18 8.2 CVE-2026-22810 Linux–Linux In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications. 2026-05-19 9.8 CVE-2026-43493 LizardByte–Sunshine Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED as success. This can allow an untrusted certificate to pass authentication and access protected HTTPS endpoints. This issue has been fixed in version 2026.516.143833. 2026-05-22 9.8 CVE-2026-32253 Mattermost–Mattermost Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640 2026-05-21 8 CVE-2026-4858 Mattermost–Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607 2026-05-18 8.7 CVE-2026-6346 Mattermost–Mattermost Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647 2026-05-22 7.5 CVE-2026-5740 Mattermost–Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605 2026-05-18 7.6 CVE-2026-6347 MediaArea–MediaInfoLib MediaArea MediaInfoLib Channel Splitting heap-based buffer overflow vulnerability 2026-05-20 7.8 CVE-2026-22554 MediaArea–MediaInfoLib MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability 2026-05-21 7.8 CVE-2026-28764 memcached–memcached In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass. 2026-05-20 8.1 CVE-2026-47783 memcached–memcached In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass. 2026-05-20 8.1 CVE-2026-47784 Mesalvo–Meona Client Launcher Component Improper Control of Generation of Code (‘Code Injection’) vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users’ systems. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020. 2026-05-20 9 CVE-2026-22314 Mesalvo–Meona Client Launcher Component Improper Access Control vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables a normal user gaining access to the admin panel. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020. 2026-05-20 7.8 CVE-2026-0856 Mesalvo–Meona Client Launcher Component Incorrect Privilege Assignment vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables the export of user data, including cleartext passwords, via the SQL editor. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020. 2026-05-20 7.2 CVE-2026-22315 metaphorcreations–Ditty Responsive News Tickers, Sliders, and Lists The Ditty - Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the full item content of non-public Dittys - including drafts, pending, scheduled, and disabled entries - by enumerating integer post IDs against the ditty_init AJAX endpoint. Unlike the non-AJAX init() counterpart, init_ajax() does not verify that the requested Ditty has a ‘publish’ post status before loading and returning its items, allowing content that administrators explicitly withheld from public view to be extracted. 2026-05-22 7.5 CVE-2026-9011 Microsoft–Azure Local Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network. 2026-05-18 10 CVE-2026-42822 Microsoft–Azure Orbital Spatio Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network. 2026-05-22 10 CVE-2026-40412 Microsoft–Azure Privileged Identity Management (PIM) Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a network. 2026-05-22 8.8 CVE-2026-35430 Microsoft–Azure Resource Manager Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network. 2026-05-22 10 CVE-2026-47280 Microsoft–Azure Stack HCI Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network. 2026-05-22 7.7 CVE-2026-26147 Microsoft–Azure Virtual Network Gateway Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network. 2026-05-22 9.9 CVE-2026-40411 Microsoft–Microsoft 365 Copilot for iOS Improper neutralization of special elements used in a command (‘command injection’) in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network. 2026-05-22 9.3 CVE-2026-41090 Microsoft–Microsoft Edge (Chromium-based) Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 2026-05-18 8.8 CVE-2026-45495 Microsoft–Microsoft Entra Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. 2026-05-22 10 CVE-2026-42901 Microsoft–Microsoft Entra Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network. 2026-05-22 9.1 CVE-2026-33843 Microsoft–Microsoft Global Secure Access (GSA) Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network. 2026-05-22 7.5 CVE-2026-23663 Microsoft–Microsoft Malware Protection Engine Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network. 2026-05-20 8.1 CVE-2026-45584 Microsoft–Microsoft Malware Protection Engine Improper link resolution before file access (‘link following’) in Microsoft Defender allows an authorized attacker to elevate privileges locally. 2026-05-20 7.8 CVE-2026-41091 Microsoft–Microsoft Planetary Computer Pro (GeoCatalog) Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network. 2026-05-22 10 CVE-2026-41104 Microsoft–Microsoft Power Pages Improper neutralization of special elements used in a command (‘command injection’) in Microsoft Power Pages allows an unauthorized attacker to execute code over a network. 2026-05-22 10 CVE-2026-23652 Microsoft–Microsoft SharePoint Enterprise Server 2016 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. 2026-05-22 8.8 CVE-2026-45659 Microsoft–Windows Admin Center in Azure Portal Improper link resolution before file access (‘link following’) in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally. 2026-05-20 7.8 CVE-2026-42834 Motorola–Phones An improper authentication vulnerability was discovered in the Motorola Factory Test component (com.motorola.motocit). The application contained a reference to a writable file descriptor in external storage which could be used by third party apps running on the device to open a TCP server, exposing sensitive permissions and data. This could allow a local attacker to bypass permission checks and access protected device settings. 2026-05-19 8.4 CVE-2026-5804 mullvad–mullvadvpn-app Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group can pre-place a crafted application bundle at that location and may be able to achieve code execution as root. Since the issue only affected the installer, there is no immediate need for users to update if they are already running an older version. This issue has been fixed in version 2026.2-beta1. 2026-05-19 7.3 CVE-2026-32323 n/a–exifreader This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion. 2026-05-19 7.5 CVE-2026-8813 n/a–lwIP A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue. 2026-05-18 9.8 CVE-2026-8836 n/a–shell-quote shell-quote’s quote() function did not validate object-token inputs against the operator model used by parse(). The .op field was backslash-escaped character by character using /(.)/g, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in .op therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of { op: '...\n...' } from external input, and (2) via parse(cmd, envFn) when envFn returns object tokens whose .op is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: .op must match the parser’s control-operator allowlist; { op: 'glob', pattern } validates pattern and forbids line terminators; { comment } validates comment and forbids line terminators; any other object shape throws TypeError. 2026-05-22 8.1 CVE-2026-9277 NeoRazorX–facturascripts FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. The vulnerability is located in Plugins.php. While the testZipFile function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. An attacker can bypass this check by naming a file ValidPluginName/../../shell.php. The explode function will see ValidPluginName as the root folder, satisfying the count($folders) != 1 check. However, during extraction, the ../../ sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory. This issue is fixed in version 2026.1. 2026-05-18 7.2 CVE-2026-27891 Netatalk–Netatalk A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service. 2026-05-21 9.9 CVE-2026-44050 Netatalk–Netatalk An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service. 2026-05-21 8.8 CVE-2026-44047 Netatalk–Netatalk A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service. 2026-05-21 8.8 CVE-2026-44048 Netatalk–Netatalk An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary files via attacker-controlled symlink creation. 2026-05-21 8.1 CVE-2026-44051 Netatalk–Netatalk An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data. 2026-05-21 7.5 CVE-2026-44049 Netatalk–Netatalk Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials. 2026-05-21 7.5 CVE-2026-44052 Netatalk–Netatalk Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, which allows a remote attacker to obtain authentication credentials or impersonate a user via cryptanalytic attack. 2026-05-21 7.4 CVE-2026-44053 Netatalk–Netatalk A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code. 2026-05-21 7.5 CVE-2026-44055 Netatalk–Netatalk An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request. 2026-05-21 7.5 CVE-2026-44060 Netatalk–Netatalk A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data. 2026-05-21 7.5 CVE-2026-44062 Netatalk–Netatalk An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request. 2026-05-21 7.1 CVE-2026-44064 Netatalk–Netatalk Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a remote authenticated attacker to obtain sensitive information or cause a minor service disruption. 2026-05-21 7.1 CVE-2026-44066 Netatalk–Netatalk Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to write to files outside the intended metadata namespace via crafted EA names. 2026-05-21 7.6 CVE-2026-44068 nimiq–core-rs-albatross nimiq-blockchain provides persistent block storage for Nimiq’s Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record would contain a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64 in order to cause a crash. When the victim node’s DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics. This issue has been fixed in version 1.4.0. 2026-05-20 7.5 CVE-2026-40092 NousResearch–hermes-agent A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This affects the function check_all_command_guards of the file tools/approval.py of the component Batch Runner. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 7.3 CVE-2026-9350 NousResearch–hermes-agent A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23. Impacted is an unknown function of the file agent/skills_guard.py of the component Skills Guard Multi-Word Prompt Handler. The manipulation of the argument THREAT_PATTERNS leads to injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 7.3 CVE-2026-9353 NousResearch–hermes-agent A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 7.3 CVE-2026-9366 NousResearch–hermes-agent A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command of the file tools/approval.py of the component terminal_tool. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 7.3 CVE-2026-9367 NousResearch–hermes-agent A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 7.3 CVE-2026-9368 nukeviet–nukeviet NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and attributes in user-submitted content, which can be bypassed by intercepting and modifying HTTP requests directly (e.g., using Burp Suite). An attacker can inject malicious payloads which are stored server-side and executed in the browser of any user who views the content. Anyone viewing user-submitted content (such as administrators and moderators reviewing contact messages or comments) is impacted, and the vulnerability can be exploited by any anonymous visitor without authentication, with the Contact module used only as a proof of concept. Potential consequences include session hijacking through cookie theft, unauthorized actions performed under the victim’s identity, defacement or redirection to phishing pages, and phishing attacks via manipulated email notifications. This issue has been fixed in version 4.5.08. If developers are unable to upgrade immediately, they should work around this issue by implementing server-side HTML sanitization in the Request class to strip or encode dangerous tags and attributes (e.g., <iframe>, srcdoc, event handlers like onerror/onload), enforcing a Content Security Policy (CSP) to restrict inline script execution, and set cookies with the HttpOnly flag to mitigate cookie theft via XSS. 2026-05-22 8.7 CVE-2026-41147 NVIDIA–BioNeMo Framework NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering. 2026-05-20 8.8 CVE-2026-24217 NVIDIA–BioNeMo Framework NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering. 2026-05-20 7.8 CVE-2026-24216 NVIDIA–DGX Spark NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned systems enables host impersonation or attacker-in-the-middle attacks. A successful exploit of this vulnerability might lead to code execution, data tampering, escalation of privileges, information disclosure, and denial of service. 2026-05-20 8.1 CVE-2026-24218 NVIDIA–TensorRT NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to data tampering. 2026-05-20 8.2 CVE-2026-24188 NVIDIA–TensorRT-LLM NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclosure. 2026-05-20 7.5 CVE-2025-33255 NVIDIA–TensorRT-LLM NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclosure. 2026-05-20 7.5 CVE-2026-24163 NVIDIA–Triton Inference Server NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure. 2026-05-20 9.8 CVE-2026-24207 NVIDIA–Triton Inference Server NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, or information disclosure. 2026-05-20 8 CVE-2026-24213 NVIDIA–Triton Inference Server NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering, or denial of service. 2026-05-20 8 CVE-2026-24214 NVIDIA–Triton Inference Server NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or information disclosure. 2026-05-20 7.3 CVE-2026-24206 NVIDIA–Triton Inference Server NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service. 2026-05-20 7.5 CVE-2026-24209 NVIDIA–Triton Inference Server NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to denial of service. 2026-05-20 7.5 CVE-2026-24210 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values parsed from external GPS tracking service XML/JSON responses (InstaMapper and Google Latitude integration) are concatenated into UPDATE and INSERT statements without sanitization. An attacker able to compromise or impersonate the remote GPS tracker endpoint can inject SQL to manipulate the responder location, tracks, and assignment tables. 2026-05-21 8.2 CVE-2026-48235 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network. 2026-05-21 8.1 CVE-2026-48241 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the source to obtain valid configuration values that may match deployed installations. 2026-05-21 8.1 CVE-2026-48242 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are concatenated into table/column identifiers in dynamically constructed SELECT/UPDATE/DELETE statements without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. 2026-05-21 7.1 CVE-2026-48231 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/fullsit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. 2026-05-21 7.1 CVE-2026-48232 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. 2026-05-21 7.1 CVE-2026-48233 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated into the ORDER BY clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. 2026-05-21 7.1 CVE-2026-48234 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) are concatenated into mysqli connection arguments and dynamic SQL operating against an attacker-controlled database without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. 2026-05-21 7.1 CVE-2026-48236 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. 2026-05-21 7.1 CVE-2026-48237 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause of a SELECT statement used as a ticket-existence sanity check without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. 2026-05-21 7.1 CVE-2026-48238 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. 2026-05-21 7.1 CVE-2026-48239 Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. 2026-05-21 7.1 CVE-2026-48240 OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. 2026-05-19 8.1 CVE-2026-24792 OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered. 2026-05-19 8.4 CVE-2026-25781 OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. 2026-05-19 8.8 CVE-2026-27648 OPPO–O+ Connect A local privilege escalation vulnerability exists in O+ Connect because it fails to validate the identity of the caller on the pipe interface. 2026-05-19 7.3 CVE-2026-22069 Piotnet–Piotnet Addons For Elementor Pro The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the ‘pafe_ajax_form_builder’ function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form. 2026-05-19 9.8 CVE-2026-4885 Piotnet–Piotnet Forms The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the ‘piotnetforms_ajax_form_builder’ function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form. 2026-05-19 9.8 CVE-2026-4883 PixelYourSite–Boost The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. 2026-05-20 9.8 CVE-2026-7637 PixelYourSite–Boost The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the ‘current_url’ and ‘user_name’ parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-05-20 7.5 CVE-2026-9010 pixelyoursite–Cost of Goods by PixelYourSite The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘csvdata[0][cost_of_goods_value]’ parameter in versions up to, and including, 1.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2026-05-20 7.2 CVE-2026-7613 PosCube Hardware Software and Consulting Ltd.–QR Menu Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation of Trusted Identifiers. This issue affects QR Menu: through 21052026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-21 7.5 CVE-2025-13479 PowerDNS–Authoritative Insufficient Validation of Autoprimary SOA Queries 2026-05-21 7.5 CVE-2026-42001 projectworlds–hospital-management-system-in-php A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-18 7.3 CVE-2026-8785 projectworlds–Online Art Gallery Shop A flaw has been found in projectworlds Online Art Gallery Shop 1.0. Impacted is an unknown function of the file /admin/adminHome.php. Executing a manipulation of the argument social_linked can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. 2026-05-24 7.3 CVE-2026-9364 prosolution–ProSolution WP Client The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file. 2026-05-20 9.8 CVE-2026-6555 Red Hat–Red Hat build of Keycloak 26.2 A flaw was found in Keycloak’s URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard () in the “Valid Redirect URIs” field and requires user interaction to be successfully exploited. The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java’s URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak’s validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect. 2026-05-19 8.1 CVE-2026-7504 Red Hat–Red Hat build of Keycloak 26.2 A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable. 2026-05-19 7.5 CVE-2026-7307 Red Hat–Red Hat build of Keycloak 26.2 A session fixation vulnerability was found in Keycloak’s login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint-which processes session handles without adequate CSRF protection or cookie ownership validation-an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim’s credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts. 2026-05-19 7.5 CVE-2026-7507 Red Hat–Red Hat build of Keycloak 26.4 A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure. 2026-05-19 7.1 CVE-2026-7571 Red Hat–Red Hat Directory Server 11 A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service. 2026-05-20 7.5 CVE-2026-9064 Red Hat–Red Hat Hardened Images A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service. 2026-05-18 7.5 CVE-2026-42009 Redaxo–Redaxo CMS Mediapool Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist restrictions. Attackers with editor accounts can upload executable files by using obfuscated extensions like php71 or php53 to evade the blacklist filter and execute arbitrary code. 2026-05-23 8.8 CVE-2018-25353 Repute Infosystems–BookingPress Appointment Booking Pro The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ‘bookingpress_validate_submitted_booking_form_func’ function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form. 2026-05-21 9.8 CVE-2026-6960 RsyncProject–rsync Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation. 2026-05-20 8.1 CVE-2026-43618 RsyncProject–rsync Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false. 2026-05-20 7 CVE-2026-29518 ruby-lang–Ruby An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(…, timeout:) or Socket.tcp(…, resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver. 2026-05-22 8.1 CVE-2026-46727 Samsung Open Source–Escargot Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. 2026-05-19 7.8 CVE-2026-47310 Samsung Open Source–Escargot Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. 2026-05-19 7.8 CVE-2026-47311 Samsung Open Source–Escargot Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. 2026-05-19 7.8 CVE-2026-47314 SigmaPlugin–Advanced Database Cleaner Premium The Advanced Database Cleaner - Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the ‘template’ parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. 2026-05-20 8.8 CVE-2026-7522 Significant-Gravitas–AutoGPT AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are vulnerable to Authenticated Session Hijacking via IDOR. If an authenticated attacker can determine the session_id of another user’s session, they can take it over, reading any messages in it and locking the legitimate user out. The PATCH /sessions/{session_id}/assign-user endpoint authenticates the caller but never verifies session ownership: the service layer invokes the session lookup with user_id=None, which the data access layer interprets as a privileged/system call that bypasses the ownership filter, allowing any authenticated user to reassign an arbitrary session to themselves. This issue has been patched in version 0.6.51. 2026-05-18 7.1 CVE-2026-30950 Significant-Gravitas–AutoGPT AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vulnerable to an unauthenticated Denial of Service (DoS) through the server due to uncontrolled disk space consumption. The download_agent_file endpoint creates persistent temporary files for every request but fails to delete them after they are served. An unauthenticated attacker can repeatedly call this endpoint to exhaust the server’s disk space, causing the database or other system services to fail due to “No space left on device” errors, rendering the entire AutoGPT Platform backend unavailable to all users. This issue has been patched in version 0.6.52. 2026-05-19 7.5 CVE-2026-33232 Significant-Gravitas–AutoGPT AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.6.34 through 0.6.51, the backend deserializes Redis cache bytes using pickle.loads without integrity/authenticity checks. The write path serializes values with pickle.dumps(…) into Redis and the read path blindly invokes pickle.loads(…) on bytes with no HMAC/signature or strict schema validation gating deserialization. If an attacker can poison a shared-cache key in Redis, arbitrary command execution is possible in the backend container context, affecting confidentiality, integrity, and availability. This issue has been fixed in version 0.6.52. 2026-05-19 7.6 CVE-2026-33233 Sipp–SIPp SIPp 3.6 and earlier contains a local buffer overflow vulnerability in command-line argument handling that allows local attackers to crash the application or execute arbitrary code. Attackers can trigger the vulnerability by supplying oversized input to the -3pcc, -i, or -log_file parameters, causing strcpy to write beyond buffer boundaries in sipp.cpp. 2026-05-23 8.4 CVE-2018-25356 Sitemio Information Technologies Trade Ltd. Co.–WISECP Cross-Site request forgery (CSRF) vulnerability in Sitemio Information Technologies Trade Ltd. Co. WISECP allows Cross Site Request Forgery. This issue affects WISECP: through 20022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-20 8 CVE-2025-11954 SourceCodester–Hospitals Patient Records Management System A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_patient_history. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. 2026-05-24 7.3 CVE-2026-9355 SourceCodester–Hospitals Patient Records Management System A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. This affects an unknown function of the file /admin/patients/manage_history.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. 2026-05-24 7.3 CVE-2026-9356 Splunk–Splunk Enterprise In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the _internal index could view session cookies and response bodies that contain sensitive data. 2026-05-20 7.5 CVE-2026-20239 Splunk–Splunk Enterprise In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause a Denial of Service by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.

The Denial of Service is possible because of missing input validation in the coldToFrozen.sh script, which accepts arbitrary file paths and renames them without restricting operations to safe directories. 2026-05-20 7.1 CVE-2026-20240 steipete–summarize Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction. 2026-05-18 7.1 CVE-2026-45242 steipete–summarize Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content. 2026-05-18 7.4 CVE-2026-45245 strukturag–libheif libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1Ã—4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0. 2026-05-19 8.8 CVE-2026-32740 strukturag–libheif libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file containing a mask image (mski), the function copies the full iloc extent data into a pixel buffer using memcpy(dst, data.data(), data.size()). The copy length data.size() is determined by the iloc extent in the file (attacker-controlled), while the destination buffer is sized based on the declared image dimensions. Because no upper-bound check exists on the data length, a crafted file whose iloc extent exceeds the pixel buffer allocation overflows the heap. The vulnerable single-memcpy branch is reached when the mskC property specifies bits_per_pixel = 8 and the ispe property declares an even width â‰¥ 64 (so that stride == width), with no changes to default security limits or external codec plugins required. This issue has been fixed in version 1.22.0. 2026-05-19 7.1 CVE-2026-32741 strukturag–libheif libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc. When compositing an overlay image (iovl) whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride (in_stride) instead of the previously retrieved alpha_stride, causing reads past the end of the alpha buffer (up to 3,123 bytes for a 100Ã—50 image with 10-bit color and 8-bit alpha). A crafted HEIF file can exploit this to cause a denial of service (crash) or potentially disclose adjacent heap memory through leaked bytes embedded in the decoded output pixels. This issue has been fixed in versionThis issue has been fixed in version 1.22.0. 2026-05-19 7.1 CVE-2026-32882 SUSE–Container suse/sle-micro-rancher/5.3:latest In src/havegecmd.c, the socket_handler function performs a credential check on the abstract UNIX socket (\0/sys/entropy/haveged). However, while it detects if the connecting user is not root (cred.uid != 0) and prepares a negative acknowledgement (ASCII_NAK), it fails to stop execution. The code proceeds to the switch statement, allowing any local unprivileged user to execute privileged commands such as MAGIC_CHROOT. 2026-05-20 7.8 CVE-2026-41054 SUSE–SUSE Linux Enterprise PluginScript attempts to chroot the plugin to the repoManagerRoot, this root is frequently / (the system root) in standard configurations or when using --root. If the chroot target is /, it is a no-op, allowing the traversed path to execute host binaries (like /bin/bash) with root privileges. 2026-05-20 7.8 CVE-2026-44933 syslink software AG–Avantra Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay). This issue affects Avantra: before 25.3.1. 2026-05-22 9.6 CVE-2026-8670 syslink software AG–Avantra Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure. This issue affects Avantra: before 25.3.0. 2026-05-22 7.5 CVE-2026-8671 Taiko Network Communications Pte Ltd.–AG1000-01A SMS Alert Gateway Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device. 2026-05-20 9.8 CVE-2026-9139 Taiko Network Communications Pte Ltd.–AG1000-01A SMS Alert Gateway Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenticated attackers to access internal application pages without any session management or server-side authentication checks. Attackers with network access can directly request internal resources such as index.zhtml, point.zhtml, and log.shtml to gain full administrative read and write access, enabling unauthorized modification of alarm routing, device configuration, and disruption of monitoring and control functions. 2026-05-20 9.8 CVE-2026-9141 Taiko Network Communications Pte Ltd.–AG1000-01A SMS Alert Gateway Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious payloads across multiple administrative form fields. Attackers can bypass front-end length restrictions using JavaScript comments and template literals to concatenate executable script fragments that are rendered in administrative dashboard views such as index.zhtml, resulting in persistent script execution within administrative sessions. 2026-05-20 7.6 CVE-2026-9144 Talend–Talend Administration Center A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio update URL. This issue was resolved in a patch, which is already available. 2026-05-20 8.2 CVE-2026-9057 tenable–Terrascan Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) when running in server mode. An unauthenticated remote attacker can supply an arbitrary URL as the webhook_url multipart form parameter. After scanning the uploaded file, Terrascan sends an HTTP POST request to the attacker-controlled URL containing the full scan results as a JSON body, with the attacker-supplied webhook_token forwarded as a Bearer token in the Authorization header. The retryable HTTP client retries up to 10 times on failure. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released. 2026-05-19 7.5 CVE-2026-47356 tenable–Terrascan Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated remote attacker can supply an attacker-controlled HTTP URL as remote_url with remote_type set to “http”. The URL is passed directly to hashicorp/go-getter (v1.7.5) without validation. Go-getter’s HttpGetter supports the X-Terraform-Get response header, allowing the attacker’s server to redirect the download to a file:// URL, enabling local file read. Additionally, HttpGetter has Netrc set to true, causing it to read ~/.netrc and send stored credentials to attacker-controlled hostnames. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released. 2026-05-19 7.5 CVE-2026-47357 tenable–Terrascan Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves external URLs referenced within those templates via hashicorp/go-getter with all default detectors enabled, including FileDetector. An unauthenticated remote attacker can upload an ARM template containing a templateLink.uri or parametersLink.uri field, or a CloudFormation template containing an AWS::CloudFormation::Stack TemplateURL field, pointing to an attacker-controlled URL. Terrascan will fetch the attacker-controlled URL server-side. Unlike SSRF via the remote scan endpoint, file:// URLs are directly usable without requiring an X-Terraform-Get redirect, enabling local file read. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released. 2026-05-19 7.5 CVE-2026-47358 Tenda–F456 A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. 2026-05-24 8.8 CVE-2026-9389 themefusion–Avada (Fusion) Builder The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the wp_conditional_tags case in Fusion_Builder_Conditional_Render_Helper::get_value() passing attacker-controlled values from a base64-decoded JSON blob directly to call_user_func() without any allowlist validation. This is exploitable by unauthenticated attackers through the fusion_get_widget_markup AJAX endpoint, which is registered for non-privileged (unauthenticated) users via wp_ajax_nopriv_fusion_get_widget_markup. The endpoint is protected only by a nonce (fusion_load_nonce), but this nonce is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public-facing page containing a Post Cards ([fusion_post_cards]) or Table of Contents ([fusion_table_of_contents]) element. This makes it possible for unauthenticated attackers to execute arbitrary code on affected sites. 2026-05-21 9.8 CVE-2026-6279 themeum–Kirki Freeform Page Builder, Website Builder & Customizer The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the ‘downloadZIP’ function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory. 2026-05-19 7.5 CVE-2026-8073 themewant–Easy Elements for Elementor Addons & Website Templates The Easy Elements for Elementor - Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the ‘easyel_handle_register’ function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the ‘administrator’ role during registration and gain administrator access to the site. 2026-05-20 9.8 CVE-2026-7284 themewant–Easy Elements for Elementor Addons & Website Templates The Easy Elements for Elementor - Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the easyel_handle_register() function. This is due to the wp_ajax_nopriv_eel_register AJAX handler iterating the attacker-controlled custom_meta POST array and writing every supplied key-value pair to the newly created user’s meta via update_user_meta() without any key whitelist or blocklist, allowing the wp_capabilities user meta key to be overwritten after wp_insert_user() has already assigned a safe role. This makes it possible for unauthenticated attackers to register a new account with full administrator-level privileges by supplying custom_meta[wp_capabilities][administrator]=1. Exploitation requires that user registration is enabled on the site and that at least one page exposes the Login/Register widget, which publishes the required easy_elements_nonce into the page DOM where it can be retrieved by any unauthenticated visitor via a simple GET request. 2026-05-22 8.8 CVE-2026-9018 TONNET–TPR7308 E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents. 2026-05-20 7.5 CVE-2026-9003 Totolink–A8000RU A vulnerability was found in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument ip results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. 2026-05-24 9.8 CVE-2026-9384 Totolink–A8000RU A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument command causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. 2026-05-24 9.8 CVE-2026-9385 Totolink–A8000RU A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument lang leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used. 2026-05-24 9.8 CVE-2026-9386 Totolink–A8000RU A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. 2026-05-24 9.8 CVE-2026-9387 Totolink–A8000RU A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument mode can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. 2026-05-24 9.8 CVE-2026-9388 Totolink–A8000RU A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used. 2026-05-24 9.8 CVE-2026-9404 Totolink–A8000RU A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. 2026-05-24 9.8 CVE-2026-9405 Totolink–A8000RU A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. 2026-05-24 9.8 CVE-2026-9406 Totolink–A8000RU A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setFirewallType of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument firewallType leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. 2026-05-24 9.8 CVE-2026-9407 Trend Micro, Inc.–TrendAI Apex One A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their consoleï¿½s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied. 2026-05-21 9.8 CVE-2025-71210 Trend Micro, Inc.–TrendAI Apex One A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their consoleï¿½s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied. 2026-05-21 9.8 CVE-2025-71211 Trend Micro, Inc.–TrendAI Apex One A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2026-05-21 7.8 CVE-2025-71212 Trend Micro, Inc.–TrendAI Apex One An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2026-05-21 7.8 CVE-2025-71213 Trend Micro, Inc.–TrendAI Apex One An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2026-05-21 7.8 CVE-2026-34927 Trend Micro, Inc.–TrendAI Apex One An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2026-05-21 7.8 CVE-2026-34928 Trend Micro, Inc.–TrendAI Apex One An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2026-05-21 7.8 CVE-2026-34929 Trend Micro, Inc.–TrendAI Apex One An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2026-05-21 7.8 CVE-2026-34930 Trend Micro, Inc.–TrendAI Apex One An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2026-05-21 7.8 CVE-2026-45206 Trend Micro, Inc.–TrendAI Apex One An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45206 but exists in a different process protection communication mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2026-05-21 7.8 CVE-2026-45207 Trend Micro, Inc.–TrendAI Apex One A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2026-05-21 7.8 CVE-2026-45208 TriliumNext–Trilium Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Clipper API in Trilium Desktop (v0.101.3) allows full authentication bypass when running in an Electron environment. When Trilium detects an Electron environment, it explicitly disables authentication middleware for the Clipper API, exposing endpoints such as /api/clipper/notes to the network with no password, API token, or CSRF protection. An attacker on a shared network (for example, a corporate LAN or public Wi-Fi) can scan for open high-range ports using a tool like nmap, since Trilium often binds to ports such as 37840. Once a candidate port is found, an unauthenticated request to the Clipper handshake endpoint, which also bypasses authentication, confirms a Trilium instance by returning the application name and protocol version. This facilitates unauthorized data access, phishing, and local system compromise. The issue has been fixed in version 0.102.2. 2026-05-20 8.6 CVE-2026-39310 twigphp–Twig Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally. 2026-05-20 8.8 CVE-2026-24425 Tyler Technologies–TID-L Tyler Identity Local (TID-L) uses documented, default administrative credentials. Users are not required to change the credentials before deployment. TID-L has not been distributed since December 2020, and has not been supported since 2021. 2026-05-19 9.8 CVE-2026-44159 Ubiquiti Inc–UniFi OS Server A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system. 2026-05-22 10 CVE-2026-34908 Ubiquiti Inc–UniFi OS Server A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account. 2026-05-22 10 CVE-2026-34909 Ubiquiti Inc–UniFi OS Server A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. 2026-05-22 10 CVE-2026-34910 Ubiquiti Inc–UniFi OS Server A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. 2026-05-22 9.1 CVE-2026-33000 Ubiquiti Inc–UniFi OS Server A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information. 2026-05-22 7.7 CVE-2026-34911 ultimate-form-builder-lite–Ultimate Form Builder Lite WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the entry_id POST parameter. Attackers can send POST requests to the admin-ajax.php endpoint with the ufbl_get_entry_detail_action action to extract, modify, or escalate privileges within the WordPress database. 2026-05-23 7.1 CVE-2018-25352 UserSpice–userSpice userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the ‘taken’ string to identify existing accounts in the system. 2026-05-23 9.8 CVE-2018-25350 web-dorado–Contact Form Maker WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the ‘name’ and ‘search_labels’ parameters to extract sensitive database information or escalate privileges. 2026-05-23 7.1 CVE-2018-25347 webdriverio–webdriverio WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution (RCE) in test orchestration. Git permits branch names containing shell metacharacters, and getGitMetadataForAISelection() interpolates these names directly into execSync() calls without sanitization. An attacker can exploit this by supplying a malicious repository (via testOrchestrationOptions.runSmartSelection.source, or the current directory if unset) whose branch name carries a payload, causing the shell to execute arbitrary code. This enables remote code execution on CI/CD servers and developer machines, leading to credential and secret disclosure, source code and SSH key exfiltration, system compromise, and supply chain attacks via tampered build artifacts. The issue has been fixed in version 9.24.0. 2026-05-18 9.8 CVE-2026-25244 weDevs–WP ERP Pro The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the ‘search_key’ parameter in all versions up to, and including, 1.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-05-22 7.5 CVE-2026-4834 windmill-labs–windmill Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated users to write arbitrary entries to /etc/hosts, /etc/resolv.conf, and /etc/ssl/certs/ca-certificates.crt from within script execution sandboxes. Attackers can exploit persistent poisoned entries across all subsequent script executions on the same worker pod to redirect hostnames, intercept DNS queries, perform transparent HTTPS man-in-the-middle attacks, and intercept WM_TOKEN JWTs to gain workspace-admin access to other users’ workspaces. 2026-05-19 8.1 CVE-2026-47107 Wishlist Member–Wishlist Member The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in versions up to and including 3.30.1. This is due to the missing capability and nonce check in the ajax_get_screen() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to supply an arbitrary admin screen identifier via the data[url] parameter, causing the plugin to load and execute the administrative API configuration template without authorization. The rendered HTML, which contains the plugin’s plaintext REST API Secret Key, is returned directly to the attacker in the AJAX JSON response. An attacker who obtains this key can authenticate to the WishList Member API, create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover. 2026-05-23 8.8 CVE-2026-6419 Wishlist Member–Wishlist Member The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to and including 3.30.1. This is due to the missing capability checks in the ‘export_settings’ function. This function returns the REST API Secret Key to the attacker in the AJAX JSON response. An attacker who obtains this key can authenticate to the WishList Member API, create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover. 2026-05-23 8.8 CVE-2026-6895 Wishlist Member–Wishlist Member The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘WishListMember\Features\Team_Accounts::save_settings’ function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options, includes the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover. 2026-05-23 8.8 CVE-2026-6897 Wishlist Member–Wishlist Member The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘WishListMember3_Hooks::generate_api_key’ function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover. 2026-05-23 8.8 CVE-2026-6898 woocommerce–WooCommerce PayPal Payments The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the ppc-create-order and ppc-get-order WC-AJAX endpoints in all versions up to, and including, 4.0.1. The ppc-create-order endpoint accepts an arbitrary WooCommerce order ID in the pay-now context without validating order ownership, allowing attackers to create PayPal orders for any WC order and write PayPal metadata to it. The ppc-get-order endpoint returns full PayPal order details for any PayPal order ID without binding to the requester’s session. This makes it possible for unauthenticated attackers to chain these endpoints to manipulate other customers’ order payment flows and exfiltrate sensitive order details (payer information, shipping data) by creating a PayPal order for a victim’s WC order and then retrieving the PayPal order data. 2026-05-23 8.2 CVE-2026-9284 Wp Directory Kit–WP Directory Kit Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0. 2026-05-21 9.3 CVE-2026-39531 WP Swings–Gift Cards For WooCommerce Pro Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6. 2026-05-20 10 CVE-2026-45444 yiisoft–yii2 Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Local File Inclusion. The function calls extract($_params, EXTR_OVERWRITE) before the require statement that loads the view file. As a result, a caller-controlled file key in the $params array overwrites the internal local variable specifying which file to include, potentially enabling RCE if an attacker can write PHP files through a separate primitive, as well as information disclosure. This issue has been fixed in version 2.0.55. 2026-05-20 7.4 CVE-2026-39850 YITH–YITH WooCommerce Product Add-Ons Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0. 2026-05-20 7.6 CVE-2026-42383 ZKTeco–SSC335-GC2063-Face-0b77 Solution Camera An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials. 2026-05-20 9.1 CVE-2026-8598 Zohocorp–ManageEngine ADSelfService Plus Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency. 2026-05-21 8.4 CVE-2026-2740 Back to top Medium Vulnerabilities Primary Vendor – Product Description Published CVSS Score Source Info Patch Info 546669204–vps-inventory-monitoring A vulnerability was determined in 546669204 vps-inventory-monitoring up to 98c00b370668c96ae75e91c15548d9ea113652d9. This issue affects the function eval of the file app/index/command/VpsTest.php of the component VpsTest Console. Executing a manipulation of the argument vf can lead to code injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-23 6.3 CVE-2026-9302 VDB-365249 546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection VDB-365249 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811843 546669204 vps-inventory-monitoring <=98c00b3 Code Injection / Eval Injection https://github.com/546669204/vps-inventory-monitoring/issues/36 https://github.com/dntyfate/cve/issues/2 https://github.com/546669204/vps-inventory-monitoring/ ADD-ONS.ORG–PDF for Elementor Forms + Drag And Drop Template Builder Missing Authorization vulnerability in ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Template Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through 5.5.1. 2026-05-20 5 CVE-2026-45443 https://patchstack.com/database/wordpress/plugin/pdf-for-elementor-forms/vulnerability/wordpress-pdf-for-elementor-forms-drag-and-drop-template-builder-plugin-5-5-1-broken-access-control-vulnerability?s_id=cve askywhale–Games Catalog The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the gc_crud() function which handles the delete action (action=delete) via a GET request without any wp_verify_nonce() / check_admin_referer() call. This makes it possible for unauthenticated attackers to delete arbitrary game catalog entries (including the associated WordPress post created for the game) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. 2026-05-20 4.3 CVE-2026-8418 https://www.wordfence.com/threat-intel/vulnerabilities/id/0888cda8-63ca-44f6-a3eb-765c14a7e6c7?source=cve https://plugins.trac.wordpress.org/browser/game-catalog/trunk/admin-crud.php#L94 https://plugins.trac.wordpress.org/browser/game-catalog/tags/1.2.0/admin-crud.php#L94 https://plugins.trac.wordpress.org/browser/game-catalog/trunk/admin-crud.php#L31 https://plugins.trac.wordpress.org/browser/game-catalog/tags/1.2.0/admin-crud.php#L31 https://plugins.trac.wordpress.org/browser/game-catalog/trunk/games-catalog.php#L96 https://plugins.trac.wordpress.org/browser/game-catalog/tags/1.2.0/games-catalog.php#L96 baptisteArno–typebot.io Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller against the provided typebotId but fetches logs solely by resultId without verifying that the result belongs to the authorized typebot, leading to IDOR. An authenticated attacker can supply their own typebotId alongside any victim’s resultId to read execution logs from other workspaces, leaking sensitive data including HTTP response bodies, AI model outputs, and webhook payloads. Every other result-scoped endpoint in the same router properly validates that the resultId belongs to the authorized typebotId. This confirms the missing check is an oversight, not a design choice. This issue has been fixed in version 3.15.2. 2026-05-22 6.5 CVE-2026-28444 https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-c63p-mqx5-75r7 https://github.com/baptisteArno/typebot.io/commit/d82b2d47c86ae614a08d4073c669ca64442faff2 https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 baptisteArno–typebot.io TypeBot is a chatbot builder tool. In versions 3.15.2, the getLinkedTypebots API endpoint returns full bot definitions to any authenticated user who references a target bot ID in a Typebot Link block, regardless of workspace ownership, leading to IDOR. The authorization check uses Array.filter() with an async callback - since filter() is synchronous, the callback always returns a truthy Promise, so the access control predicate is never actually evaluated. Any authenticated Typebot user can read the full definition of any other workspace’s private bots, including: all conversation blocks and logic flow, variable values embedded in the bot (credentials, API keys, PII), webhook URLs and integration configurations. This issue has been fixed in version 3.16.0. 2026-05-22 6.5 CVE-2026-39966 https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-3fr5-999r-84qj https://github.com/baptisteArno/typebot.io/commit/b9530a089b43bfa6e79e3ff9cbfab921ce832f45 https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 baptisteArno–typebot.io TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) does not verify the x-hub-signature-256 HMAC signature included by Meta in every webhook delivery. The webhook URL exposes both workspaceId and credentialsId as path parameters, which are logged in web server access logs, visible in Meta’s webhook configuration dashboard, and potentially shared when configuring integrations. This allows any unauthenticated attacker to send spoofed webhook messages to trigger bot flows, consume API resources, and interact with external services using the workspace owner’s credentials. The issue has been fixed in version 3.17.0. 2026-05-22 6.5 CVE-2026-39969 https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-8vqp-r5w7-v47f https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.0 baptisteArno–typebot.io TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor’s browser context when clicked. Since the viewer is typically embedded in a third-party site, the attacker’s JavaScript runs in the host page’s origin and can exfiltrate cookies and session tokens. This can result in any authenticated Typebot user (including those on the free tier) being able to create a bot with this payload. Shared bots are publicly accessible - no victim authentication is required. This issue has been resolved in version 3.16.0. 2026-05-22 5.4 CVE-2026-39964 https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-hqmv-v56g-4m47 https://github.com/baptisteArno/typebot.io/commit/2c3fc7267a5e1529ba4b1a2ab4f1edb3e3b8990b https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 Behance–Smartshop Smartshop 1 contains a cross-site request forgery vulnerability that allows attackers to modify user profiles by tricking authenticated users into submitting malicious requests. Attackers can craft HTML forms targeting editprofile.php with hidden fields for email and password parameters that execute automatically when visited by an authenticated admin user. 2026-05-23 4.3 CVE-2018-25343 ExploitDB-44824 Official Product Homepage Product Reference VulnCheck Advisory: Smartshop 1 Cross-Site Request Forgery via editprofile.php bentoml–BentoML BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.38 and prior, the build packaging workflow follows attacker-controlled symlinks inside the build context and copies the referenced file contents into the generated Bento artifact. If a victim builds an untrusted repository or other attacker-supplied build context, the attacker can place a symlink such as loot.txt -> /tmp/outside-marker.txt or a link to a more sensitive local file. When bentoml build runs, BentoML dereferences the symlink and packages the target file contents into the Bento. The leaked file can then propagate further through export, push, or containerization workflows. An attacker can exfiltrate local files from the build host into the Bento artifact, exposing secrets such as cloud credentials, SSH keys, API tokens, environment files, or other sensitive local configurations. Because Bento artifacts are commonly exported, uploaded, stored, or containerized after build, the leaked file contents can spread beyond the original build machine. This issue has been fixed in version 1.4.39. 2026-05-22 5.5 CVE-2026-40610 https://github.com/bentoml/BentoML/security/advisories/GHSA-mcfx-4vc6-qgxv https://github.com/bentoml/BentoML/commit/5fb7cd41f92e2a56b45391284cf15b9ac9963a1f https://github.com/bentoml/BentoML/releases/tag/v1.4.39 bestpractical–rt RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by avoiding opening exported RT spreadsheet files directly in spreadsheet applications when the data may contain untrusted user input. 2026-05-22 4.6 CVE-2026-41073 https://github.com/bestpractical/rt/security/advisories/GHSA-6x92-7v65-7m3r https://github.com/bestpractical/rt/releases/tag/rt-5.0.10 https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 bigbluebutton–bigbluebutton BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user’s input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19. 2026-05-18 6.5 CVE-2026-27737 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8vv7-vj94-q2pv https://github.com/bigbluebutton/bbb-playback/commit/09e89bfe4ff8488b68c3ff040d3081e419dc89b1 https://github.com/bigbluebutton/bigbluebutton/commit/69f45aa1b963dc7d80179d0155acc670aec5c4fc https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.19 https://github.com/blindsidenetworks/scalelite/releases/tag/v1.7.0 Brainstorm Force–Presto Player Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Presto Player: from n/a through 4.1.3. 2026-05-19 4.3 CVE-2026-45442 https://patchstack.com/database/wordpress/plugin/presto-player/vulnerability/wordpress-presto-player-plugin-4-1-3-broken-access-control-vulnerability?_s_id=cve broadstreetads–Broadstreet The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata. 2026-05-21 4.3 CVE-2026-1881 https://www.wordfence.com/threat-intel/vulnerabilities/id/328ccf8f-797b-4b1a-b0f1-afd8e44f41e6?source=cve https://plugins.trac.wordpress.org/changeset?old_path=%2Fbroadstreet/tags/1.52.2&new_path=%2Fbroadstreet/tags/1.53.2 burlingtonbytes–WP Blockade Visual Page Builder The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to and including 0.9.14. This is due to insufficient input sanitization and output escaping in the render_shortcode_preview() function. The function receives user input from $_GET[‘shortcode’], passes it through stripslashes() without any sanitization, and then outputs it directly via echo do_shortcode($shortcode) on line 393. When the input is not a valid WordPress shortcode (e.g., an HTML tag with JavaScript event handlers), do_shortcode() returns it unchanged, and it is reflected into the page without escaping. The endpoint is registered via admin_post (not admin_post_nopriv_), meaning it requires the user to be logged in with at minimum a Subscriber-level account. There is no nonce verification or additional capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute if they can successfully trick a user into performing an action such as clicking a link. 2026-05-22 6.1 CVE-2026-3481 https://www.wordfence.com/threat-intel/vulnerabilities/id/66950509-ce2a-42fe-a8b2-2a92a1b573c3?source=cve https://plugins.trac.wordpress.org/browser/wp-blockade/trunk/wp-blockade.php#L393 https://plugins.trac.wordpress.org/browser/wp-blockade/tags/0.9.14/wp-blockade.php#L393 https://plugins.trac.wordpress.org/browser/wp-blockade/trunk/wp-blockade.php#L360 https://plugins.trac.wordpress.org/browser/wp-blockade/tags/0.9.14/wp-blockade.php#L360 calcom–cal.diy A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-23 5 CVE-2026-9304 VDB-365251 calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery VDB-365251 CTI Indicators (IOB, IOC, IOA) Submit #812176 cal.com <= v4.9.4 Server-Side Request Forgery (CWE-918) https://gist.github.com/YLChen-007/b3d0b85767b7e346a291933d602fbb3b calcom–cal.diy A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument cancelledBy/rescheduledBy causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 5.3 CVE-2026-9349 VDB-365312 calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure VDB-365312 CTI Indicators (IOB, IOC, TTP, IOA) Submit #812177 cal.com <= v4.9.4 Exposure of Sensitive Information (CWE-200) https://gist.github.com/YLChen-007/b59c44d1550c4b0f373ca4eb1c150994 calcom–cal.diy A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-23 4.3 CVE-2026-9303 VDB-365250 calcom cal.diy cross-site request forgery VDB-365250 CTI Indicators (IOB, IOC) Submit #812173 cal.com <= v4.9.4 Cross-Site Request Forgery (CWE-352) Submit #812175 cal.com <= v4.9.4 Cross-Site Request Forgery (CWE-352) (Duplicate) https://gist.github.com/YLChen-007/26663d9558e15994176dc420d2e11d48 https://gist.github.com/YLChen-007/dafada36e356bc895b09829d8ec57e49 Cisco–Cisco NX-OS Software A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to trigger BGP peer flaps, resulting in a denial of service (DoS) condition. This vulnerability is due to incorrect parsing of a transitive BGP attribute. An attacker could exploit this vulnerability by sending a crafted BGP update through an established BGP peer session. If the update propagates to an affected device, it could cause the device to drop the BGP session and flap with the BGP peer that is forwarding this update, resulting in a DoS condition. 2026-05-20 6.8 CVE-2026-20171 cisco-sa-bgp-iefab-3hb2pwtx Cisco–Cisco ThousandEyes Enterprise Agent A vulnerability in the BrowserBot component of Cisco ThousandEyes Enterprise Agent could have allowed an authenticated, remote attacker to execute arbitrary commands on Agents on behalf of the BrowserBot synthetics orchestration process. Cisco has addressed this vulnerability in the Cisco ThousandEyes Enterprise Agent, and no customer action is needed. This vulnerability was due to insufficient input validation of command arguments that are supplied by the user. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by authenticating to the ThousandEyes SaaS and submitting crafted input into the affected parameter. A successful exploit could have allowed the attacker to execute arbitrary commands within the BrowserBot container as the node user. To exploit this vulnerability, the attacker must have valid user credentials for the ThousandEyes SaaS and the ability to manage transaction tests. 2026-05-20 6.3 CVE-2026-20206 cisco-sa-tebbot-cmdinj-wN3yQ5gn Cisco–Cisco ThousandEyes Enterprise Agent A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to execute commands on the underlying operating system as the root user. This vulnerability is due to insufficient validation of user-supplied input. An authenticated attacker could exploit this vulnerability by uploading a crafted certificate to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials. 2026-05-20 4.7 CVE-2026-20199 cisco-sa-tevacert-rce-RMJVEym5 conoha–TypeSquare Webfonts for ConoHa The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin’s site-wide font settings, including the typesquare_auth option (fontThemeUseType), show_post_form, and typesquare_fonttheme, by submitting a POST request to any wp-admin page. For fontThemeUseType values 1 and 3, no nonce verification is performed either, meaning those branches are additionally exploitable via cross-site request forgery. 2026-05-20 4.3 CVE-2026-8610 https://www.wordfence.com/threat-intel/vulnerabilities/id/88002a25-6890-4f8b-8a11-239b59d56672?source=cve https://plugins.trac.wordpress.org/browser/ts-webfonts-for-conoha/tags/2.0.4/typesquare-admin.php#L93 https://plugins.trac.wordpress.org/browser/ts-webfonts-for-conoha/tags/2.0.4/inc/class/class.auth.php#L51 https://plugins.trac.wordpress.org/browser/ts-webfonts-for-conoha/tags/2.0.4/typesquare-admin.php#L25 cryptpad–cryptpad CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Diffmarked.js can be bypassed due to incomplete attribute filtering on restricted tags. The sanitizer validates only the src attribute of <iframe>, Edimax BR-6228NC POST Request mp command injection VDB-364399 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811529 EDIMAX BR6228NC BR-6228NCv2 (Version : v1.22) Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6228NC-mp-34b53a41781f80db8aaed24e43ea24b9?source=copy_link Edimax–BR-6428NS A vulnerability was found in Edimax BR-6428NS 1.10. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. Performing a manipulation of the argument stadrv_ssid results in command injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-18 6.3 CVE-2026-8777 VDB-364402 Edimax BR-6428NS POST Request formStaDrvSetup command injection VDB-364402 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811532 EDIMAX BR-6428NS BR-6428NS_v4_1.10 Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6428NS-formStaDrvSetup-34b53a41781f80ca940cc467cd15dfc2?source=copy_link Edimax–BR-6428NS A weakness has been identified in Edimax BR-6428NS 1.10. This impacts the function system of the file /goform/formWlanM of the component POST Request Handler. Executing a manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/ateTxFreqOffset/ateMode/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/e2pTxPwDeltaN/readE2P can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-23 6.3 CVE-2026-9296 VDB-365243 Edimax BR-6428NS POST Request formWlanM system command injection VDB-365243 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811535 EDIMAX BR-6428NS BR-6428NS_v4_1.10 Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6428NS-formWlanMP-34b53a41781f808fb207ce3f297db80b?source=copy_link Edimax–BR-6428NS A security vulnerability has been detected in Edimax BR-6428NS 1.10. Affected is the function formWlbasic of the file /goform/formWlbasic of the component POST Request Handler. The manipulation of the argument repeaterSSID leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-23 6.3 CVE-2026-9297 VDB-365244 Edimax BR-6428NS POST Request formWlbasic command injection VDB-365244 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811536 EDIMAX BR-6428NS BR-6428NS_v4_1.10 Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6428NS-formWlbasic-34b53a41781f807fb398dbab03bdbb38?source=copy_link Edimax–BR-6675nD A security flaw has been discovered in Edimax BR-6675nD 1.12. This affects the function formHwSet of the file /goform/formHwSet of the component POST Request Handler. The manipulation of the argument regDomain/ABandregDomain/nic0Addr/nic1Addr/wlanAddr/inicAddr results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9378 VDB-365341 Edimax BR-6675nD POST Request formHwSet command injection VDB-365341 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811555 EDIMAX BR-6675nD BR-6675nD v1.12 Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formHwSet-34b53a41781f8077b588f6e7cbbed36b?source=copy_link Edimax–BR-6675nD A weakness has been identified in Edimax BR-6675nD 1.12. This impacts the function formWpsStart of the file /goform/formWpsStart of the component POST Request Handler. This manipulation of the argument pinCode causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9379 VDB-365342 Edimax BR-6675nD POST Request formWpsStart command injection VDB-365342 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811556 EDIMAX BR-6675nD BR-6675nD v1.12 Command Injection Submit #811567 EDIMAX BR-6675nD BR-6675nD v1.12 Command Injection (Duplicate) https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formWpsStart-34b53a41781f8011b77ac5ebb77dfddd?source=copy_link Edimax–BR-6675nD A flaw has been found in Edimax BR-6675nD 1.12. This issue affects the function formUSBStorage of the file /goform/formUSBStorage of the component POST Request Handler. Executing a manipulation of the argument sub_dir can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9400 VDB-365381 Edimax BR-6675nD POST Request formUSBStorage command injection VDB-365381 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811562 EDIMAX BR-6675nD BR-6675nD v1.12 Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formUSBStorage-34b53a41781f80809fc9e6ab3c51328b?source=copy_link Edimax–BR-6675nD A vulnerability was found in Edimax BR-6675nD 1.12. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component POST Request Handler. The manipulation of the argument ateFunc/ateGain/ateRate/ateChan/ateTxCount/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/ateTxFreqOffset/ateMode/ateMacID/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/readE2P/e2pTxPwDeltaN results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9402 VDB-365383 Edimax BR-6675nD POST Request formWlanMP command injection VDB-365383 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811565 EDIMAX BR-6675nD BR-6675nD v1.12 Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formWlanMP-34b53a41781f8041aa2ecb4fa1927f59?source=copy_link Edimax–EW-7438RPn A weakness has been identified in Edimax EW-7438RPn up to 1.31. The affected element is the function formWpsStart of the file /goform/formWpsStart of the component webs. This manipulation of the argument pinCode causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-23 6.3 CVE-2026-9343 VDB-365306 Edimax EW-7438RPn webs formWpsStart os command injection VDB-365306 CTI Indicators (IOB, IOC, TTP, IOA) Submit #813884 Edimax EW-7438RPn 1.31 Command Injection Submit #811551 EDIMAX EW-7438RPn Mini EW-7438RPn Mini Firmware 1.28a (Version : 1.28a) Command Injection (Duplicate) https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_1/1.md Edimax–EW-7438RPn A vulnerability has been found in Edimax EW-7438RPn up to 1.31. Affected is the function formWizSurvey of the file /goform/formWizSurvey of the component webs. The manipulation of the argument ip/mask/gateway leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9347 VDB-365310 Edimax EW-7438RPn webs formWizSurvey os command injection VDB-365310 CTI Indicators (IOB, IOC, TTP, IOA) Submit #813889 Edimax EW-7438RPn 1.31 Command Injection Submit #811543 EDIMAX EW-7438RPn Mini EW-7438RPn Mini Firmware 1.28a (Version : 1.28a) Command Injection (Duplicate) https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_5/5.md Edimax–EW-7438RPn A vulnerability was identified in Edimax EW-7438RPn 1.28a. Affected by this vulnerability is the function formHwSet of the file /goform/formHwSet of the component POST Request Handler. The manipulation of the argument Anntena/Mcs/regDomain/nic0Addr/nic1Addr/wlanAddr/wanAddr/wlanSSID/wlanChan/comd/initgain/txcck/txofdm leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9359 VDB-365322 Edimax EW-7438RPn POST Request formHwSet command injection VDB-365322 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811540 EDIMAX EW-7438RPn Mini EW-7438RPn Mini Firmware 1.28a (Version : 1.28a) Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7438RPn-Mini-formHwSet-34b53a41781f80b98d10f0da699f2236?source=copy_link Edimax–EW-7438RPn A weakness has been identified in Edimax EW-7438RPn 1.12. This affects the function formAccept of the file /goform/formAccep of the component POST Request Handler. This manipulation of the argument submit-url causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9361 VDB-365324 Edimax EW-7438RPn POST Request formAccep formAccept command injection VDB-365324 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811552 EDIMAX BR-6675nD BR-6675nD v1.12 Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formAccept-34b53a41781f807fb8f3d96c5e5ef215?source=copy_link Edimax–EW-7438RPn A security vulnerability has been detected in Edimax EW-7438RPn 1.12. This vulnerability affects the function formConnectionSetting of the file /goform/formConnectionSetting of the component Setting Handler. Such manipulation of the argument max_Conn/timeOut leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9362 VDB-365325 Edimax EW-7438RPn Setting formConnectionSetting command injection VDB-365325 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811553 EDIMAX BR-6675nD BR-6675nD v1.12 Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formConnectionSetting-34b53a41781f807a9c88e746d24540cd?source=copy_link Edimax–EW-7438RPn A vulnerability was detected in Edimax EW-7438RPn 1.12. This issue affects the function formEZCHNwlanSetup of the file /goform/formEZCHNwlanSetu of the component POST Request Handler. Performing a manipulation of the argument method results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9363 VDB-365326 Edimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injection VDB-365326 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811554 EDIMAX BR-6675nD BR-6675nD v1.12 Command Injection https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formEZCHNwlanSetup-34b53a41781f803a8c60ca409394df5b?source=copy_link edmonparker–Read More & Accordion The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 3.5.7. This is due to the use of esc_sql() without surrounding the value in quotes in an ORDER BY clause inside the getAllDataByLimit() and getAccordionAllDataByLimit() functions in ReadMoreData.php. The user-supplied $_GET[‘orderby’] value is only processed through esc_attr() (an HTML-escaping function) before being passed to these database functions, where esc_sql() is applied but the value is directly concatenated-unquoted-into the ORDER BY fragment of the SQL query before $wpdb->prepare() is called. Because esc_sql() only escapes quote characters and backslashes (which are irrelevant in an unquoted ORDER BY context), an attacker can inject arbitrary SQL expressions such as (SELECT SLEEP(5)) or conditional subqueries to perform time-based blind data extraction. This makes it possible for authenticated attackers with administrator-level access or above (or any role explicitly permitted access to the plugin’s admin pages via the yrm-user-roles setting) to extract sensitive data from the database, including administrator credential hashes. 2026-05-20 4.9 CVE-2026-7472 https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7c7e21-fbd7-4451-bc7d-3d11db01a443?source=cve https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php#L1522 https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php#L1522 https://plugins.trac.wordpress.org/browser/expand-maker/trunk/views/readMorePagesView.php#L29 https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/readMorePagesView.php#L29 https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreData.php#L1537 https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/classes/ReadMoreData.php#L1537 https://plugins.trac.wordpress.org/browser/expand-maker/trunk/views/accordionBuilder/list.php#L29 https://plugins.trac.wordpress.org/browser/expand-maker/tags/3.5.7/views/accordionBuilder/list.php#L29 espocrm–espocrm EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents through both the attachment and image entry points, resulting in stored cross-user XSS reachable through a normal attachment workflow. Although inline SVG script is blocked by the response CSP, the same CSP still allows same-origin external script. As a result, an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment, then trick another user into opening the SVG to execute JavaScript in the victim’s EspoCRM origin. This issue has been fixed in version 9.3.4. 2026-05-19 6.8 CVE-2026-33741 https://github.com/espocrm/espocrm/security/advisories/GHSA-5wh5-ccv2-m3pv Esri–ArcGIS Server ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the endpoint. Successful exploitation may result in disruption of the web-based browsing interface. This issue affects ArcGIS Server 12.0 and earlier. 2026-05-20 5.3 CVE-2026-2812 https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin Esri–ArcGIS Server ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirecting the browser to an unintended, untrusted site, resulting in a limited confidentiality impact under specific user interaction conditions. The vulnerability affects only the client side navigation logic during authentication and remains confined to the same security boundary. No server side compromise or cross component impact is possible. This issue affects ArcGIS Server 11.5. 2026-05-20 4.7 CVE-2026-2813 https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin etspring–LJ comments import: reloaded The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.97.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability arises specifically because PHP_SELF includes attacker-controllable PATH_INFO appended to the script name, and there are two distinct unsanitized echo points for this value in the same function. 2026-05-20 6.1 CVE-2026-8624 https://www.wordfence.com/threat-intel/vulnerabilities/id/0f09cb59-dbbb-48a3-aeac-377f6ec87b88?source=cve https://plugins.trac.wordpress.org/browser/lj-comments-import-reloaded/trunk/lj_comments_import.php#L129 https://plugins.trac.wordpress.org/browser/lj-comments-import-reloaded/trunk/lj_comments_import.php#L161 goback2–Logo Manager For Enamad The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute of the vc_enamad_namad, vc_enamad_shamed, and vc_enamad_custom shortcodes in all versions up to, and including, 0.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2026-05-20 6.4 CVE-2026-6549 https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6d1167-c89d-4c97-9446-b968df945e6c?source=cve https://wordpress.org/plugins/logo-manager-for-enamad https://plugins.trac.wordpress.org/browser/logo-manager-for-enamad/tags/0.7.4/widgets.php#L295 https://plugins.trac.wordpress.org/browser/logo-manager-for-enamad/trunk/widgets.php#L295 HCL–BigFix Service Management (SM) HCL BigFix Service Management (SM) is susceptible to a Configuration - ‘Insecure Use of Base Image Version’. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environment. 2026-05-20 4 CVE-2025-31973 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144 HCLSoftware–Connections HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. 2026-05-18 4.6 CVE-2026-21789 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129719 HCLSoftware–DominoIQ The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability. Under certain circumstances, document level access restrictions will be ignored when determining what data to return from an AI query. This could enable an authenticated attacker to view sensitive data. 2026-05-20 6.5 CVE-2026-21836 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130932 heartcombo–devise Devise is an authentication solution for Rails based on Warden. In versions 5.0.3 and below, when the Timeoutable module is enabled in Devise, the FailureApp#redirect_url method returns request.referrer - the HTTP Referer header, which is attacker-controllable - without validation for any non-GET request that results in a session timeout. An attacker who hosts a page with an auto-submitting cross-origin form can cause a victim with an expired Devise session to be redirected to an arbitrary external URL. This contrasts with the GET timeout path (which uses server-side attempted_path) and Devise’s own store_location_for mechanism (which strips external hosts via extract_path_from_location), both of which are protected; only the non-GET timeout redirect path is unprotected. Expired-session users can be silently redirected from the trusted app domain to attacker-controlled URLs, enabling phishing and malware delivery while bypassing browser warnings. Note: Rails’ built-in open-redirect protection does not mitigate this issue. Devise::FailureApp is an ActionController::Metal app with its own isolated copy of the relevant redirect configuration, so config.action_controller.action_on_open_redirect = :raise (and the older raise_on_open_redirects setting) do not reach it. This issue has been fixed in version 5.0.4. 2026-05-22 6.1 CVE-2026-40295 https://github.com/heartcombo/devise/security/advisories/GHSA-jp94-3292-c3xv https://github.com/heartcombo/devise/commit/025fe2124f9928766fc46520e999633b598d0360 helgatheviking–KIA Subtitle The KIA Subtitle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s the-subtitle shortcode before and after attributes in all versions up to, and including, 4.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2026-05-22 6.4 CVE-2026-7509 https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a52097-0d85-4036-9b74-f35fea549607?source=cve https://plugins.trac.wordpress.org/browser/kia-subtitle/tags/4.0.1/kia-subtitle.php#L359 https://plugins.trac.wordpress.org/browser/kia-subtitle/tags/4.0.1/kia-subtitle.php#L329 https://plugins.trac.wordpress.org/browser/kia-subtitle/trunk/kia-subtitle.php#L359 https://plugins.trac.wordpress.org/browser/kia-subtitle/trunk/kia-subtitle.php#L329 https://plugins.trac.wordpress.org/browser/kia-subtitle/tags/4.0.2/kia-subtitle.php#L369 https://plugins.trac.wordpress.org/browser/kia-subtitle/tags/4.0.2/kia-subtitle.php#L370 helpstring–Child Height Predictor by Ostheimer The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.3. This is due to missing nonce verification in the options() function, which handles plugin settings updates. The form template does not include a wp_nonce_field() call, and the handler never calls check_admin_referer() or wp_verify_nonce(). This makes it possible for unauthenticated attackers to trick a site administrator into clicking a link or visiting a malicious page that submits a forged POST request, causing unauthorized changes to the plugin settings such as unit preferences to be persisted to the database via update_option(). 2026-05-20 4.3 CVE-2026-6400 https://www.wordfence.com/threat-intel/vulnerabilities/id/dc1681a8-5f2e-45f1-96d9-797b13644607?source=cve https://plugins.trac.wordpress.org/browser/child-height-predictor/trunk/childheight.php#L149 https://plugins.trac.wordpress.org/browser/child-height-predictor/tags/1.3/childheight.php#L149 https://plugins.trac.wordpress.org/browser/child-height-predictor/trunk/childheight.php#L135 https://plugins.trac.wordpress.org/browser/child-height-predictor/tags/1.3/childheight.php#L135 Honeywell International Inc.–Control Network Module (CNM) Honeywell Control Network Module (CNM) contains insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability through probing system files, potentially resulting in unintended access to protected data. 2026-05-21 5.9 CVE-2026-5434 https://process.honeywell.com/ infility–Infility Global The Infility Global plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ and ‘order’ parameters in all versions up to, and including, 2.15.16. This is due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query within the show_control_data::post_list() function, which is registered as an admin menu page with only the ‘read’ capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2026-05-20 6.5 CVE-2026-8685 https://www.wordfence.com/threat-intel/vulnerabilities/id/1caeb5e0-9e4e-4c9e-a6e4-881fb81dc5f2?source=cve https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L34 https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L74 https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L78 https://plugins.trac.wordpress.org/browser/infility-global/trunk/widgets/show-control-data/show-control-data.php#L84 Intelbras – VIP-1230-D-G4 An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset functionality under /OutsideCmd 2026-05-18 5.3 CVE-2026-36438 https://backend.intelbras.com/sites/default/files/2023-03/Datasheet%20UNIFICADO%20-%20VIP%201230%20B.D.G4-v2.pdf https://www.intelbras.com/pt-br/camera-dome-wi-fi-vip-1230-d-w-g4 https://github.com/kensh1k/CVE-2026-36438/tree/main ISC–BIND 9 BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1. 2026-05-20 5.3 CVE-2026-3592 CVE-2026-3592 https://downloads.isc.org/isc/bind9/9.18.49 https://downloads.isc.org/isc/bind9/9.20.23 https://downloads.isc.org/isc/bind9/9.21.22 ISC–BIND 9 An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1. 2026-05-20 5.3 CVE-2026-5950 CVE-2026-5950 https://downloads.isc.org/isc/bind9/9.18.49 https://downloads.isc.org/isc/bind9/9.20.23 https://downloads.isc.org/isc/bind9/9.21.22 ItzCrazyKns–Vane A security vulnerability has been detected in ItzCrazyKns Vane up to 1.12.1. Affected by this issue is some unknown functionality of the file route.ts of the component API. The manipulation leads to missing authentication. The attack may be initiated remotely. The attack’s complexity is rated as high. The exploitation is known to be difficult. The exploit has been disclosed publicly and may be used. It appears that basic authentication is planned. 2026-05-24 5.6 CVE-2026-9371 VDB-365334 ItzCrazyKns Vane API route.ts missing authentication VDB-365334 CTI Indicators (IOB, IOC, IOA) Submit #813209 ItzCrazyKns Vane 1.12.1 API Key Exposure Submit #813210 ItzCrazyKns Vane 1.12.1 Missing Authentication for Critical Function (Duplicate) https://github.com/ItzCrazyKns/Vane/issues/1122 https://github.com/ItzCrazyKns/Vane/issues/1123 https://github.com/ItzCrazyKns/Vane/ jarrodwatts–claude-hud Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values, allowing attackers to inject arbitrary ANSI codes into terminal sessions. Attackers can embed ESC+backslash sequences in the current working directory or branch URL to execute malicious ANSI codes including text color changes, forged prompts, and OSC 52 clipboard writes, or trigger outbound HTTP requests to attacker-controlled remotes when hyperlinks are clicked. 2026-05-18 4.6 CVE-2026-47090 https://github.com/jarrodwatts/claude-hud/issues/485 https://github.com/jarrodwatts/claude-hud/pull/487 https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30 https://www.vulncheck.com/advisories/claude-hud-terminal-injection-via-osc-8-hyperlinks javibola–JaviBola Custom Theme Test The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the options page. This makes it possible for unauthenticated attackers to change the site’s active theme by modifying the jbct_theme option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-05-20 4.3 CVE-2026-8423 https://www.wordfence.com/threat-intel/vulnerabilities/id/68a8a277-2ea6-4d75-b8cd-4d20eb17b3aa?source=cve https://plugins.trac.wordpress.org/browser/javibola-custom-theme/trunk/javibola-custom-theme.php#L41 https://plugins.trac.wordpress.org/browser/javibola-custom-theme/tags/2.0.5/javibola-custom-theme.php#L41 https://plugins.trac.wordpress.org/browser/javibola-custom-theme/trunk/javibola-custom-theme.php#L40 https://plugins.trac.wordpress.org/browser/javibola-custom-theme/tags/2.0.5/javibola-custom-theme.php#L40 https://plugins.trac.wordpress.org/browser/javibola-custom-theme/trunk/javibola-custom-theme.php#L54 https://plugins.trac.wordpress.org/browser/javibola-custom-theme/tags/2.0.5/javibola-custom-theme.php#L54 jay_patel–Remove Yellow BGBOX The Remove Yellow BGBOX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the ‘rybb_api_settings’ page. This makes it possible for unauthenticated attackers to reset the plugin’s stored settings by overwriting its configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-05-20 4.3 CVE-2026-8424 https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b30d27-a3f8-4535-a47f-675c939ec648?source=cve https://plugins.trac.wordpress.org/browser/remove-yellow-bgbox/trunk/admin/rybb_api_settings.php#L5 https://plugins.trac.wordpress.org/browser/remove-yellow-bgbox/tags/1.0/admin/rybb_api_settings.php#L5 https://plugins.trac.wordpress.org/browser/remove-yellow-bgbox/trunk/includes/functions.php#L16 https://plugins.trac.wordpress.org/browser/remove-yellow-bgbox/tags/1.0/includes/functions.php#L16 jetmonsters–MotoPress Hotel Booking The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce for this action is output in the HTML source of every public page through wp_localize_script (MPHB._data.nonces), so any unauthenticated visitor can obtain a valid nonce and perform the action without any account or prior interaction. 2026-05-22 5.3 CVE-2026-8684 https://www.wordfence.com/threat-intel/vulnerabilities/id/6567e63c-3129-47b2-a734-733eb599821a?source=cve https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/6.0.1/includes/ajax-api/ajax-actions/update-booking-notes.php#L83 https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/6.0.1/includes/ajax-api/ajax-actions/abstract-ajax-api-action.php#L34 https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/6.0.1/includes/ajax-api/ajax-api-handler.php#L43 https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/5.4.1/includes/ajax-api/ajax-actions/update-booking-notes.php#L83 https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/5.4.1/includes/ajax-api/ajax-actions/abstract-ajax-api-action.php#L34 https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/5.4.1/includes/ajax-api/ajax-api-handler.php#L43 https://plugins.trac.wordpress.org/changeset/3537354/motopress-hotel-booking-lite/trunk/includes/ajax-api/ajax-actions/update-booking-notes.php Jomres–Jomres Joomla Component jomres 9.11.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information by tricking authenticated users into visiting malicious pages. Attackers can craft HTML forms targeting the account/index endpoint with hidden fields to change passwords, email addresses, and profile details without user consent. 2026-05-23 4.3 CVE-2018-25354 ExploitDB-44901 Official Product Homepage Product Reference VulnCheck Advisory: Joomla Component jomres 9.11.2 Cross-Site Request Forgery jupyterhub–jupyterhub JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker’s server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy. 2026-05-22 5.4 CVE-2026-40864 https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-m68r-v472-jgq9 https://github.com/jupyterhub/jupyterhub/commit/9c5ec277d3cda5a59de2d8c8117efa77bd941127 kasparsd–Widget Context The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is due to missing or incorrect nonce validation on the save_widget_context_settings function. This makes it possible for unauthenticated attackers to modify widget visibility context settings stored in the WordPress options table via a forged POST request to /wp-admin/widgets.php via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-05-22 4.3 CVE-2026-7615 https://www.wordfence.com/threat-intel/vulnerabilities/id/3c434637-4bf9-46ee-9a6d-35eab7ef11a1?source=cve https://plugins.trac.wordpress.org/browser/widget-context/trunk/src/WidgetContext.php#L311 https://plugins.trac.wordpress.org/browser/widget-context/tags/1.3.3/src/WidgetContext.php#L311 https://plugins.trac.wordpress.org/browser/widget-context/trunk/src/WidgetContext.php#L282 https://plugins.trac.wordpress.org/browser/widget-context/tags/1.3.3/src/WidgetContext.php#L282 https://plugins.trac.wordpress.org/browser/widget-context/trunk/src/WidgetContext.php#L91 https://plugins.trac.wordpress.org/browser/widget-context/tags/1.3.3/src/WidgetContext.php#L91 https://github.com/kasparsd/widget-context-wporg/pull/73 Kieback & Peter–DDC4002 The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim’s browser, which allows the attacker to control the browser. 2026-05-20 5.3 CVE-2026-4293 https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-05 https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-139-05.json ktulhu–Bigfishgames Syndicate The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the bigfishgames_syndicate_submenu() function. This makes it possible for unauthenticated attackers to reset plugin settings and update them via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-05-20 4.3 CVE-2026-6452 https://www.wordfence.com/threat-intel/vulnerabilities/id/67877a2e-a45d-4674-b749-05d9217ef6bf?source=cve https://plugins.trac.wordpress.org/browser/bigfishgames-syndicate/trunk/bigfishgames-syndicate.php#L238 https://plugins.trac.wordpress.org/browser/bigfishgames-syndicate/tags/1.2/bigfishgames-syndicate.php#L238 https://plugins.trac.wordpress.org/browser/bigfishgames-syndicate/trunk/bigfishgames-syndicate.php#L169 https://plugins.trac.wordpress.org/browser/bigfishgames-syndicate/tags/1.2/bigfishgames-syndicate.php#L169 langgenius–dify Dify version 1.14.1 and prior contain an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document across all tenants and workspaces using only the file’s UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint with an intercepted file UUID to extract sensitive content from documents without ownership or workspace permission verification. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker. 2026-05-18 5.9 CVE-2026-41949 https://huntr.com/bounties/d50a0240-7951-4939-b989-9bded66c7682 https://github.com/langgenius/dify/pull/35797 https://www.vulncheck.com/advisories/dify-authorization-bypass-via-file-preview-endpoint laurent22–joplin Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerability in the title input functionality due to a lack of proper length validation. This flaw allows an attacker to cause an Out Of Memory (OOM) error and subsequent program termination by inserting an excessively long string into a note’s title. This can be triggered either through direct user interface (UI) input or programmatically via the local web service API after compromising an authentication token. There are 2 primary methods of exploitation: via User Interface (UI) Input, and the Local Web Service API. A local user can directly type or paste an extremely long string into the title field when creating or editing a note Joplin runs a local web service (typically on port 41184) that allows programmatic interaction, such as creating or editing notes via HTTP API calls. If an attacker manages to exfiltrate or compromise the user’s authentication token (e.g., through malware on the local system, or other local vulnerabilities), they can then send a crafted HTTP POST request to this local API. By including an excessively long string in the title parameter of this request, the application will attempt to allocate an unbounded amount of memory. This issue has been patched in version 3.7.1. 2026-05-19 5.5 CVE-2025-57798 https://github.com/laurent22/joplin/security/advisories/GHSA-6jm8-gr87-q69x https://github.com/laurent22/joplin/commit/5b8795da446a5a40c9e212c98b35e368ffce628e laurent22–joplin Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.5.2 and prior contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them, related to but not fully fixed by the prior patch in #14289. In ChangeModel.delta, when DELTA_INCLUDES_ITEMS is enabled (the default), the latest state of items is attached to delta output without verifying that those items are still shared with the requesting user, and the existing removal logic only filters items deleted for all users. Additionally, the change compression logic incorrectly reduces create - delete to NOOP, which is unsafe because compression is applied per page and an item can have multiple create events; if an earlier create falls on a separate page from a later create -> delete pair, the deletion is dropped and the sequence collapses to a create. As a result, the delta API returns a create event for a deleted item with the full latest content attached, exposing notes the user no longer has access to. This issue has been fixed in version 3.5.3. 2026-05-19 5.7 CVE-2026-34600 https://github.com/laurent22/joplin/security/advisories/GHSA-88x4-77rc-jw94 https://github.com/laurent22/joplin/issues/14110 https://github.com/laurent22/joplin/pull/14289 Ledger–Ledger Bitcoin app Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the a: fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses. 2026-05-20 4 CVE-2023-7346 Ledger Security Bulletin 019 https://www.vulncheck.com/advisories/ledger-bitcoin-app-address-derivation-error-via-miniscript Ledger–Ledger Nano X Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during firmware flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code to cause the device to enter an unrecoverable fault state during boot, resulting in permanent loss of operability. 2026-05-19 4.6 CVE-2025-15645 Ledger Security Bulletin 021 https://www.vulncheck.com/advisories/ledger-nano-x-flex-stax-mcu-firmware-update-denial-of-service Ledger–ledgerhq/hw-app-eth Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions, such as asset transfers at incorrect amounts. 2026-05-19 6.5 CVE-2023-7345 Ledger Security Bulletin 020 https://www.vulncheck.com/advisories/ledger-live-hw-app-eth-eip-712-message-parsing-integer-truncation linlinjava–litemall A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vulnerability is the function backup/load of the file litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java of the component Database Setting Handler. The manipulation of the argument db/password leads to argument injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-18 4.7 CVE-2026-8773 VDB-364398 linlinjava litemall Database Setting DbUtil.java load argument injection VDB-364398 CTI Indicators (IOB, IOC, TTP, IOA) Submit #811469 linlinjava litemall up to 1.8.0 Argument Injection https://gist.github.com/A1AAAAAAAAAA1/d5ae30a17744459e7cc5902fff32a35b Live Networks, Inc.–LIVE555 LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions. 2026-05-19 5.9 CVE-2026-41470 https://gist.github.com/yhcho0405/ee9b67a96808ef19f22e8a4ee88c795f https://download.live555.com/ https://www.vulncheck.com/advisories/live555-rtsp-server-authorization-bypass-via-session-token lykich–Correct Prices The Correct Prices plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER[‘PHP_SELF’] variable in versions up to and including 1.0. This is due to the correct_prices_page() function echoing $_SERVER[‘PHP_SELF’] into a form’s action attribute without any input sanitization or output escaping (such as esc_url() or esc_attr()). Because PHP_SELF reflects attacker-controlled path-info appended to the script URL, an attacker can break out of the attribute and inject arbitrary markup. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link. 2026-05-20 6.1 CVE-2026-8627 https://www.wordfence.com/threat-intel/vulnerabilities/id/605c6c53-6920-42ba-8784-b3a186bbf821?source=cve https://plugins.trac.wordpress.org/browser/correct-prices/trunk/correct_prices.php#L134 Magepeople inc.–WpBookingly Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9. 2026-05-20 6.5 CVE-2026-27405 https://patchstack.com/database/wordpress/plugin/service-booking-manager/vulnerability/wordpress-wpbookingly-plugin-1-2-9-broken-access-control-vulnerability?_s_id=cve makeplane–plane Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an allowlist), causing ORM Field Reference Injection. An authenticated workspace MEMBER can send GET /api/workspaces//saved-analytic-view// with a crafted segment value that is forwarded into build_graph_plot() and traverses foreign-key relationships (e.g. workspace__owner__password) before being projected via .values("dimension", "segment"), returning the referenced field values directly in the JSON response. This exposes sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses, making it a stronger primitive than the related order_by injection where values are only leaked through ordering. This issue has been fixed in version 1.3.1. 2026-05-20 6.5 CVE-2026-40102 https://github.com/makeplane/plane/security/advisories/GHSA-93x3-ghh7-72j3 https://github.com/makeplane/plane/releases/tag/v1.3.1 manchumahara--CBX 5 Star Rating & Review The CBX 5 Star Rating & Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link. 2026-05-22 6.1 CVE-2026-6864 https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee11e19-21a6-45df-a118-f6dec3b55bc1?source=cve https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.7/templates/admin/admin-rating-review-rating-avg-logs.php#L41 https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.7/templates/admin/admin-rating-review-review-logs.php#L41 https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.8/templates/admin/admin-rating-review-review-logs.php https://plugins.trac.wordpress.org/browser/cbxscratingreview/tags/1.0.8/templates/admin/admin-rating-review-rating-avg-logs.php mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custom field's contents in the Update Issue page, (bug_update_page.php) allowing an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. This facilitates session theft, leading to admin account takeover, full project data access. In order to exploit this issue, a textarea-type custom field must be configured for the project, the attack must be carried out by an authenticated user with bug report permission (low privilege). This can affect any user viewing the bug edit form, including administrators. The issue has been fixed in version 2.28.2. If users cannot immediately upgrade, they can work around the issue by using the default Content-Security Policy, which blocks script execution. 2026-05-20 5.4 CVE-2026-39960 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-qj6w-v29q-4rgx https://github.com/mantisbt/mantisbt/commit/5fec0f448b7a7d7d539a6adb6dccceac4e4e4ab7 mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2. 2026-05-19 4.3 CVE-2026-34754 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h4x5-gvx6-3rwc https://github.com/mantisbt/mantisbt/commit/b262b4d2835b81394d75356dead66e52a6275206 https://mantisbt.org/bugs/view.php?id=36976 Mattermost--Mattermost Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564 2026-05-21 6.1 CVE-2026-22880 MMSA-2025-00564 Mattermost--Mattermost Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing commands in the Gitlab plugin which allows normal users to uninstall instances or setup webhook connections via the { {gitlab instance {option} } } or the { {/gitlab webhook {option} } } commands. Mattermost Advisory ID: MMSA-2026-00600 2026-05-18 6.5 CVE-2026-3117 MMSA-2026-00600 Mattermost--Mattermost Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling { {window.open('javascript:alert()');} }. Mattermost Advisory ID: MMSA-2026-00618 2026-05-18 6.5 CVE-2026-3471 MMSA-2026-00618 Mattermost--Mattermost Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications which allows authenticated user to crash the server via timing the creation of persistent notification message between the server deleting existing persistent notifications and archiving the channel.. Mattermost Advisory ID: MMSA-2026-00637 2026-05-22 6.5 CVE-2026-4635 MMSA-2026-00637 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645 2026-05-18 6.5 CVE-2026-5163 MMSA-2026-00645 Mattermost--Mattermost Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image header before allocating memory, which allows authenticated users with file upload or posting permissions to cause a denial of service (server OOM) via uploading a crafted TIFF file or posting a URL that serves one.. Mattermost Advisory ID: MMSA-2026-00648 2026-05-22 6.5 CVE-2026-5755 MMSA-2026-00648 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614 2026-05-18 6.5 CVE-2026-6345 MMSA-2026-00614 Mattermost--Mattermost Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL.. Mattermost Advisory ID: MMSA-2026-00628 2026-05-22 5.4 CVE-2026-28735 MMSA-2026-00628 Mattermost--Mattermost Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs.. Mattermost Advisory ID: MMSA-2026-00620 2026-05-22 5.9 CVE-2026-3473 MMSA-2026-00620 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to { {/api/v1/meetings} }.. Mattermost Advisory ID: MMSA-2026-00608 2026-05-18 4.3 CVE-2026-2325 MMSA-2026-00608 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash commands via editing their own slash command trigger to an already-registered trigger through the command update API. Mattermost Advisory ID: MMSA-2026-00597 2026-05-18 4.3 CVE-2026-28732 MMSA-2026-00597 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576 2026-05-18 4.3 CVE-2026-28759 MMSA-2026-00576 Mattermost--Mattermost Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users without elevated permissions which allows a user without permissions to get data about team members roles via invoking various team API endpoints.. Mattermost Advisory ID: MMSA-2026-00626 2026-05-22 4.3 CVE-2026-3636 MMSA-2026-00626 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627 2026-05-18 4.3 CVE-2026-3637 MMSA-2026-00627 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629 2026-05-21 4.3 CVE-2026-4055 MMSA-2026-00629 Mattermost--Mattermost Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint.. Mattermost Advisory ID: MMSA-2026-00638 2026-05-22 4.3 CVE-2026-4646 MMSA-2026-00638 Mattermost--Mattermost Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which allows an attacker to cause a denial of service via crafted oversized HTTP requests.. Mattermost Advisory ID: MMSA-2026-00646 2026-05-22 4.9 CVE-2026-5308 MMSA-2026-00646 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown image tag.. Mattermost Advisory ID: MMSA-2026-00636 2026-05-18 4.3 CVE-2026-6339 MMSA-2026-00636 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.. Mattermost Advisory ID: MMSA-2026-00573 2026-05-18 4.3 CVE-2026-6340 MMSA-2026-00573 Mattermost--Mattermost Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to have API-level checks on which groups the user can create issues or attach comments to which allows a user that is member of multiple groups to create issues to a locked group via direct API requests. Mattermost Advisory ID: MMSA-2026-00602 2026-05-18 4.3 CVE-2026-6341 MMSA-2026-00602 Mattermost--Mattermost Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to appropriately check for valid namespaces which allows plugin users to create subscriptions to groups that were not whitelisted via creating groups that share the same prefix as a whitelisted group. Mattermost Advisory ID: MMSA-2026-00601 2026-05-18 4.3 CVE-2026-6342 MMSA-2026-00601 Mattermost--Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-00591 2026-05-18 4.3 CVE-2026-6343 MMSA-2026-00591 mcinvale--Faces of Users The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofusers' shortcode in all versions up to, and including, 0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2026-05-20 6.4 CVE-2026-8038 https://www.wordfence.com/threat-intel/vulnerabilities/id/ea39d249-0345-4028-af58-31b298376950?source=cve https://plugins.trac.wordpress.org/browser/faces-of-users/trunk/faces-of.php#L62 https://plugins.trac.wordpress.org/browser/faces-of-users/tags/0.0.3/faces-of.php#L62 Mesalvo--Meona Client Launcher Component Cleartext Storage of Sensitive Information in Memory vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020. 2026-05-20 6 CVE-2026-0857 https://seccore.at/blog/cves-meona/ Mesalvo--Meona Client Launcher Component Insufficient Verification of Data Authenticity vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component makes it possible to send messages to any email address. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020. 2026-05-20 4.4 CVE-2026-25602 https://seccore.at/blog/cves-meona/ Microsoft--Microsoft 365 Copilot Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. 2026-05-22 6.5 CVE-2026-42827 M365 Copilot Information Disclosure Vulnerability Microsoft--Microsoft Defender Antimalware Platform Microsoft Defender Denial of Service Vulnerability 2026-05-20 4 CVE-2026-45498 Microsoft Defender Denial of Service Vulnerability Microsoft--Microsoft Edge (Chromium-based) Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. 2026-05-18 5.4 CVE-2026-45492 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability Microsoft--Microsoft Edge (Chromium-based) Microsoft Edge (Chromium-based) Spoofing Vulnerability 2026-05-18 5.4 CVE-2026-45494 Microsoft Edge (Chromium-based) Spoofing Vulnerability Microsoft--Windows 11 Version 24H2 Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available. Mitigation FAQs Should I leverage the temporary mitigation? Microsoft recommends that you consider implementing these mitigations if you are concerned your devices and data are at risk of being compromised or stolen. For example, if your organization's employees take their work devices home or on business travel. What impact to service availability/management could be caused by implementing the mitigations? Implementing these mitigations will not impact service availability or management operations. Do customers need to revert the changes made to mitigate the vulnerability once the security update to protect against this vulnerability is available? No. The security update will maintain the mitigation's behavior once the security update is installed. I am using TPM+PIN, am I at risk of this vulnerability being exploited No, if you are using TPM+PIN the vulnerability is not exploitable. 2026-05-19 6.8 CVE-2026-45585 Windows BitLocker Security Feature Bypass Vulnerability MongoDB, Inc.--C Driver The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read). 2026-05-20 5.9 CVE-2026-9100 https://jira.mongodb.org/browse/CDRIVER-6281 MongoDB, Inc.--Compass Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution. 2026-05-20 4.3 CVE-2026-9101 https://jira.mongodb.org/browse/COMPASS-10657 MongoDB, Inc.--MongoDB Server Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6 2026-05-18 6.5 CVE-2026-8843 https://jira.mongodb.org/browse/SERVER-116327 mrdollar4444--GSheet For Woo Importer The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options. 2026-05-21 4.3 CVE-2026-4843 https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d60991-0675-4efa-9427-380e6b59fe28?source=cve https://plugins.trac.wordpress.org/browser/import-products-from-gsheet-for-woo-importer/tags/2.3.1/src/Actions/AdminSettingsAction.php#L391 n/a--Ettercap A vulnerability has been found in Ettercap up to 0.8.3. The affected element is the function FUNC_DECODER of the file src/dissectors/ec_gg.c of the component GG Dissector. The manipulation of the argument gg leads to heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.4 is sufficient to fix this issue. The identifier of the patch is feeae6fa366e01a3dd9f1857ec6aae847b2ae00c. It is suggested to upgrade the affected component. 2026-05-24 5.6 CVE-2026-9365 VDB-365328 Ettercap GG Dissector ec_gg.c FUNC_DECODER heap-based overflow VDB-365328 CTI Indicators (IOB, IOC, IOA) Submit #813142 Ettercap <=v0.8.4 Heap-based Buffer Overflow https://github.com/Ettercap/ettercap/issues/1306 https://github.com/Ettercap/ettercap/pull/1307 https://github.com/Ettercap/ettercap/commit/feeae6fa366e01a3dd9f1857ec6aae847b2ae00c https://github.com/Ettercap/ettercap/ n/a–exifreader Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file containing a highly compressed zTXt chunk can cause ExifReader to materialize a disproportionately large Comment value in memory. 2026-05-19 5.3 CVE-2026-8814 https://security.snyk.io/vuln/SNYK-JS-EXIFREADER-16689340 https://gist.github.com/yuki-matsuhashi/cad1a45d936062438b4ab24613c34c55 https://github.com/mattiasw/ExifReader/commit/5f116128adc19f674902f8bf582bfe7dd0a36375 n/a–JPress A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave of the component UCenter Article Submission Endpoint. Executing a manipulation of the argument id/userId can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-24 6.3 CVE-2026-9376 VDB-365339 JPress UCenter Article Submission Endpoint doWriteSave improper authorization VDB-365339 CTI Indicators (IOB, IOC, TTP, IOA) Submit #813253 JPress 1.0.3 Improper Authorization https://github.com/JPressProjects/jpress/issues/194 n/a–postcss A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition “DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).” 2026-05-24 4.3 CVE-2026-9358 VDB-365321 postcss AST Serialization container.js toString recursion VDB-365321 CTI Indicators (IOB, IOC, TTP, IOA) Submit #813080 postcss-selector-parser postcss <= 7.1.1 CWE-674: Uncontrolled Recursion https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9 nanomq–nanomq NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In versions 0.24.10 and below, when NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients. The transport’s p_peer callback (tcptran_pipe_peer()) iterates cpipe->subinfol while copying session metadata from the cached old pipe to the new reconnecting pipe, without checking whether the pointer is NULL. Under a reconnect race, cpipe->subinfol can be freed and set to NULL before session restore invokes this function, resulting in a remote unauthenticated Denial-of-Service (process crash) condition. This issue has been fixed in version 0.24.11. 2026-05-19 5.9 CVE-2026-32134 https://github.com/nanomq/nanomq/security/advisories/GHSA-q36f-83mh-pcv2 https://github.com/nanomq/nanomq/issues/2241 https://github.com/nanomq/NanoNNG/commit/522ec62e29e60d1122f2aedaa6e702dcf089f7bb https://github.com/nanomq/nanomq/releases/tag/0.24.11 NeoRazorX–facturascripts FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripping EXIF/XMP/IPTC metadata. Any authenticated user who downloaded an image could extract the uploader’s embedded metadata, which included GPS coordinates, device information, timestamps, embedded comments/notes, thumbnail previews, and other personally identifiable information (PII) preserved in the image metadata. Of all FacturaScripts’ image upload features, only the Library module combined unrestricted uploads, persistent storage, authenticated download access, and a total lack of server-side metadata sanitization. This vulnerability carries significant real-world impact: an employee uploading a photo taken at their home inadvertently discloses their precise home address to every user with Library download access. This issue has been fixed in version 2026. 2026-05-18 6.5 CVE-2026-27892 https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-q7f2-rv22-2xgr https://github.com/NeoRazorX/facturascripts/commit/b0725147a61a9a377b7180589af33ff52b4751e2 Netatalk–Netatalk Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of service by exploiting the reconnect mechanism. 2026-05-21 6.5 CVE-2026-44054 Netatalk Security Advisory CVE-2026-44054 Netatalk–Netatalk A stack-based buffer overflow in desktop.c in Netatalk 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited information, or modify limited data. 2026-05-21 6 CVE-2026-44056 Netatalk Security Advisory CVE-2026-44056 Netatalk–Netatalk An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism. 2026-05-21 6.4 CVE-2026-44058 Netatalk Security Advisory CVE-2026-44058 Netatalk–Netatalk Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a crafted volume path. 2026-05-21 6.7 CVE-2026-44076 Netatalk Security Advisory CVE-2026-44076 Netatalk–Netatalk Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials via timing analysis. 2026-05-21 5.9 CVE-2026-44061 Netatalk Security Advisory CVE-2026-44061 Netatalk–Netatalk An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input. 2026-05-21 4.2 CVE-2026-44063 Netatalk Security Advisory CVE-2026-44063 Netatalk–Netatalk Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain elevated privileges under error conditions. 2026-05-21 4 CVE-2026-44073 Netatalk Security Advisory CVE-2026-44073 NetBSD–src NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX. A local attacker with access to /dev/crypto and a compression session type can exploit this vulnerability by providing a dst_len value exceeding INT_MAX to trigger a kernel panic through NULL pointer dereference when CONFIG_SVS is disabled and corrupted UIO pointer arithmetic. 2026-05-18 5.5 CVE-2026-32849 https://nasm.re/posts/uaf_netbsd_crypto/ https://github.com/NetBSD/src/commit/ec8451efc1565516aba9e7047e1a1a1ce7953a2f https://www.vulncheck.com/advisories/netbsd-signed-integer-overflow-in-cryptodev-op-via-cryptodev-c NetBSD–src NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() within the opencrypto subsystem that allows local attackers to trigger a double-free condition by concurrently issuing CIOCCRYPT operations on the same session identifier on SMP systems. Attackers can exploit mutable per-operation state embedded in the csession struct to corrupt kernel heap memory. 2026-05-18 4.7 CVE-2026-32848 https://nasm.re/posts/uaf_netbsd_crypto/ https://github.com/NetBSD/src/commit/ec8451efc1565516aba9e7047e1a1a1ce7953a2f https://www.vulncheck.com/advisories/netbsd-cryptodev-race-condition-double-free-via-cryptodev-op nimiq–core-rs-albatross nimiq-blockchain provides persistent block storage for Nimiq’s Rust implementation. In versions 1.3.0 and prior, network-libp2p discovery accepts signed PeerContact updates from untrusted peers and stores them in a peer contact book, eventually leading to address book crash. A PeerContact can legally contain an empty addresses list (no intrinsic validation enforces non-empty). Later, PeerContactBook::known_peers builds an address book by taking addresses.first().expect(“every peer should have at least one address”). If the attacker has inserted a signed peer contact with addresses=[], any call to get_address_book (RPC/web client) can panic and crash the node/RPC task depending on panic settings. This issue has been fixed in version 1.4.0. 2026-05-20 4.3 CVE-2026-40094 https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-c45m-6x25-3cjq https://github.com/nimiq/core-rs-albatross/pull/3715 https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 NousResearch–hermes-agent A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.16. This vulnerability affects the function _is_blocked_device of the file tools/file_tools.py of the component read_file Tool. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.5 CVE-2026-9351 VDB-365314 NousResearch hermes-agent read_file Tool file_tools.py _is_blocked_device path traversal VDB-365314 CTI Indicators (IOB, IOC, TTP, IOA) Submit #812214 NousResearch hermes-agent 2026.4.16 Path Traversal (CWE-22) https://gist.github.com/YLChen-007/1d1aeff404cb88e06ec2fb3377f49fef NousResearch–hermes-agent A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function of the component Slack Agent/Mattermost Agent. The manipulation of the argument format_message results in escaping of output. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.5 CVE-2026-9354 VDB-365317 NousResearch hermes-agent Slack Agent/Mattermost Agent escape output VDB-365317 CTI Indicators (IOB, IOC, IOA) Submit #812226 NousResearch hermes-agent 2026.4.16 Improper Encoding or Escaping of Output (CWE-116) https://gist.github.com/YLChen-007/e90fb38ac03284176bae49898a3a46a4 NousResearch–hermes-agent A weakness has been identified in NousResearch hermes-agent up to 2026.4.23. This issue affects the function _make_run_env of the file tools/environments/local.py of the component Messaging Gateway Handler. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 5.3 CVE-2026-9352 VDB-365315 NousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosure VDB-365315 CTI Indicators (IOB, IOC, TTP, IOA) Submit #812215 NousResearch hermes-agent 2026.4.23 Exposure of Sensitive Information (CWE-200) https://gist.github.com/YLChen-007/760b3940f708990e535214529c0c7a27 NousResearch–hermes-agent A security flaw has been discovered in NousResearch hermes-agent 2026.4.23. Affected is the function _discover_dashboard_plugins of the file hermes_cli/web_server.py of the component CLI web-dashboard Interface. Performing a manipulation of the argument HERMES_ENABLE_PROJECT_PLUGINS results in incorrect comparison. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 5.3 CVE-2026-9369 VDB-365332 NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparison VDB-365332 CTI Indicators (IOB, IOC, IOA) Submit #812230 NousResearch hermes-agent 2026.4.23 Incorrect Comparison (CWE-697) https://gist.github.com/YLChen-007/062b77ceac6aa9844842a616f5d2ef30 Nozomi Networks–Guardian A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can push malicious remote strategies containing HTML tags through the sync. When a victim views the affected remote strategy in the Smart Polling functionality, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration. 2026-05-19 6.5 CVE-2025-40904 https://security.nozominetworks.com/NN-2026:7-01 Nozomi Networks–Guardian A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious identity containing HTML tags. When a victim attempts to delete the affected identity, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration. 2026-05-19 5.9 CVE-2025-40901 https://security.nozominetworks.com/NN-2026:4-01 Nozomi Networks–Guardian A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can create a malicious user whose username contains HTML tags. When a victim attempts to delete a group containing the affected user, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration. 2026-05-19 5.9 CVE-2025-40902 https://security.nozominetworks.com/NN-2026:5-01 Nozomi Networks–Guardian A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious restore schedule containing HTML tags. When a victim views the affected schedule, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration. 2026-05-19 5.9 CVE-2025-40903 https://security.nozominetworks.com/NN-2026:6-01 Nozomi Networks–Guardian An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the Angular template executes in their browser context, allowing the attacker to modify application data, or disrupt application availability. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration. 2026-05-19 4.6 CVE-2025-40900 https://security.nozominetworks.com/NN-2026:3-01 npitre–cramfs-tools A vulnerability was detected in npitre cramfs-tools up to 2.2. Affected is the function change_file_status of the file cramfsck.c. Performing a manipulation results in symlink following. The attack requires a local approach. The exploit is now public and may be used. The patch is named b4a3a695c9873f824907bd15659f2a6ac7667b4f. It is recommended to apply a patch to fix this issue. 2026-05-18 4.2 CVE-2026-8784 VDB-364408 npitre cramfs-tools cramfsck.c change_file_status symlink VDB-364408 CTI Indicators (IOB, IOC, IOA) Submit #811897 GNU cramfs-tools below v2.2 Symlink Following https://github.com/npitre/cramfs-tools/issues/13 https://github.com/npitre/cramfs-tools/issues/13#issuecomment-4306102583 https://github.com/npitre/cramfs-tools/commit/b4a3a695c9873f824907bd15659f2a6ac7667b4f https://github.com/npitre/cramfs-tools/ NVIDIA–TensorRT-LLM NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. 2026-05-20 6.3 CVE-2026-24142 https://nvd.nist.gov/vuln/detail/CVE-2026-24142 https://www.cve.org/CVERecord?id=CVE-2026-24142 https://nvidia.custhelp.com/app/answers/detail/a_id/5805 NVIDIA–TensorRT-LLM NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an unchecked return value to a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service. 2026-05-20 5.5 CVE-2026-24160 https://nvd.nist.gov/vuln/detail/CVE-2026-24160 https://www.cve.org/CVERecord?id=CVE-2026-24160 https://nvidia.custhelp.com/app/answers/detail/a_id/5805 NVIDIA–Triton Inference Server NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service. 2026-05-20 5.3 CVE-2026-24208 https://nvd.nist.gov/vuln/detail/CVE-2026-24208 https://www.cve.org/CVERecord?id=CVE-2026-24208 https://nvidia.custhelp.com/app/answers/detail/a_id/5828 NVIDIA–Triton Inference Server NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service. 2026-05-20 5.7 CVE-2026-24215 https://nvd.nist.gov/vuln/detail/CVE-2026-24215 https://www.cve.org/CVERecord?id=CVE-2026-24215 https://nvidia.custhelp.com/app/answers/detail/a_id/5828 oliverpos–Oliver POS A WooCommerce Point of Sale (POS) The Oliver POS - A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback, which uses a loose PHP comparison (==) to compare the attacker-supplied ‘OliverAuth’ header value against the ‘oliver_pos_authorization_token’ option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get_option returns false). Due to PHP’s type juggling, the loose comparison ‘0’ == false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending ‘OliverAuth: 0’. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover. 2026-05-20 6.5 CVE-2026-6072 https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6aa922-9c58-445c-b88a-3d1d1c95102c?source=cve https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1679 https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1679 https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1677 https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1677 https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L170 https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L170 https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L195 https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L195 https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L231 https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L231 olivesystem– The è¨ºæ–ã‚¸ã‚§ãƒãƒ¬ãƒ¼ã‚¿ä½œæˆãƒ—ãƒ©ã‚°ã‚¤ãƒ³ (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘js’ parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc() function. The function is hooked to ‘admin_init’ and processes theme update requests without verifying user capabilities, allowing any authenticated user (including subscribers) to save malicious JavaScript to theme files. Additionally, the save() function uses stripslashes() which removes WordPress’s magic quotes protection. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in theme files that will execute whenever a user accesses a page containing the diagnosis form shortcode. 2026-05-20 6.4 CVE-2026-5293 https://www.wordfence.com/threat-intel/vulnerabilities/id/c5293c0f-90b0-41df-a623-90297d998c41?source=cve https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/diagnosisAdminClass.php#L409 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/diagnosisAdminClass.php#L409 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/class/themeClass.php#L26 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/class/themeClass.php#L26 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/class/themeClass.php#L39 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/class/themeClass.php#L39 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/trunk/include_files/user-viewFormPage.php#L102 https://plugins.trac.wordpress.org/browser/os-diagnosis-generator/tags/1.4.16/include_files/user-viewFormPage.php#L102 omec-project–amf A vulnerability was detected in omec-project amf up to 2.1.1. Affected by this vulnerability is an unknown functionality of the component PathSwitchRequest Handler. The manipulation results in memory corruption. The attack may be launched remotely. The exploit is now public and may be used. It is advisable to implement a patch to correct this issue. 2026-05-23 6.3 CVE-2026-9298 VDB-365245 omec-project amf PathSwitchRequest memory corruption VDB-365245 CTI Indicators (IOB, IOC) Submit #811684 Linux Foundation Projects SD-Core 2.1.1 Memory Corruption https://github.com/omec-project/amf/issues/680 https://github.com/omec-project/amf/pull/666 https://github.com/omec-project/amf/ omec-project–amf A flaw has been found in omec-project amf up to 2.1.1. Affected by this issue is the function PDUSessionResourceModifyIndication of the file /go/src/amf/ngap/handler.go. This manipulation causes memory corruption. Remote exploitation of the attack is possible. The exploit has been published and may be used. Applying a patch is the recommended action to fix this issue. 2026-05-23 6.3 CVE-2026-9299 VDB-365246 omec-project amf handler.go PDUSessionResourceModifyIndication memory corruption VDB-365246 CTI Indicators (IOB, IOC, IOA) Submit #811829 Linux Foundation Projects SD-Core 2.1.1 Memory Corruption https://github.com/omec-project/amf/issues/681 https://github.com/omec-project/amf/pull/666 https://github.com/omec-project/amf/ omec-project–amf A vulnerability has been found in omec-project amf up to 2.1.1. This affects an unknown part of the component NGSetupRequest Handler. Such manipulation leads to memory corruption. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. It is best practice to apply a patch to resolve this issue. 2026-05-23 6.3 CVE-2026-9300 VDB-365247 omec-project amf NGSetupRequest memory corruption VDB-365247 CTI Indicators (IOB, IOC) Submit #811841 Linux Foundation Projects SD-Core 2.1.1 Memory Corruption https://github.com/omec-project/amf/issues/679 https://github.com/omec-project/amf/pull/666 https://github.com/omec-project/amf/ omec-project–amf A vulnerability was found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGReset Message Handler. Performing a manipulation results in memory corruption. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is recommended to apply a patch to fix this issue. 2026-05-23 6.3 CVE-2026-9301 VDB-365248 omec-project amf NGReset Message memory corruption VDB-365248 CTI Indicators (IOB, IOC) Submit #811842 Linux Foundation Projects SD-Core 2.1.1 Memory Corruption https://github.com/omec-project/amf/issues/678 https://github.com/omec-project/amf/pull/666 https://github.com/omec-project/amf/ omec-project–amf A vulnerability was determined in omec-project amf up to 2.1.3-dev. Impacted is the function NGSetupRequest of the file ngap/handler.go. Executing a manipulation of the argument InformationElement can lead to memory corruption. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.0 is recommended to address this issue. The affected component should be upgraded. The same pull request fixes multiple security issues. 2026-05-18 4.3 CVE-2026-8779 VDB-364403 omec-project amf handler.go NGSetupRequest memory corruption VDB-364403 CTI Indicators (IOB, IOC, IOA) Submit #811616 Linux Foundation Projects SD-Core 2.1.1 Memory Corruption https://github.com/omec-project/amf/issues/671 https://github.com/omec-project/amf/pull/666 https://github.com/omec-project/amf/releases/tag/v2.2.0 https://github.com/omec-project/amf/ omec-project–amf A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element is an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. It is suggested to upgrade the affected component. The same pull request fixes multiple security issues. 2026-05-18 4.3 CVE-2026-8780 VDB-364404 omec-project amf NGAP Message dispatcher.go memory corruption VDB-364404 CTI Indicators (IOB, IOC, IOA) Submit #811617 Linux Foundation Projects SD-Core 2.1.1 Memory Corruption https://github.com/omec-project/amf/issues/670 https://github.com/omec-project/amf/pull/666 https://github.com/omec-project/amf/releases/tag/v2.2.0 https://github.com/omec-project/amf/ omec-project–amf A security flaw has been discovered in omec-project amf up to 2.1.3-dev. The impacted element is the function RANConfiguration of the file ngap/handler.go. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.2.0 is sufficient to resolve this issue. Upgrading the affected component is recommended. The same pull request fixes multiple security issues. 2026-05-18 4.3 CVE-2026-8781 VDB-364405 omec-project amf handler.go RANConfiguration null pointer dereference VDB-364405 CTI Indicators (IOB, IOC, IOA) Submit #811653 Linux Foundation Projects SD-Core 2.1.1 Memory Corruption https://github.com/omec-project/amf/issues/673 https://github.com/omec-project/amf/pull/666 https://github.com/omec-project/amf/releases/tag/v2.2.0 https://github.com/omec-project/amf/ omec-project–amf A weakness has been identified in omec-project amf up to 2.1.3-dev. This affects an unknown function of the file ngap/handler.go of the component NGAP Message Handler. This manipulation causes null pointer dereference. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 mitigates this issue. It is recommended to upgrade the affected component. The same pull request fixes multiple security issues. 2026-05-18 4.3 CVE-2026-8782 VDB-364406 omec-project amf NGAP Message handler.go null pointer dereference VDB-364406 CTI Indicators (IOB, IOC, IOA) Submit #811654 Linux Foundation Projects SD-Core 2.1.1 Memory Corruption https://github.com/omec-project/amf/issues/674 https://github.com/omec-project/amf/pull/666 https://github.com/omec-project/amf/releases/tag/v2.2.0 https://github.com/omec-project/amf/ omec-project–amf A security vulnerability has been detected in omec-project amf up to 2.1.3-dev. This impacts the function UERadioCapabilityCheckResponse of the file ngap/dispatcher.go. Such manipulation leads to null pointer dereference. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 will fix this issue. Upgrading the affected component is advised. The same pull request fixes multiple security issues. 2026-05-18 4.3 CVE-2026-8783 VDB-364407 omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference VDB-364407 CTI Indicators (IOB, IOC, IOA) Submit #811655 Linux Foundation Projects SD-Core 2.1.1 Memory Corruption https://github.com/omec-project/amf/issues/675 https://github.com/omec-project/amf/pull/666 https://github.com/omec-project/amf/releases/tag/v2.2.0 https://github.com/omec-project/amf/ Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id POST parameter directly into an HTML form input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48213 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-add-php-ticket-id-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_nm.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id POST parameter directly into an HTML form input value attribute and an inline JavaScript string literal. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48214 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-add-nm-php-ticket-id-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in circle.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_id POST parameter directly into an HTML form input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48215 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-circle-php-frm-id-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in db_loader.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix, db_schema) directly into HTML form input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48216 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-db-loader-php-multiple-parameters Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (module_choice, flag, confirmation) directly into rendered HTML content and form action attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48217 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-delete-module-php-multiple-parameters Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_name and frm_id POST parameters directly into rendered HTML content and inline JavaScript. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48218 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-icons-buttons-landb-php-frm-name-and-frm-id-parameters Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics202.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48219 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ics202-php-frm-add-str-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48220 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ics205-php-frm-add-str-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205a.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48221 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ics205a-php-frm-add-str-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48222 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ics213-php-frm-add-str-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213rr.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48223 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ics213rr-php-frm-add-str-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48224 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ics214-php-frm-add-str-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the _type POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48225 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-landb-php-type-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in os_watch.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ref and mode_orig POST parameters directly into HTML form hidden input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48226 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-os-watch-php-ref-and-mode-orig-parameters Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id and ticket_id GET parameters directly into an HTML form action URL. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48227 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-patient-php-id-and-ticket-id-parameters Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_w.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id and ticket_id GET parameters directly into an HTML form action URL. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48228 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-patient-w-php-id-and-ticket-id-parameters Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_i.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into HTML form hidden input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48229 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-routes-i-php-ticket-id-parameter Open ISES–Tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdb_import.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (mdbhost, mdbdb, mdbuser, mdbpassword, mdbprefix, ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix) directly into HTML form hidden input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim’s browser when the response is rendered. 2026-05-21 5.4 CVE-2026-48230 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ticketsmdb-import-php-multiple-parameters Open ISES–Tickets Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner’s WhitePages account. 2026-05-21 5.3 CVE-2026-48243 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-hardcoded-whitepages-api-key-in-wp1-php Open ISES–Tickets Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner’s Google Cloud project. 2026-05-21 5.3 CVE-2026-48244 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-hardcoded-google-maps-api-key-in-settings-inc-php Open ISES–Tickets Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner’s Google Cloud project. 2026-05-21 5.3 CVE-2026-48245 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-hardcoded-google-maps-api-key-in-tables-php Open ISES–Tickets Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit. 2026-05-21 5.9 CVE-2026-48246 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-ajax-reports-php Open ISES–Tickets Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for general-purpose outbound HTTPS requests issued by the shared helper functions. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit. 2026-05-21 5.9 CVE-2026-48247 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-incs-functions-inc-php Open ISES–Tickets Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests issued during the login/authentication flow. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit. 2026-05-21 5.9 CVE-2026-48248 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-incs-login-inc-php Open ISES–Tickets Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests issued during the mobile (RouteMate) login flow. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit. 2026-05-21 5.9 CVE-2026-48249 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-rm-incs-mobile-login-inc-php OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution. 2026-05-19 6.5 CVE-2026-28733 https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak 2026-05-19 5.5 CVE-2026-25850 https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak. 2026-05-19 5.5 CVE-2026-27766 https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single_unit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a malicious URL containing a JavaScript payload in the id parameter that executes in the victim’s browser when the URL is visited. 2026-05-20 4.6 CVE-2026-35007 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-single-unit-php-id-parameter openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into an HTML attribute. Attackers can craft a malicious URL containing a JavaScript payload in the id parameter that executes in the victim’s browser when the URL is visited. 2026-05-20 4.6 CVE-2026-35008 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-single-php-ticket-id-parameter openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_note.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a hidden input field VALUE attribute. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim’s browser when the URL is visited. 2026-05-20 4.6 CVE-2026-35009 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-add-note-php-ticket-id-parameter openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_JF.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim’s browser when the URL is visited. 2026-05-20 4.6 CVE-2026-35010 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-patient-jf-php-ticket-id-parameter openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_call GET parameter directly into page output. Attackers can craft a malicious URL containing a JavaScript payload in the frm_call parameter that executes in the victim’s browser when the URL is visited. 2026-05-20 4.6 CVE-2026-35011 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-opena-php-frm-call-parameter openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a hidden input field VALUE attribute. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim’s browser when the URL is visited. 2026-05-20 4.6 CVE-2026-35012 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-add-facnote-php-ticket-id-parameter openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitrary JavaScript by passing unsanitized values through the thelat and thelng GET parameters directly into JavaScript variable assignments. Attackers can craft a malicious URL containing a JavaScript payload in either parameter that executes in the victim’s browser when the URL is visited. 2026-05-20 4.6 CVE-2026-35013 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-street-view-php-thelat-and-thelng-parameters openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_nm.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a hidden input field VALUE attribute. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim’s browser when the URL is visited. 2026-05-20 4.6 CVE-2026-35014 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-routes-nm-php-ticket-id-parameter openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the the_ticket GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the the_ticket parameter that executes in the victim’s browser when the URL is visited. 2026-05-20 4.6 CVE-2026-35015 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-do-unit-mail-php-the-ticket-parameter openises–tickets Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_query POST parameter directly into an HTML input field VALUE attribute. Attackers can craft a malicious request containing a JavaScript payload in the frm_query parameter that executes in the victim’s browser when submitted. 2026-05-20 4.6 CVE-2026-35016 https://github.com/openises/tickets/releases/tag/v3.44.2 https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-search-php-frm-query-parameter opensourcepos–Open Source Point of Sale A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure. 2026-05-18 4.3 CVE-2026-8802 VDB-364435 opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal VDB-364435 CTI Indicators (IOB, IOC, TTP, IOA) Submit #802559 opensourcepos Open Source Point of Sale 3.4.1 Path Traversal https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xq63-3v4g-39r5 https://github.com/opensourcepos/opensourcepos/pull/4545 https://github.com/opensourcepos/opensourcepos/commit/def0c27a0e252668df8d942fc31e16d1edfd7323 owencutajar–SponsorMe The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The PHP_SELF value is reflected in two separate locations within the vulnerable function - a form action attribute and an anchor href attribute - both of which can be exploited by appending a crafted payload to the wp-admin/admin.php URL path. 2026-05-20 6.1 CVE-2026-8626 https://www.wordfence.com/threat-intel/vulnerabilities/id/7df7f541-b8aa-46fa-bfca-b333beea27f9?source=cve https://plugins.trac.wordpress.org/browser/sponsorme/trunk/sponsorme.php#L440 https://plugins.trac.wordpress.org/browser/sponsorme/trunk/sponsorme.php#L475 pftool–Alfie Feed Plugin The Alfie - Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_manage() function which handles feed deletion via the ‘delete’ GET parameter. This makes it possible for unauthenticated attackers to delete arbitrary plugin feed data (from alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct tables) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-05-22 4.3 CVE-2026-4070 https://www.wordfence.com/threat-intel/vulnerabilities/id/af36719a-8f7d-46dc-a697-cfcbb08e45e2?source=cve https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L60 https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L60 https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/trunk/include/alfie-manage.php#L58 https://plugins.trac.wordpress.org/browser/alfie-the-productfeedtool-wp-plugin/tags/1.2.1/include/alfie-manage.php#L58 PowerDNS–Authoritative Insufficient Validation of Names During AXFR 2026-05-21 6.8 CVE-2026-42000 https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html PowerDNS–Authoritative Concurrency and locking defects in GSS-TSIG 2026-05-21 5.9 CVE-2026-42002 https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html PowerDNS–Authoritative Incorrect Behaviour of Views with TCP PROXY Requests 2026-05-21 4.8 CVE-2026-41999 https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html PowerDNS–Authoritative Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail 2026-05-21 4.9 CVE-2026-42396 https://docs.powerdns.com/authoritative/security-advisories/powerdns-advisory-powerdns-2026-06.html Progress Software–MOVEit Automation Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7. 2026-05-20 6.5 CVE-2026-8487 https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html Progress Software–MOVEit Automation Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7. 2026-05-20 5.9 CVE-2026-8485 https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html Progress Software–MOVEit Automation Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7. 2026-05-20 5.3 CVE-2026-8486 https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html Progress Software–MOVEit Automation Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7. 2026-05-20 4.3 CVE-2026-8488 https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html QuantumNous–new-api A weakness has been identified in QuantumNous new-api up to 0.12.1. The impacted element is the function SearchUserTopUps/SearchAllTopUps of the file model/topup.go of the component self Endpoint. This manipulation causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-23 6.3 CVE-2026-9305 VDB-365252 QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection VDB-365252 CTI Indicators (IOB, IOC, TTP, IOA) Submit #812192 QuantumNous new-api [Needs Manual Input] SQL Injection (CWE-89) Submit #812195 QuantumNous new-api 0.12.1 Improper Neutralization of Data Query Logic (CWE-943) (Duplicate) https://gist.github.com/YLChen-007/cf501d0a66c81298b2f97e854f3813db rdbeach–BLOGCHAT Chat System The BLOGCHAT Chat System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-05-20 6.1 CVE-2026-8420 https://www.wordfence.com/threat-intel/vulnerabilities/id/a62186aa-19aa-445b-8fdc-b029bdafd58f?source=cve https://plugins.trac.wordpress.org/browser/blogchat-chat-system/trunk/wp-blogchat-widget.php#L208 https://plugins.trac.wordpress.org/browser/blogchat-chat-system/tags/1.3.6.3/wp-blogchat-widget.php#L208 https://plugins.trac.wordpress.org/browser/blogchat-chat-system/trunk/wp-blogchat-widget.php#L215 https://plugins.trac.wordpress.org/browser/blogchat-chat-system/tags/1.3.6.3/wp-blogchat-widget.php#L215 https://plugins.trac.wordpress.org/browser/blogchat-chat-system/trunk/wp-blogchat-widget.php#L222 https://plugins.trac.wordpress.org/browser/blogchat-chat-system/tags/1.3.6.3/wp-blogchat-widget.php#L222 https://plugins.trac.wordpress.org/browser/blogchat-chat-system/trunk/wp-blogchat-widget.php#L293 https://plugins.trac.wordpress.org/browser/blogchat-chat-system/tags/1.3.6.3/wp-blogchat-widget.php#L293 Red Hat–Red Hat Build of Keycloak A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim’s local account. 2026-05-20 6.4 CVE-2026-9087 https://access.redhat.com/security/cve/CVE-2026-9087 RHBZ#2480172 Red Hat–Red Hat Build of Keycloak A flaw was found in Keycloak. When both realm-level and client-level notBefore revocation policies are configured, Keycloak’s OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management. 2026-05-19 5.4 CVE-2026-8922 https://access.redhat.com/security/cve/CVE-2026-8922 RHBZ#2479586 Red Hat–Red Hat Build of Keycloak A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential’s parameters, such as public key algorithms, match the realm’s configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods. 2026-05-19 4.3 CVE-2026-8830 https://access.redhat.com/security/cve/CVE-2026-8830 RHBZ#2479565 Red Hat–Red Hat build of Keycloak 26.4 A flaw was found in Keycloak. This access control vulnerability in Keycloak’s OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials. 2026-05-19 6.5 CVE-2026-37979 RHSA-2026:19596 RHSA-2026:19597 https://access.redhat.com/security/cve/CVE-2026-37979 RHBZ#2455328 Red Hat–Red Hat build of Keycloak 26.4 A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ExecuteActionsActionToken tokens within Keycloak’s WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim’s account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover. 2026-05-19 6.8 CVE-2026-37982 RHSA-2026:19596 RHSA-2026:19597 https://access.redhat.com/security/cve/CVE-2026-37982 RHBZ#2455329 Red Hat–Red Hat build of Keycloak 26.4 A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the Authorization Services Protection API endpoint. By knowing or obtaining a resource’s unique identifier (UUID) belonging to another Resource Server within the same realm, the client could bypass authorization checks. This allows the client to perform unauthorized GET, PUT, and DELETE operations on resources, leading to information disclosure and potential unauthorized modification or deletion of data. 2026-05-19 6.8 CVE-2026-4630 RHSA-2026:19596 RHSA-2026:19597 https://access.redhat.com/security/cve/CVE-2026-4630 RHBZ#2450245 Red Hat–Red Hat build of Keycloak 26.4 A flaw was found in Keycloak. A low-privilege administrator with the ‘view-clients’ role can exploit this by invoking the ‘evaluate-scopes’ Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cross-role personally identifiable information (PII) leakage, enabling unauthorized visibility into user identities and authorizations across the realm. Exploitation is possible remotely via network access to the Admin API. 2026-05-19 4.9 CVE-2026-37978 RHSA-2026:19596 RHSA-2026:19597 https://access.redhat.com/security/cve/CVE-2026-37978 RHBZ#2455327 Red Hat–Red Hat build of Keycloak 26.4 A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access (UMA) resource, to enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values, the endpoint returns full profile objects for unrelated users. This leads to broad profile-level information disclosure. 2026-05-19 4.3 CVE-2026-37981 RHSA-2026:19596 RHSA-2026:19597 https://access.redhat.com/security/cve/CVE-2026-37981 RHBZ#2455326 Red Hat–Red Hat Enterprise Linux 10 A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted .solv file containing negative size values in the repo_add_solv function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS). 2026-05-20 6.5 CVE-2026-9149 https://access.redhat.com/security/cve/CVE-2026-9149 RHBZ#2460380 https://github.com/openSUSE/libsolv/pull/617 Red Hat–Red Hat Enterprise Linux 10 A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv’s Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system. 2026-05-20 6.5 CVE-2026-9150 https://access.redhat.com/security/cve/CVE-2026-9150 RHBZ#2460379 https://github.com/openSUSE/libsolv/pull/616 registrationformbuilder–Vedrixa Forms User Registration Form, Signup Form & Drag & Drop Form Builder The Vedrixa Forms - User Registration Form, Signup Form & Drag & Drop Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the structure of any form - adding, removing, or altering fields - by writing attacker-controlled data to the plugin’s FORMS database table. The ‘ajax-nonce’ nonce used by this handler is injected into the public frontend via wp_localize_script(), so any authenticated user who visits a page containing a form shortcode can obtain it without any elevated access. 2026-05-22 4.3 CVE-2026-8692 https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3b8a6c-1c84-4abe-ad4a-02302b04987b?source=cve https://plugins.trac.wordpress.org/browser/vedrixa-forms-registration-builder/tags/1.1.1/admin/class-registration-form-builder-admin.php#L866 https://plugins.trac.wordpress.org/browser/vedrixa-forms-registration-builder/tags/1.1.1/includes/class-registration-form-builder.php#L174 https://plugins.trac.wordpress.org/browser/vedrixa-forms-registration-builder/tags/1.1.1/public/class-registration-form-builder-public.php#L121 https://plugins.trac.wordpress.org/browser/vedrixa-forms-registration-builder/tags/1.0.0/admin/class-registration-form-builder-admin.php#L866 https://plugins.trac.wordpress.org/browser/vedrixa-forms-registration-builder/tags/1.0.0/includes/class-registration-form-builder.php#L174 https://plugins.trac.wordpress.org/browser/vedrixa-forms-registration-builder/tags/1.0.0/public/class-registration-form-builder-public.php#L121 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3540543%40vedrixa-forms-registration-builder&new=3540543%40vedrixa-forms-registration-builder&sfp_email=&sfph_mail= Revolution Slider–Slider Revolution The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.0.9 via the ‘get_stream_data()’ function. This makes it possible for unauthenticated attackers to extract sensitive data including published password-protected post, page, and product content. 2026-05-20 5.3 CVE-2026-6728 https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd7be2c-9ba9-4d25-8907-610898df5834?source=cve https://www.sliderrevolution.com/changelog/ RsyncProject–rsync Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with ‘use chroot = no’. 2026-05-20 6.3 CVE-2026-43619 https://github.com/RsyncProject/rsync/security/advisories/GHSA-4h9m-w5ff-j735 https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-path-based-syscalls RsyncProject–rsync Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client. 2026-05-20 6.5 CVE-2026-43620 https://github.com/RsyncProject/rsync/security/advisories/GHSA-28pw-r563-rxvm https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 https://www.vulncheck.com/advisories/rsync-out-of-bounds-array-read-via-recv-files RsyncProject–rsync Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon’s hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN. 2026-05-20 4.8 CVE-2026-43617 https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-hostname-resolution Samsung Open Source–Escargot Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. 2026-05-19 5.5 CVE-2026-47309 https://github.com/Samsung/escargot/pull/1565 Samsung Open Source–Escargot Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. 2026-05-19 5.5 CVE-2026-47312 https://github.com/Samsung/escargot/pull/1565 Samsung Open Source–Escargot Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. 2026-05-19 5.5 CVE-2026-47313 https://github.com/Samsung/escargot/pull/1565 Samsung Open Source–Escargot Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. 2026-05-19 5.5 CVE-2026-47315 https://github.com/Samsung/escargot/pull/1565 Samsung Open Source–Escargot Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. 2026-05-19 5.5 CVE-2026-47316 https://github.com/Samsung/escargot/pull/1565 Samsung Open Source–Escargot Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3. 2026-05-19 5.5 CVE-2026-47317 https://github.com/Samsung/escargot/pull/1565 Samsung Open Source–Walrus NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containing deeply nested instructions. This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9. 2026-05-19 5.5 CVE-2026-47307 https://github.com/Samsung/walrus/pull/409 Samsung Open Source–Walrus NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9. 2026-05-19 5.5 CVE-2026-47308 https://github.com/Samsung/walrus/pull/409 shapedplugin–Location Weather WordPress Weather Forecast, AQI, Temperature and Weather Widget The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splw_update_block_options() and lwp_clean_weather_transients() functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is exposed to all authenticated users via wp_localize_script() on the init hook. 2026-05-22 4.3 CVE-2026-7249 https://www.wordfence.com/threat-intel/vulnerabilities/id/d472011d-1623-4791-9d56-715d90fe0469?source=cve https://plugins.trac.wordpress.org/browser/location-weather/tags/3.0.2/includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php#L256 https://plugins.trac.wordpress.org/browser/location-weather/tags/3.0.2/includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php#L331 https://wordpress.org/plugins/location-weather/ https://plugins.trac.wordpress.org/browser/location-weather/tags/3.0.3/includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php#L256 https://plugins.trac.wordpress.org/browser/location-weather/tags/3.0.3/includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php#L332 Significant-Gravitas–AutoGPT AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, SendEmailBlock in autogpt_platform/backend/backend/blocks/email_block.py accepts a user-supplied smtp_server (string) and smtp_port (integer) as per-execution block inputs, then passes them directly to Python’s smtplib.SMTP() to open a raw TCP connection with no IP address validation. This completely bypasses the platform’s hardened SSRF protections in backend/util/request.py - the validate_url_host() function and BLOCKED_IP_NETWORKS blocklist that every other block uses to block connections to private, loopback, link-local, and cloud metadata addresses. An authenticated user on a shared AutoGPT deployment can use this to perform non-blind internal network port scanning and service fingerprinting: smtplib reads the target’s TCP banner on connect and embeds it in the exception message, which is persisted as user-visible block output via the execution framework. This issue has been fixed in version 0.6.52. 2026-05-19 5 CVE-2026-33234 https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-4jwj-6mg5-wrwf https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.52 simonholliday–Anomify AI Anomaly Detection and Alerting The Anomify AI - Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anomify_api_key’ parameter in versions up to and including 0.3.6. This is due to insufficient input sanitization and missing output escaping: the plugin applies sanitize_text_field() to the Metric Data Key input before saving it via update_option(), but sanitize_text_field() strips HTML tags without encoding double-quote characters, and the value is then echoed directly into an HTML attribute context (value=”…”) without esc_attr(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that execute whenever a user visits the plugin’s settings page. 2026-05-20 4.4 CVE-2026-6404 https://www.wordfence.com/threat-intel/vulnerabilities/id/4036057c-0c43-4d9c-97db-4861d91a4daa?source=cve https://plugins.trac.wordpress.org/browser/anomify/trunk/Anomify/Wp/includes/admin_options.php#L43 https://plugins.trac.wordpress.org/browser/anomify/tags/0.3.6/Anomify/Wp/includes/admin_options.php#L43 https://plugins.trac.wordpress.org/browser/anomify/trunk/Anomify/Wp/Admin.php#L32 https://plugins.trac.wordpress.org/browser/anomify/tags/0.3.6/Anomify/Wp/Admin.php#L32 https://plugins.trac.wordpress.org/browser/anomify/trunk/Anomify/Config.php#L152 https://plugins.trac.wordpress.org/browser/anomify/tags/0.3.6/Anomify/Config.php#L152 simonholliday–Anomify AI Anomaly Detection and Alerting The Anomify AI - Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in versions up to and including 0.3.6. This is due to missing nonce verification on the settings page handler and insufficient output escaping in the admin_options.php template. The settings form includes no wp_nonce_field() and the handler performs no check_admin_referer() check, meaning any cross-origin POST can modify plugin settings. The API key field is sanitized only with sanitize_text_field(), which strips HTML tags but does not encode double-quote characters; the value is then rendered into an HTML attribute via bare echo without esc_attr(), allowing a double-quote attribute-escape payload to survive both sanitization and storage. This makes it possible for unauthenticated attackers to inject arbitrary web scripts by tricking a logged-in administrator into visiting a malicious page that submits a forged request, storing the payload in the database and causing it to execute in the administrator’s browser whenever the plugin settings page is visited. 2026-05-20 4.3 CVE-2026-6405 https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e02c2d-a38a-495c-9c37-098049297be2?source=cve https://plugins.trac.wordpress.org/browser/anomify/trunk/Anomify/Wp/includes/admin_options.php#L43 https://plugins.trac.wordpress.org/browser/anomify/tags/0.3.6/Anomify/Wp/includes/admin_options.php#L43 https://plugins.trac.wordpress.org/browser/anomify/trunk/Anomify/Wp/Admin.php#L31 https://plugins.trac.wordpress.org/browser/anomify/tags/0.3.6/Anomify/Wp/Admin.php#L31 https://plugins.trac.wordpress.org/browser/anomify/trunk/Anomify/Config.php#L152 https://plugins.trac.wordpress.org/browser/anomify/tags/0.3.6/Anomify/Config.php#L152 smub–All in One SEO Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via ‘internalOptions’ localized script data in versions up to, and including, 4.9.7 due to sensitive internal option data being passed to wp_localize_script() in post editor contexts without effective masking for low-privilege users. This makes it possible for authenticated attackers, with contributor-level access and above, to view configured API/OAuth tokens and license-related values from page source. 2026-05-20 4.3 CVE-2026-5075 https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8bc203-c17a-4b31-8f9e-695f9e638cda?source=cve https://plugins.trac.wordpress.org/changeset/3532318/all-in-one-seo-pack smub–Photo Gallery, Sliders, Proofing and Themes NextGEN Gallery The Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks ‘NextGEN Manage gallery’ permissions and does not enforce gallery ownership or ‘NextGEN Manage others gallery’ permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and ‘NextGEN Manage gallery’ capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default). 2026-05-20 4.3 CVE-2026-6566 https://www.wordfence.com/threat-intel/vulnerabilities/id/439809ad-21ea-4a0b-b1fd-5de9f8f5ee7a?source=cve https://plugins.trac.wordpress.org/changeset/3533432/nextgen-gallery smub–Slider by Soliloquy Responsive Image Slider for WordPress The Slider by Soliloquy - Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 via the map_meta_cap. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract draft slider metadata including unpublished media URLs, captions, and slider configuration authored by administrators or editors. 2026-05-22 4.3 CVE-2026-7636 https://www.wordfence.com/threat-intel/vulnerabilities/id/54115a9a-dadd-4f18-a139-02ec89f0a571?source=cve https://plugins.trac.wordpress.org/browser/soliloquy-lite/trunk/includes/global/posttype.php#L90 https://plugins.trac.wordpress.org/browser/soliloquy-lite/trunk/includes/global/posttype.php#L177 https://plugins.trac.wordpress.org/browser/soliloquy-lite/tags/2.8.1/includes/global/posttype.php#L177 https://plugins.trac.wordpress.org/browser/soliloquy-lite/trunk/includes/global/posttype.php#L125 https://plugins.trac.wordpress.org/browser/soliloquy-lite/tags/2.8.1/includes/global/posttype.php#L125 https://plugins.trac.wordpress.org/browser/soliloquy-lite/tags/2.8.1/includes/global/posttype.php#L90 https://plugins.trac.wordpress.org/changeset/3538404/soliloquy-lite/trunk/includes/global/posttype.php?old=3395148&old_path=soliloquy-lite%2Ftrunk%2Fincludes%2Fglobal%2Fposttype.php SourceCodester–Hospitals Patient Records Management System A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. Impacted is an unknown function of the file /admin/patients/view_history.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. 2026-05-23 6.3 CVE-2026-9342 VDB-365305 SourceCodester Hospitals Patient Records Management System view_history.php sql injection VDB-365305 CTI Indicators (IOB, IOC, TTP, IOA) Submit #812834 sourcecodester Hospital’s Patient Records Management System V1.0 SQL injection https://github.com/july-skyload/exp/issues/1 https://www.sourcecodester.com/ Splunk–Splunk AI Toolkit In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the ‘admin’ or ‘power’ roles could access confidential data that was restricted through srchFilter configurations on custom roles.

The app contains an authorize.conf configuration file with a srchFilter entry that modifies the built-in ‘user’ role. Because the Splunk platform combines inherited search filters with the OR SPL operator, the injected filter overrides more restrictive filters on child roles. 2026-05-20 6.5 CVE-2026-20238 https://advisory.splunk.com/advisories/SVD-2026-0502 steipete–summarize Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks. 2026-05-18 6.1 CVE-2026-45243 https://github.com/steipete/summarize/releases/tag/v0.15.2 https://github.com/steipete/summarize/pull/222 https://github.com/steipete/summarize/commit/357544063af535bd574752622f9eb94be33ee5fd https://www.vulncheck.com/advisories/summarize-browser-extension-missing-authorization-via-content-script steipete–summarize Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content. 2026-05-18 5.4 CVE-2026-45244 https://github.com/steipete/summarize/releases/tag/v0.15.2 https://github.com/steipete/summarize/pull/219 https://github.com/steipete/summarize/commit/e64fe3ecd1bb4fdc181dcfa88c96b9e1914ced0e https://www.vulncheck.com/advisories/summarize-unapproved-browser-automation-execution steipete–summarize Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems. 2026-05-18 5.5 CVE-2026-45246 https://github.com/steipete/summarize/releases/tag/v0.15.2 https://github.com/steipete/summarize/pull/217 https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure storybookjs–telejson TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious constructor-name property value. The custom reviver passes the constructor name directly to new Function() without sanitization when recreating object prototypes, enabling attackers to inject arbitrary JavaScript through vectors such as postMessage in cross-frame communication contexts to achieve script execution within the application. 2026-05-20 6.1 CVE-2026-47099 https://github.com/storybookjs/telejson/security/advisories/GHSA-ccgf-5rwj-j3hv https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-47099/cve-2026-47099.md https://www.vulncheck.com/advisories/telejson-dom-based-xss-via-parse-function strukturag–libheif libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0. 2026-05-19 6.5 CVE-2026-32738 https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww strukturag–libheif libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS. The loop has no iteration limit or timeout and is triggered during file open (parsing) - before any user interaction or image decoding. The process stays alive (no crash, no error logged), making it invisible to crash-based monitoring. This issue has been fixed in version 1.22.0. 2026-05-19 6.5 CVE-2026-32739 https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c https://github.com/strukturag/libheif/releases/tag/v1.22.0 strukturag–libheif libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() â†’ plane.alloc() â†’ new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile’s region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users’ image data. This issue has been fixed in version 1.22.0. 2026-05-19 6.5 CVE-2026-32814 https://github.com/strukturag/libheif/security/advisories/GHSA-4m8r-34pg-rvwc https://github.com/strukturag/libheif/releases/tag/v1.22.0 strukturag–libheif libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count == 0 (creating no chunks) while still passing validation because saio.entry_count == 0 matches, but with saiz.sample_count > 0 the SampleAuxInfoReader constructor still enters its loop. This leads to an out-of-bounds dereference on the empty chunks[0] in chunked mode. 2026-05-22 6.5 CVE-2026-41069 https://github.com/strukturag/libheif/security/advisories/GHSA-p82x-fpmv-576r https://github.com/strukturag/libheif/releases/tag/v1.22.0 submone–Amazon Scraper The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2026-05-20 4.3 CVE-2026-8419 https://www.wordfence.com/threat-intel/vulnerabilities/id/c956e4c5-bf7e-4ec4-b795-74d477a61694?source=cve https://plugins.trac.wordpress.org/browser/amazon-scraper/trunk/amazon-admin.php#L49 https://plugins.trac.wordpress.org/browser/amazon-scraper/tags/1.1/amazon-admin.php#L49 https://plugins.trac.wordpress.org/browser/amazon-scraper/trunk/amazon-admin.php#L13 https://plugins.trac.wordpress.org/browser/amazon-scraper/tags/1.1/amazon-admin.php#L13 https://plugins.trac.wordpress.org/browser/amazon-scraper/trunk/amazon-admin.php#L26 https://plugins.trac.wordpress.org/browser/amazon-scraper/tags/1.1/amazon-admin.php#L26 https://plugins.trac.wordpress.org/browser/amazon-scraper/trunk/amazon-admin.php#L45 https://plugins.trac.wordpress.org/browser/amazon-scraper/tags/1.1/amazon-admin.php#L45 svil4ok–Bottom Bar The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.1.7. This is due to missing nonce verification on the plugin’s settings update forms handled in bottom-bar-admin.php. None of the three settings forms (main settings, sharing services, restore defaults) include a wp_nonce_field(), and the server-side processing code never calls check_admin_referer() or any equivalent nonce validation before processing POST data and calling update_option(). This makes it possible for unauthenticated attackers to trick a logged-in administrator into submitting a crafted request that updates plugin configuration options, such as changing the language, maximum post counts, or enabled sharing services. 2026-05-20 4.3 CVE-2026-6401 https://www.wordfence.com/threat-intel/vulnerabilities/id/db0715ed-a06e-4a68-b9c3-408887cae113?source=cve https://plugins.trac.wordpress.org/browser/bottom-bar/trunk/bottom-bar-admin.php#L16 https://plugins.trac.wordpress.org/browser/bottom-bar/tags/0.1.7/bottom-bar-admin.php#L16 https://plugins.trac.wordpress.org/browser/bottom-bar/trunk/bottom-bar-admin.php#L59 https://plugins.trac.wordpress.org/browser/bottom-bar/tags/0.1.7/bottom-bar-admin.php#L59 syslink software AG–Avantra Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords. This issue affects Avantra: before 25.3.0. 2026-05-22 5.1 CVE-2026-8672 https://support.avantra.com/hc/en-us/articles/5535551609759 syslink software AG–Avantra Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: before 25.3.0. 2026-05-22 5.9 CVE-2026-8673 https://support.avantra.com/hc/en-us/articles/5535621927071 Talend–Talend Administration Center A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user. 2026-05-20 5.4 CVE-2026-9056 https://community.qlik.com/t5/Official-Support-Articles/Security-fix-for-Qlik-Talend-Administration-Center-cross-site/ta-p/2548522 TeamViewer–DEX (On-premises) A broken access control vulnerability exists in the TeamViewer DEX Platform (Onâ€‘Premises) prior version 9.2. Certain backend API endpoints do not correctly enforce authorization checks, allowing an authenticated user with low privileges to perform actions and access resources intended only for higherâ€‘privileged roles. An attacker with lowâ€‘privileged credentials may exploit this to gain unauthorized access to administrative or sensitive functionality. 2026-05-22 5.4 CVE-2026-8381 https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1005/ techjewel–FluentCRM Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution The FluentCRM - Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the ‘SubscribeURL’ parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key (‘_fc_bounce_key’) has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests. 2026-05-22 5.4 CVE-2026-7798 https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3ca2d7-7af9-401f-bc5a-1796c6253cb0?source=cve https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php#L113 https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L113 https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php#L85 https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L85 https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php#L87 https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L87 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3532271%40fluent-crm&new=3532271%40fluent-crm&sfp_email=&sfph_mail= Technitium–DNS Server Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker in control of a domain can cause a vulnerable system to generate excessive network traffic. Fixed in 15.0. 2026-05-19 5.8 CVE-2026-45557 url url url Tencent–WeKnora A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-18 6.3 CVE-2026-8786 VDB-364410 Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization VDB-364410 CTI Indicators (IOB, IOC, IOA) Submit #812172 Tencent WeKnora <= v0.3.6 Insecure Direct Object Reference (CWE-639) https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b themefusion–Avada (Fusion) Builder The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an administrator) accesses a page displaying dynamic user data (such as via the Dynamic Data feature pulling user biographical information). 2026-05-21 6.4 CVE-2026-1543 https://www.wordfence.com/threat-intel/vulnerabilities/id/72a6b040-ed02-4561-82f2-4adb820bdf7d?source=cve https://themeforest.net/item/avada-responsive-multipurpose-theme/2833226 https://avada.com/documentation/avada-changelog/ Themeisle–Visualizer Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Themeisle Visualizer allows Stored XSS. This issue affects Visualizer: from n/a before 4.0.0. 2026-05-20 6.5 CVE-2026-24573 https://patchstack.com/database/wordpress/plugin/visualizer/vulnerability/wordpress-visualizer-plugin-4-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve themeum–Kirki Freeform Page Builder, Website Builder & Customizer The Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms. 2026-05-19 6.5 CVE-2026-8096 https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4414b1-6a49-42f8-9927-93763d1502ce?source=cve https://plugins.trac.wordpress.org/browser/kirki/tags/6.0.4/includes/Ajax.php#L675 https://plugins.trac.wordpress.org/changeset/3535640/kirki Tobias–CF7 WOW Styler Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 WOW Styler: from n/a through 1.7.6. 2026-05-21 5.3 CVE-2026-27393 https://patchstack.com/database/wordpress/plugin/cf7-styler/vulnerability/wordpress-cf7-wow-styler-plugin-1-7-6-broken-access-control-vulnerability?_s_id=cve Trend Micro, Inc.–TrendAI Apex One A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability. 2026-05-21 6.7 CVE-2026-34926 https://success.trendmicro.com/en-US/solution/KA-0023430 https://success.trendmicro.com/ja-JP/solution/KA-0022974 https://jvn.jp/en/vu/JVNVU90583059/ https://www.jpcert.or.jp/english/at/2026/at260014.html TriliumNext–Trilium Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server’s filesystem. The uploadModifiedFileToAttachment function, which is called when a POST request is received to /api/attachments/{attachmentId}/upload-modified-file, replaces the content of the attachment with the content from another file (whose path is provided in filePath of Request body). After which the content of the attachment can be viewed at /api/attachments/{attachmentId}/download. This exposes sensitive system files such as SSH keys, credentials, configs, and OS files, potentially leading to remote code execution and compromise of co-hosted applications. This issue has been fixed in version 0.102.2. 2026-05-19 6.8 CVE-2026-35593 https://github.com/TriliumNext/Trilium/security/advisories/GHSA-hf4x-22rg-pjjp https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2 TriliumNext–Trilium Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Versions 0.102.1 and prior contain a critical security flaw where lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API results in an unauthenticated Remote Code Execution (RCE). The vulnerability arises from an insecure-by-design architecture: Trilium serves SVG attachments with the image/svg+xml MIME type without any sanitization, and it explicitly disables Helmet’s Content Security Policy middleware, removing the primary defense against script execution in served assets. Because the malicious SVG runs under the Same-Origin Policy, it can issue a fetch(‘/’) to extract the csrfToken from the document body. With that token, it can send a signed request to /api/script/exec to execute arbitrary Node.js code on the server. An attacker can compromise the entire server instance simply by tricking an authenticated user into viewing a shared SVG attachment. The issue has been fixed in version 0.102.2. 2026-05-20 6.8 CVE-2026-39311 https://github.com/TriliumNext/Trilium/security/advisories/GHSA-p837-cxw3-m964 https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2 TriliumNext–Trilium Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission prompts by running malicious code under the identity of the trusted app. The root cause is that the RunAsNode fuse allows launching the app in a special Node.js mode using -e to execute arbitrary system commands with Trilium Notes’s permissions and identity. An attacker can leverage this through a subprocess to request any sensitive permissions, such as access to hardware (camera, microphone) and TCC-protected files, causing the TCC system prompt to appear as if the request came from Trilium rather than the attacker’s code, because macOS treats the subprocess as part of the parent application. Exploitation allows access to TCC-protected resources like the screen, camera, microphone, and folders such as ~/Documents and ~/Downloads, undermining macOS’s security model and UI integrity through social engineering. This issue has been fixed in version 0.102.2. 2026-05-19 5.5 CVE-2026-39309 https://github.com/TriliumNext/Trilium/security/advisories/GHSA-66pm-8hvq-2wwx https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2 Turkiye Electricity Transmission Corporation (TEA)–Mobile Application Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEÄ°AÅž) Mobile Application allows Brute Force. This issue affects Mobile Application: from 1.6.2 before 1.13. 2026-05-21 6.3 CVE-2026-1816 https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0286 Turkiye Electricity Transmission Corporation (TEA)–Mobile Application Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEÄ°AÅž) Mobile Application allows Session Hijacking. This issue affects Mobile Application: from 1.6.2 before 1.13. 2026-05-21 5.7 CVE-2026-1815 https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0286 UserSpice–userSpice userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. Attackers can send crafted requests to the backup.php endpoint with XSS payloads in the X-Forwarded-For header that execute when administrators visit the audit log page. 2026-05-23 6.1 CVE-2018-25349 ExploitDB-44871 VulnCheck Advisory: userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header vatanyazilim–VatanSMS WP SMS The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link. 2026-05-20 6.1 CVE-2026-7462 https://www.wordfence.com/threat-intel/vulnerabilities/id/96ef8459-1600-4ca0-93c6-0ee42f8adabd?source=cve https://plugins.trac.wordpress.org/browser/wp-sms-vatansms-com/trunk/includes/admin/groups/groups.php#L34 https://plugins.trac.wordpress.org/browser/wp-sms-vatansms-com/trunk/includes/admin/outbox/outbox.php#L5 https://plugins.trac.wordpress.org/browser/wp-sms-vatansms-com/trunk/includes/admin/subscribers/subscribers.php#L128 VillaTheme–HAPPY Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: from n/a through 1.0.10. 2026-05-21 6.5 CVE-2026-39593 https://patchstack.com/database/wordpress/plugin/happy-helpdesk-support-ticket-system/vulnerability/wordpress-happy-plugin-1-0-10-broken-access-control-vulnerability?_s_id=cve Webmin–Webmin Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi. 2026-05-21 5.4 CVE-2026-22678 https://webmin.com/changelog/webmin-2.641-released/ https://www.vulncheck.com/advisories/webmin-stored-xss-via-system-and-server-status winking–Word 2 Cash The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited. 2026-05-20 6.1 CVE-2026-6395 https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c7ca5c-38aa-4413-83eb-29185cca2a74?source=cve https://plugins.trac.wordpress.org/browser/word-2-cash/trunk/word2cash.php#L31 https://plugins.trac.wordpress.org/browser/word-2-cash/tags/0.9.2/word2cash.php#L31 https://plugins.trac.wordpress.org/browser/word-2-cash/trunk/word2cash.php#L20 https://plugins.trac.wordpress.org/browser/word-2-cash/tags/0.9.2/word2cash.php#L20 https://plugins.trac.wordpress.org/browser/word-2-cash/trunk/word2cash.php#L18 https://plugins.trac.wordpress.org/browser/word-2-cash/tags/0.9.2/word2cash.php#L18 WP Chill--Image Photo Gallery Final Tiles Grid Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.11. 2026-05-20 4.3 CVE-2026-27424 https://patchstack.com/database/wordpress/plugin/final-tiles-grid-gallery-lite/vulnerability/wordpress-image-photo-gallery-final-tiles-grid-plugin-3-6-11-broken-access-control-vulnerability?_s_id=cve wpbean--WPB Floating Menu or Categories Sticky Floating Side Menu & Categories with Icons The WPB Floating Menu & Categories for WordPress - Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon CSS Class' category field in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2026-05-21 4.9 CVE-2026-4811 https://www.wordfence.com/threat-intel/vulnerabilities/id/961702ff-60fb-41ff-99b0-a37ade051083?source=cve https://plugins.trac.wordpress.org/browser/wpb-floating-menu-or-categories/tags/1.0.8/admin/category-icon.php#L41 wpdive--Nexa Blocks Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE The Nexa Blocks - Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to and including 1.1.1. This is due to the import_demo() function accepting a user-supplied URL in the demo_json_file POST parameter and passing it directly to wp_remote_get() without any URL validation or restriction against internal or private network destinations. The nexa_blocks_nonce required for the AJAX action is publicly exposed in the HTML source of any frontend page where the plugin is active via wp_localize_script on the enqueue_block_assets hook, effectively making the nonce available to all visitors and bypassing any intended authentication barrier. This makes it possible for unauthenticated attackers to make server-side HTTP requests to arbitrary internal or external destinations, potentially exposing internal services, cloud metadata endpoints such as the AWS instance metadata service, localhost services, and other resources not intended to be publicly accessible. A secondary SSRF vector also exists whereby image URLs extracted from the attacker-controlled JSON response are subsequently fetched via a second wp_remote_get() call, allowing chained exploitation through a crafted JSON payload. 2026-05-20 5.4 CVE-2026-6394 https://www.wordfence.com/threat-intel/vulnerabilities/id/b4bb3067-7953-466d-a469-8a101450f133?source=cve https://plugins.trac.wordpress.org/browser/nexa-blocks/trunk/inc/template/template.php#L242 https://plugins.trac.wordpress.org/browser/nexa-blocks/tags/1.1.1/inc/template/template.php#L242 https://plugins.trac.wordpress.org/browser/nexa-blocks/trunk/inc/template/template.php#L236 https://plugins.trac.wordpress.org/browser/nexa-blocks/tags/1.1.1/inc/template/template.php#L236 https://plugins.trac.wordpress.org/browser/nexa-blocks/trunk/inc/classes/enqueue-assets.php#L84 https://plugins.trac.wordpress.org/browser/nexa-blocks/tags/1.1.1/inc/classes/enqueue-assets.php#L84 WPFunnels Team--Mail Mint Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data. This issue affects Mail Mint: from n/a through 1.19.5. 2026-05-21 4.3 CVE-2026-27349 https://patchstack.com/database/wordpress/plugin/mail-mint/vulnerability/wordpress-mail-mint-plugin-1-19-5-sensitive-data-exposure-vulnerability?_s_id=cve wpxpo--FastX The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback' and 'ultp_activate_callback' functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the PostX plugin. 2026-05-22 4.3 CVE-2026-2518 https://www.wordfence.com/threat-intel/vulnerabilities/id/6f5c4194-4f97-4f85-af90-e983ba9ce3a6?source=cve https://themes.trac.wordpress.org/browser/fastx/1.0.2/classes/Initialization.php#L264 https://themes.trac.wordpress.org/browser/fastx/1.0.2/classes/Initialization.php#L249 wupsales--AI Chatbot & Workflow Automation by AIWU The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Practical exploitation is constrained due to a 20-character storage limit. 2026-05-20 6.4 CVE-2026-2955 https://www.wordfence.com/threat-intel/vulnerabilities/id/8d434250-aa16-4ba1-a1f8-289371176545?source=cve https://plugins.trac.wordpress.org/changeset/3505998/ai-copilot-content-generator xpro--Xpro Addons 140+ Widgets for Elementor The Xpro Addons - 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_content_editor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create published Xpro templates. 2026-05-20 5.3 CVE-2025-15369 https://www.wordfence.com/threat-intel/vulnerabilities/id/cf49d3fb-de14-42bc-bf51-f9adceba0d32?source=cve https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk?rev=3508547 yangzongzhuan--RuoYi-Vue A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. Impacted is the function FileUploadUtils.upload of the file /common/upload of the component Common Upload Endpoint. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 6.3 CVE-2026-9374 VDB-365338 yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload VDB-365338 CTI Indicators (IOB, IOC, TTP, IOA) Submit #813252 RuoYi RuoYi-Vue 3.9.2 Cross Site Scripting yog2515–General Options The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitize_text_field() for output escaping in the Contact Number (ad_contact_number) field - a function that strips HTML tags but does not encode double-quote characters to their HTML entity equivalent ("). When the stored value is echoed inside a double-quoted HTML attribute (value=”…”), an attacker-supplied double-quote character breaks out of the attribute context. Even with WordPress’s wp_magic_quotes mechanism (which prefixes quotes with a backslash), the resulting " sequence is NOT treated as an escaped quote by HTML parsers - the backslash is rendered as a literal character and the bare double-quote still closes the attribute. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts in the admin settings page that will execute whenever any administrator visits the General Options settings page. 2026-05-20 4.4 CVE-2026-6399 https://www.wordfence.com/threat-intel/vulnerabilities/id/d29c69bb-4feb-477e-b18f-934ece21aff6?source=cve https://plugins.trac.wordpress.org/browser/general-options/trunk/direct-main.php https://plugins.trac.wordpress.org/browser/general-options/tags/1.1.0/direct-main.php https://plugins.trac.wordpress.org/browser/general-options/trunk/direct-action.php https://plugins.trac.wordpress.org/browser/general-options/tags/1.1.0/direct-action.php ZTE–MU5250 There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attacker can modify configuration through the interface. 2026-05-19 6.3 CVE-2026-44408 https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2657904255874650158 ZTE–MU5250 There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure. 2026-05-22 5.7 CVE-2026-44409 https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3711746568357343342 Back to top Low Vulnerabilities Primary Vendor – Product Description Published CVSS Score Source Info Patch Info baptisteArno–typebot.io TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine’s the findResult query does not filter results by typebotId, allowing an authenticated user to load result data (user answers, variable values) from a different typebot by supplying a foreign resultId to the startChat endpoint. Exploitation is constrained by CUID2’s cryptographically random 24-character IDs (making brute-force infeasible), the requirement that rememberUser be enabled, and the need for matching variable names in the current typebot. If successfully exploited, an attacker can access the original user’s previous answers, session variable values, and hasStarted flag, potentially exposing PII like names, emails, and phone numbers. This issue has been fixed in version 3.16.0. 2026-05-22 3.1 CVE-2026-39967 https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx https://github.com/baptisteArno/typebot.io/commit/73162634e6bdebd37a1a571db4062d30854e0400 https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 Besen–BS20 EV Charging Station A vulnerability was determined in Besen BS20 EV Charging Station up to 20260426. This impacts an unknown function of the component Bluetooth Low Energy Handler. Executing a manipulation can lead to weak password requirements. The attack needs to be done within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The original disclosure mentions, that “[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.” 2026-05-24 3.1 CVE-2026-9394 VDB-365375 Besen BS20 EV Charging Station Bluetooth Low Energy weak password VDB-365375 CTI Indicators (IOB, IOC, TTP) Submit #813569 Besen EV Charging Station BS20 EV Charger Weak Authentication https://github.com/carfeii/besen#finding-1-weak-authentication-mechanism-in-besen-home-ev-charging-station-via-ble Besen–BS20 EV Charging Station A vulnerability was identified in Besen BS20 EV Charging Station up to 20260426. Affected is an unknown function of the component BLE/UDP. The manipulation leads to insufficiently protected credentials. The attack needs to be initiated within the local network. The original disclosure mentions, that “[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.” 2026-05-24 3.5 CVE-2026-9395 VDB-365376 Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials VDB-365376 CTI Indicators (IOB, IOC, TTP) Submit #813572 Besen EV Charging Station BS20 EV Charger Insufficiently Protected Credentials https://github.com/carfeii/besen#finding-2-cleartext-credential-exposure-via-ble-and-udp-in-besen-home-ev-charging-station Besen–BS20 EV Charging Station A security flaw has been discovered in Besen BS20 EV Charging Station up to 20260426. Affected by this vulnerability is an unknown functionality of the component Firmware Version Check. The manipulation results in improper restriction of rendered ui layers. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitation appears to be difficult. The original disclosure mentions, that “[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.” 2026-05-24 3.7 CVE-2026-9396 VDB-365377 Besen BS20 EV Charging Station Firmware Version Check ui layer VDB-365377 CTI Indicators (IOB, IOC) Submit #813575 Besen EV Charging Station BS20 EV Charger Improper Verification of Cryptographic Signature https://github.com/carfeii/besen#finding-3-firmware-version-check-manipulation-and-ui-spoofing Besen–BS20 EV Charging Station A security vulnerability has been detected in Besen BS20 EV Charging Station up to 20260426. This affects an unknown part of the component BLE/WiFi. Such manipulation leads to authentication bypass by capture-replay. The attack must be carried out from within the local network. Attacks of this nature are highly complex. It is indicated that the exploitability is difficult. The original disclosure mentions, that “[t]hese vulnerabilities have been reported to Besen and we have received their acknowlegement that they are reviewing this as of April 2026.” 2026-05-24 3.1 CVE-2026-9398 VDB-365379 Besen BS20 EV Charging Station BLE/WiFi authentication replay VDB-365379 CTI Indicators (IOB, IOC, TTP) Submit #813577 Besen EV Charging Station BS20 EV Charger Improper Authorization https://github.com/carfeii/besen#finding-5-unauthorized-tampering-of-charger-commands Dell–PowerFlex Manager (Appliance) Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. 2026-05-22 3.6 CVE-2025-46371 https://www.dell.com/support/kbdoc/en-us/000391568/dsa-2025-435-security-update-for-dell-powerflex-rack-multiple-third-party-component-vulnerabilities https://www.dell.com/support/kbdoc/en-us/000391392/dsa-2025-434-security-update-for-dell-powerflex-appliance-multiple-third-party-component-vulnerabilities HCL–BigFix Service Management (SM) HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly. 2026-05-20 3.7 CVE-2025-31985 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144 jarrodwatts–claude-hud Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to read arbitrary files by supplying an unvalidated transcript_path value via stdin JSON. Attackers can access any file readable by the process and the file metadata is written to a persistent cache file with insufficient permissions, creating a forensic record of accessed paths that survives process exit. 2026-05-18 3.3 CVE-2026-47091 https://github.com/jarrodwatts/claude-hud/issues/485 https://github.com/jarrodwatts/claude-hud/pull/487 https://github.com/jarrodwatts/claude-hud/commit/234d9aad919b51326a43bcf90b45ae35c23afc30 https://www.vulncheck.com/advisories/claude-hud-path-traversal-via-transcript-path Mattermost–Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those values.. Mattermost Advisory ID: MMSA-2026-00622 2026-05-18 3.8 CVE-2026-3495 MMSA-2026-00622 Mattermost–Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575 2026-05-18 3.7 CVE-2026-4273 MMSA-2026-00575 Mattermost–Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if { {team_id} } was being changed when updating playbooks, allowing users with only { {Manage Playbook Configurations} } permission to change a playbook’s team, bypassing manage members restriction via PUT api. Mattermost Advisory ID: MMSA-2025-00552 2026-05-18 3.1 CVE-2026-4286 MMSA-2025-00552 Mattermost–Mattermost Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking { {window.close()} } in the renderer context, leading to a denial of service condition at the client level. Mattermost Advisory ID: MMSA-2026-00633 2026-05-18 3.5 CVE-2026-4643 MMSA-2026-00633 Mattermost–Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost Advisory ID: MMSA-2026-00582 2026-05-18 3.5 CVE-2026-6333 MMSA-2026-00582 Mattermost–Mattermost Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570 2026-05-18 3.1 CVE-2026-6334 MMSA-2026-00570 n/a–JeecgBoot A vulnerability has been found in JeecgBoot 3.9.1. This issue affects some unknown processing of the file /openapi/call/ of the component OpenAPI Endpoint. Such manipulation leads to improper authentication. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 3.7 CVE-2026-9373 VDB-365337 JeecgBoot OpenAPI Endpoint call improper authentication VDB-365337 CTI Indicators (IOB, IOC, IOA) Submit #813251 jeecgboot JeecgBoot 3.9.1 Improper Authentication n/a–vBulletin A vulnerability was found in vBulletin 6.x. This impacts an unknown function of the component Login. Performing a manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. VulDB is withholding an extended redistribution of exploit details to prevent simplified exploitation. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-24 3.5 CVE-2026-9357 VDB-365320 vBulletin Login cross site scripting VDB-365320 CTI Indicators (IOB, IOC, TTP) Submit #813052 Cross Site Scripting no fÃ³rum vBulletin 6.xx Vbulletin 6.x.x Cross Site Scripting NeoRazorX–facturascripts FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick cookie parameter. The application reflects the cookie’s value directly into the HTML without sanitization. The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect. This issue has been fixed in version 2025.8. 2026-05-18 3.9 CVE-2026-27964 https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-gq5c-rw37-g46c https://github.com/NeoRazorX/facturascripts/commit/9066e10326029adf012114e27eb5f3f33f78ecfd Netatalk–Netatalk A dead bounds check in the Spotlight RPC unmarshaller in Netatalk 3.0.0 through 4.4.2 results in an unreachable code path that provides no effective bounds protection, which may allow a remote authenticated attacker to obtain limited information via crafted Spotlight RPC requests. 2026-05-21 3.1 CVE-2026-44057 Netatalk Security Advisory CVE-2026-44057 Netatalk–Netatalk A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data, or cause a minor service disruption. 2026-05-21 3.9 CVE-2026-44059 Netatalk Security Advisory CVE-2026-44059 Netatalk–Netatalk An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service disruption via crafted print data. 2026-05-21 3.7 CVE-2026-44065 Netatalk Security Advisory CVE-2026-44065 Netatalk–Netatalk A heap over-read in extended attribute (EA) header parsing in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to obtain limited information or cause a minor service disruption via crafted EA data. 2026-05-21 3.7 CVE-2026-44067 Netatalk Security Advisory CVE-2026-44067 Netatalk–Netatalk An integer underflow in the volxlate function in Netatalk 3.0.0 through 4.4.2 allows a local privileged user to obtain limited information, modify limited data, or cause a minor service disruption via crafted volume translation input. 2026-05-21 3.4 CVE-2026-44069 Netatalk Security Advisory CVE-2026-44069 Netatalk–Netatalk An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted character conversion requests. 2026-05-21 3.1 CVE-2026-44070 Netatalk Security Advisory CVE-2026-44070 Netatalk–Netatalk Netatalk 3.1.2 through 4.4.2 is compiled without FORTIFY_SOURCE, which disables built-in buffer overflow detection at runtime, potentially allowing a remote attacker to cause a minor denial of service via memory errors that would otherwise be caught and safely terminated by runtime protection. 2026-05-21 3.7 CVE-2026-44071 Netatalk Security Advisory CVE-2026-44071 Netatalk–Netatalk Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultaneously, which may allow a remote attacker to cause a minor service disruption via conditions that trigger incorrect error-handling paths. 2026-05-21 3.7 CVE-2026-44074 Netatalk Security Advisory CVE-2026-44074 Netatalk–Netatalk A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options. 2026-05-21 3.7 CVE-2026-44075 Netatalk Security Advisory CVE-2026-44075 Netatalk–Netatalk A format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input that triggers incorrect format string processing. 2026-05-21 3.1 CVE-2026-7835 Netatalk Security Advisory CVE-2026-7835 Netatalk–Netatalk An incorrect calculation in the hextoint macro in Netatalk 2.0.0 through 4.4.2 due to improper uppercase character handling allows a remote authenticated attacker to cause limited data modification via crafted hexadecimal input. 2026-05-21 3.1 CVE-2026-7836 Netatalk Security Advisory CVE-2026-7836 Netatalk–Netatalk A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, which may allow a remote attacker to cause limited data modification under specific race conditions. 2026-05-21 3.7 CVE-2026-7837 Netatalk Security Advisory CVE-2026-7837 Netatalk–Netatalk Netatalk 2.2.1 through 4.4.2 calls system() after a failed chdir() without properly handling the error condition, which allows a local privileged user to execute unintended commands or cause a minor service disruption under specific conditions. 2026-05-21 2.5 CVE-2026-44072 Netatalk Security Advisory CVE-2026-44072 OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. 2026-05-19 3.3 CVE-2026-25110 https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-04.md OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. 2026-05-19 3.3 CVE-2026-27781 https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-04.md OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. 2026-05-19 3.3 CVE-2026-28751 https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-04.md OpenHarmony–OpenHarmony in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. 2026-05-19 3.3 CVE-2026-33565 https://gitcode.com/openharmony/security/tree/master/zh/security-disclosure/2026/2026-05.md opensourcepos–Open Source Point of Sale A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: “[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it’s not actively in use as any password change will use a newer hash function.” 2026-05-18 3.7 CVE-2026-8803 VDB-364436 opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash VDB-364436 CTI Indicators (IOB, IOC, TTP, IOA) Submit #802561 opensourcepos Open Source Point of Sale 3.4.1 Weak Encoding for Password QuantumNous–new-api A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2026-05-23 3.7 CVE-2026-9306 VDB-365253 QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization VDB-365253 CTI Indicators (IOB, IOC, IOA) Submit #812196 QuantumNous new-api 0.12.1 Authorization Bypass Through User-Controlled Key (CWE-639) https://gist.github.com/YLChen-007/13974ead25fc6dac42fd7bac62fbb2df RsyncProject–rsync Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set. 2026-05-20 3.1 CVE-2026-45232 https://github.com/RsyncProject/rsync/security/advisories/GHSA-8f85-j2cv-59m8 https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 https://www.vulncheck.com/advisories/rsync-off-by-one-stack-write-via-http-proxy SourceCodester–SUP Online Shopping A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The manipulation of the argument productName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. 2026-05-24 2.4 CVE-2026-9377 VDB-365340 SourceCodester SUP Online Shopping productedit.php cross site scripting VDB-365340 CTI Indicators (IOB, IOC, TTP, IOA) Submit #813270 sourcecodester SUP Online Shopping Project V1.0 Cross Site Scripting https://github.com/redshadowword-cell/CVE/issues/13 https://www.sourcecodester.com/ SPIP–SPIP action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. 2026-05-24 3.5 CVE-2026-48832 https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-15.html?lang=fr https://git.spip.net/spip/spip/-/commit/75629034697ab52a963a340afd10930407e1cd55 https://git.spip.net/spip/ecrire/-/commit/a22cb8a56f1e37ff3854b73ff3f66aa3df47070a ulisesbocchio–jasypt-spring-boot A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator of the file jasypt-spring-boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java of the component Password Hash Handler. Executing a manipulation can lead to use of a one-way hash with a predictable salt. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. 2026-05-24 3.7 CVE-2026-9370 VDB-365333 ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable salt VDB-365333 CTI Indicators (IOB, IOC, TTP, IOA) Submit #813198 Ulises Bocchio jasypt-spring-boot 3.0.0 to 4.0.4 Cryptographic Issues https://github.com/ulisesbocchio/jasypt-spring-boot/issues/431 https://github.com/dntyfate/cve/issues/3 https://github.com/ulisesbocchio/jasypt-spring-boot/ Back to top Severity Not Yet Assigned Primary Vendor – Product Description Published CVSS Score Source Info Patch Info 9front–9front Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element. 2026-05-22 not yet calculated CVE-2026-9053 https://git.9front.org/plan9front/9front/d145acc9ef0da47131af6ad94e87264e04870d47/commit.html 9front–9front An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic. 2026-05-22 not yet calculated CVE-2026-9054 https://git.9front.org/plan9front/9front/7838d68969549f938cc8e80c0c2b4218cb12805c/commit.html https://git.9front.org/plan9front/9front/f86917b75e9562f90545b7e484dbdcd748236952/commit.html https://git.9front.org/plan9front/9front/70c97c334171c715df82774d1a47638abaca2db4/commit.html Advantech–WebAccess/SCADA 8.0-2015.08.16 Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via the decryption field in the Create New Project User component 2026-05-22 not yet calculated CVE-2026-36226 https://github.com/NullByte8080/CVE-2026-36226 Altium–Altium 365 A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace’s identifier can interact with that workspace’s search index, crossing tenant boundaries. Successful exploitation allows reading a workspace’s indexed contents (such as component data, project and folder names, and user metadata) and injecting, modifying, or deleting search index entries. These operations affect the search index only, not the underlying vault data, but they can disclose sensitive workspace information and compromise the integrity and availability of search results. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected. 2026-05-21 not yet calculated CVE-2026-9152 https://www.altium.com/platform/security-compliance/security-advisories Altium–Altium Enterprise Server A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A regular authenticated workspace user can supply a crafted filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem. Because content-controlled files can be written to web-accessible directories, this can be escalated to remote code execution in the context of the service account. It can also be used to overwrite application binaries or configuration files, leading to service takeover or denial of service. 2026-05-20 not yet calculated CVE-2026-9102 https://www.altium.com/platform/security-compliance/security-advisories Altium–Altium Enterprise Server A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path (such as an encoded drive letter) in a Viewer storage API request, causing the configured storage root to be discarded and allowing arbitrary files to be read from the server filesystem. Because the readable files include the server’s master configuration, which stores database credentials, signing key locations, certificate passwords, and OAuth secrets, exploitation can lead to disclosure of all server secrets and full compromise of the server and its data. Cloud deployments are not affected, as they use object storage and do not enable this component. 2026-05-20 not yet calculated CVE-2026-9129 https://www.altium.com/platform/security-compliance/security-advisories AMD[.]com–AMD EPYC 4004 Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write to a limited section of the Top of Memory Segment (TSEG) memory region, potentially resulting in loss of confidentiality or integrity. 2026-05-19 not yet calculated CVE-2024-36343 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3030.html https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4017.html Apache Software Foundation–Apache Airflow Amazon provider In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a conn_id containing a / (e.g. "my_team/conn") to the same path as another team’s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team’s secret by crafting a colliding conn_id. Fixed in 9.28.0 by switching the team-scope separator to -- and rejecting team-shaped conn_ids when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to apache-airflow-providers-amazon 9.28.0, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-42526 https://github.com/apache/airflow/pull/65703 https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn Apache Software Foundation–Apache Airflow CNCF Kubernetes provider JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks. 2026-05-19 not yet calculated CVE-2026-27173 https://github.com/apache/airflow/pull/60108 https://lists.apache.org/thread/pk3m2z4s2rkmc0v6gh9hnch9spc6stqw Apache Software Foundation–Apache Camel Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http) only filter outbound Camel-internal headers via setOutFilterStartsWith, while not configuring inbound filtering via setInFilterStartsWith. As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelExecCommandExecutable, CamelFileName) via HTTP requests to CXF-RS or CXF-SOAP endpoints. When a route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling remote code execution or arbitrary file writes. This is the same pattern that was previously addressed in camel-undertow (CVE-2025-30177), the broader incoming-header filter (CVE-2025-27636 and CVE-2025-29891), and non-HTTP strategies (CVE-2026-40453). This issue affects Apache Camel: from 3.18.0 before 4.14.6, from 4.15.0 before 4.18.2. Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.2. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. 2026-05-19 not yet calculated CVE-2026-47323 https://camel.apache.org/security/CVE-2026-47323.html Apache Software Foundation–Apache Camel K (Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace. This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue. 2026-05-21 not yet calculated CVE-2026-45760 https://camel.apache.org/security/CVE-2026-45760.html Apache Software Foundation–Apache CXF The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue. 2026-05-22 not yet calculated CVE-2026-44417 https://lists.apache.org/thread/bqg6gjy2cx7rfyqjxcpv3jwjvmclvz4o Apache Software Foundation–Apache CXF Insecure XML parser configuration in Apache CXF’s WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue. 2026-05-22 not yet calculated CVE-2026-44618 https://lists.apache.org/thread/c7vb015f8ljmjl44030mn0yfq71f7sd7 Apache Software Foundation–Apache CXF An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue. 2026-05-22 not yet calculated CVE-2026-44930 https://lists.apache.org/thread/c1zqxppo1m5z3kbdhjn5p991zk09ynkh Apache Software Foundation–Apache Fory Deserialization of untrusted data in Apache Fory PyFory. PyFory’s ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes. This issue affects Apache Fory: from before 1.0.0. Mitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue. 2026-05-21 not yet calculated CVE-2026-48207 https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypass Apache Software Foundation–Apache OFBiz Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, “Data Resource” records with dataTemplateTypeId = “FTL” are no longer supported. Additionally, in the updated version, the “Ecommerce Customer” security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well. 2026-05-19 not yet calculated CVE-2026-29207 https://lists.apache.org/thread/3rcrp8bh3x6ovrj5xnc0fm1f0nrn52r0 Apache Software Foundation–Apache OFBiz Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-29220 https://lists.apache.org/thread/5hjnmt9no6mmtg8sxq3mhonzff1vkd5m Apache Software Foundation–Apache OFBiz Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-29226 https://lists.apache.org/thread/6707wys8jxzmowxggn4cmtwwk9ygl2tr Apache Software Foundation–Apache OFBiz Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-31378 https://lists.apache.org/thread/cbl8qkqtxv90m6ssfwd58bnoh933v38t Apache Software Foundation–Apache OFBiz Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’), Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’), Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-31379 https://lists.apache.org/thread/1tcnkxjm0s6n1ohfb21brl25dt0hv9by Apache Software Foundation–Apache OFBiz Improper Neutralization of Special Elements used in an Expression Language Statement (‘Expression Language Injection’) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-31380 https://lists.apache.org/thread/v2brvq1tf4q491obkxv8p7fc5qfshc08 Apache Software Foundation–Apache OFBiz Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-31387 https://lists.apache.org/thread/3wgybgdvmbfvly24zm4sb4y53fc1pqcf Apache Software Foundation–Apache OFBiz Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-31388 https://lists.apache.org/thread/npjchvnpnosoqpto46s2om12jd9s7py7 Apache Software Foundation–Apache OFBiz Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-31906 https://lists.apache.org/thread/1fblqdo89d3ps8kgtcnkcq8sh7gwkcpn Apache Software Foundation–Apache OFBiz Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-31909 https://lists.apache.org/thread/0hpopzz1qrhkzsbt3ncofs6qo0545r2h Apache Software Foundation–Apache OFBiz Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-31910 https://lists.apache.org/thread/2smc4c4o056ovd2hoq1l29593y5y29vh Apache Software Foundation–Apache OFBiz Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-31986 https://lists.apache.org/thread/2hl9xoqm8tq8b22x6vnmtp7tg3opcqgc Apache Software Foundation–Apache OFBiz Improper Control of Generation of Code (‘Code Injection’) vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-35086 https://lists.apache.org/thread/g0s37yhnh2xwfts400crb2w8s337hgjx Apache Software Foundation–Apache OFBiz Improper Neutralization of Special Elements used in an LDAP Query (‘LDAP Injection’) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-41919 https://lists.apache.org/thread/592czh9o69n74c036vy30fnqknocw74p Apache Software Foundation–Apache OFBiz Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-45187 https://lists.apache.org/thread/pcmfyxjyk7dg0btxqg9h7cr30yg8mr7k Apache Software Foundation–Apache OFBiz Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-45434 https://lists.apache.org/thread/yw4owrzl0yho1yx7oqxvr6xjkmln9tq8 Apache Software Foundation–Apache OFBiz Improper Control of Generation of Code (‘Code Injection’), Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. 2026-05-19 not yet calculated CVE-2026-46586 https://lists.apache.org/thread/7mgjl81nrpxqtfcg6h5qtrx7wztbl4js Apple–Private Cloud Compute Server Software An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addressed with improved validation. This issue is fixed in PCC Release 5E290.3. 2026-05-18 not yet calculated CVE-2026-20685 https://security.apple.com/documentation/private-cloud-compute/releasenotes#darwin-init APScheduler–JSONSerializer and CBORSerializer The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling setstate on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers 2026-05-19 not yet calculated CVE-2026-31072 https://github.com/agronholm/apscheduler https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6 Arm–ArmNN In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()->InferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer. 2026-05-22 not yet calculated CVE-2026-42627 https://github.com/ARM-software/armnn/blob/main/src/armnn/Tensor.cpp https://github.com/ARM-software/armnn/blob/main/src/armnnTfLiteParser/TfLiteParser.cpp awesomemotive–NextGEN Gallery NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the ‘orderby’ parameter on the REST API endpoints ‘/imagely/v1/galleries’ and ‘/imagely/v1/albums’. The root cause is an insufficient sanitization function (‘clean_column()’) in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the ‘NextGEN Gallery overview’ capability (assigned to the Administrator role by default) to inject arbitrary SQL into the ‘ORDER BY’ clause. 2026-05-20 not yet calculated CVE-2026-9059 https://www.tenable.com/security/research/tra-2026-42 baptisteArno–typebot.io TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain a critical stored XSS vulnerability in the app.typebot.io profile picture upload form. The application fails to sanitize or restrict SVG/XML-based uploads and directly renders them when accessed through the domain. By uploading a crafted malicious SVG file containing embedded JavaScript, an attacker will execute arbitrary JavaScript code. This vulnerability directly enables stored XSS exploitation because the payload is persistently stored on your infrastructure (app.typebot.io) and accessible from a public-facing, permanent link. Stored XSS via malicious SVG uploads to app.typebot.io allows attackers to execute arbitrary JavaScript in victims’ browsers, enabling session/token theft, account takeover, and exfiltration of sensitive user data. This issue has been fixed in version 3.16.0. 2026-05-22 not yet calculated CVE-2026-39970 https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-jj87-c343-26vp https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 Best Practical–Request Tracker Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the “Page” parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser. This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2. 2026-05-21 not yet calculated CVE-2026-6841 https://cert.pl/en/posts/2026/05/CVE-2026-6841 https://requesttracker.com/request-tracker/ https://docs.bestpractical.com/release-notes/rt/5.0.10 https://docs.bestpractical.com/release-notes/rt/6.0.3 BillaBear–BillaBear BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands. 2026-05-19 not yet calculated CVE-2026-31069 https://gist.github.com/nedlir/a50725b94650467f0593b8f4009ae19e https://github.com/BillaBear/billabear https://gist.github.com/nedlir/2377ba6e7fa2ad957210b52aa8e400d9 brainstormforce–Surecart SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters (‘model_name’, ‘model_id’, ‘integration_id’, ‘provider’) on the REST API endpoint ‘/surecart/v1/integrations/{id}’. The root cause is a flawed escaping bypass in the query builder (‘wp-query-builder’). Values passed to the ‘where()’ method are only sanitized via ‘$wpdb->prepare()’ when they do not contain a dot (‘.’) or the WordPress table prefix (‘wp’). By including a dot anywhere in the payload, an attacker completely bypasses the escaping logic and injects arbitrary SQL into the ‘WHERE’ clause, allowing full UNION-based extraction of the database. 2026-05-20 not yet calculated CVE-2026-9065 https://www.tenable.com/security/research/tra-2026-43 Broadcom–Automic Automation Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris x64, Solaris Sparc 64 allows Privilege Escalation, Target Programs with Elevated Privileges. This issue affects Automic Automation: < 24.4.4 HF1. 2026-05-19 not yet calculated CVE-2026-8370 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37512 BYD–Atto3 In BYD Atto3, an attacker can obtain an authentication key through Brute Force attack, which is permanently available. The authentication key enables flash to the Electronic Parking Break (EPB) and Supplemental Restoration System (SRS) related ECUs. 2026-05-19 not yet calculated CVE-2025-61081 https://www.notion.so/BYD-Atto3-26215fb6156c8000b338db3c2011f637?source=copy_link https://www.notion.so/CVE-2025-61081-26215fb6156c8000b338db3c2011f637 Centralny Instytut Ochrony Pracy - Pastwowy Instytut Badawczy–STER A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any other data that the application itself is able to access This issue was fixed in version 9.5. 2026-05-22 not yet calculated CVE-2026-25606 https://cert.pl/posts/2026/05/CVE-2026-25606 https://www.ciop.pl/CIOPPortalWAR/appmanager/ciop/pl?_nfpb=true&_pageLabel=P52000165211572544981480 Centralny Instytut Ochrony Pracy - Pastwowy Instytut Badawczy–STER Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are encoded. This issue was fixed in version 9.5. 2026-05-22 not yet calculated CVE-2026-25607 https://cert.pl/posts/2026/05/CVE-2026-25606 https://www.ciop.pl/CIOPPortalWAR/appmanager/ciop/pl?_nfpb=true&_pageLabel=P52000165211572544981480 Centralny Instytut Ochrony Pracy - Pastwowy Instytut Badawczy–STER STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such as passwords, personal data, or authentication tokens. This issue was fixed in version 9.5. 2026-05-22 not yet calculated CVE-2026-25608 https://cert.pl/posts/2026/05/CVE-2026-25606 https://www.ciop.pl/CIOPPortalWAR/appmanager/ciop/pl?_nfpb=true&_pageLabel=P52000165211572544981480 Chroma–ChromaDB A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. 2026-05-18 not yet calculated CVE-2026-45829 https://www.hiddenlayer.com/research/chromatoast-served-pre-auth https://github.com/chroma-core/chroma/issues/6717 ClipBucket–ClipBucket v5 v.5.5.2 An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security headers components 2026-05-22 not yet calculated CVE-2026-37470 http://clipbucket.com https://medium.com/@arpit03sharma2003/cve-2026-37470-clickjacking-vulnerability-in-clipbucket-v5-leads-to-credential-theft-and-8415def7804a CODESYS–Visualization The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authentication data. The vulnerability affects only login operations within an active visualization session. 2026-05-21 not yet calculated CVE-2026-0393 https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-07_vde-2026-052.json Concrete CMS–Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.9 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting. 2026-05-21 not yet calculated CVE-2026-6826 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission-restricted files bypasses the view_file permission check. Files without passwords can be downloaded and any user who knows a file’s password can download a password protected file regardless of whether they have permission to access the file. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Youssef Eid for reporting 2026-05-21 not yet calculated CVE-2026-7879 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting. 2026-05-21 not yet calculated CVE-2026-7881 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller. The code throws an error when the token IS valid and proceeds with file deletion when the token is invalid or missing. This effectively disables CSRF protection for the file deletion endpoint, allowing cross-site request forgery attacks against users who have permission to edit conversation messages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting. 2026-05-21 not yet calculated CVE-2026-7882 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass. The AddMessage and UpdateMessage conversation controllers accept user-supplied file attachment IDs and load files directly via $em->find(File::class, $attachmentID) without checking per-file permissions (canViewFile()). A user who can post in any conversation can reference any file in the CMS file manager by its sequential ID, effectively bypassing the file permission system. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Mandani for reporting. if a site truly has private files, the owner should set up a private storage location https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/file-storage-locations outside of the webroot so that permissions can be checked on view as well. That way, even if a authorized user attaches a file, or otherwise links to it, unauthorized users won’t be able to view the file. 2026-05-21 not yet calculated CVE-2026-7886 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee) can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. Thanks 0x4c616e for reporting. 2026-05-21 not yet calculated CVE-2026-7887 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation enabling redirect-to-internal bypasses. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with a vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N. 2026-05-21 not yet calculated CVE-2026-7890 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader’s extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 9.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8134 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rogue administrator with privileges to add blocks to an area can bypass the intended protection mechanism (_fromCIF === true), which normally restricts malicious inputs over form POST requests, by leveraging the REST API functionality. Because the REST API parses requests using json_decode(), the string “true” is evaluated as a strict PHP Boolean(true). This bypass allows the attacker to inject a malicious serialized payload into the block’s filterFields database column. The payload will subsequently be executed when the block’s data is viewed or edited by an administrator leading to complete server takeover (RCE).The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.9 with a vector of CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Thanks Nguyá»…n VÄƒn Thiá»‡n https://github.com/Thien225409 for reporting 2026-05-21 not yet calculated CVE-2026-8135 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8139 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS–Concrete CMS Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/. The download() method in concrete/controllers/single_page/dashboard/extend/install.php checks only the canInstallPackages() permission before fetching a remote marketplace package and writing it to the server's DIR_PACKAGES directory. Because the endpoint is a state-changing GET route with no token enforcement, an attacker who can cause an authenticated administrator to visit a crafted page can force an arbitrary marketplace package to be downloaded. In order to be vulnerable, the victim must be passing canInstallPackages() and the site must be connected to the Concrete marketplace. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting. 2026-05-21 not yet calculated CVE-2026-8140 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete's t() translation helper as a sprintf-style format. The ... wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output as raw HTML. A rogue admin could potentially snoop on login submissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8197 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can inject malicious JavaScript that executes in the context of any visitor's browser, potentially leading to session hijacking, credential theft, or other malicious actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Alfin Joseph for reporting. 2026-05-21 not yet calculated CVE-2026-8203 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting. 2026-05-21 not yet calculated CVE-2026-8204 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks lalalala5678 for reporting. 2026-05-21 not yet calculated CVE-2026-8205 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting. 2026-05-21 not yet calculated CVE-2026-8236 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Eldudareeno for reporting. 2026-05-21 not yet calculated CVE-2026-8237 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting. 2026-05-21 not yet calculated CVE-2026-8238 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting. 2026-05-21 not yet calculated CVE-2026-8239 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the existence of private, draft, and restricted pages while leaking title, path, description, and author information. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting. 2026-05-21 not yet calculated CVE-2026-8240 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Pagination builds pagination links by raw-interpolating its $URL field into href="" (<a href="{$linkURL}" â€¦>). Any authenticated admin or report viewer with access to `/dashboard/reports/forms/legacy` who clicks the crafted URL fires the payload in their session. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting 2026-05-21 not yet calculated CVE-2026-8245 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks 0x4c616e for reporting. 2026-05-21 not yet calculated CVE-2026-8327 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by submitting the restricted optionID through the public survey's endpoint. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Zer0daySec https://github.com/Zee99y for reporting 2026-05-21 not yet calculated CVE-2026-8337 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permission is CSRF'd into publishing an attacker-chosen previously-uploaded version (downgrade to an older version of a file, or activation of a co-editor's unpublished version). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting. 2026-05-22 not yet calculated CVE-2026-8340 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting. 2026-05-22 not yet calculated CVE-2026-8347 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group. Any authenticated user with access to the bulk user assignment dashboard page can add any user email to any group and can remove legitimate admins. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Vincent55 for reporting. 2026-05-21 not yet calculated CVE-2026-8350 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages. This can lead to session hijacking, credential theft, malicious actions performed on behalf of users, and potential privilege escalation. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-22 not yet calculated CVE-2026-8353 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete. The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8409 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete. The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8410 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8411 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8412 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8413 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8414 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8415 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8416 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/. The do_update() method in concrete/controllers/single_page/dashboard/extend/update.php checks only canInstallPackages() before executing upgradeCoreData() and upgrade() on the named package's controller. Because the endpoint is a state-changing GET route with no token enforcement, an attacker can force an authenticated administrator to trigger a package upgrade via a single cross-site navigation.In order to be vulnerable, the victim must be passing canInstallPackages() and and a target package must already be already installed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting. 2026-05-21 not yet calculated CVE-2026-8417 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. An attacker who can cause an authenticated administrator to visit a crafted page, and who has placed or caused a package to be present under DIR_PACKAGES//, can force the installation of that package without any CSRF protection. Package installation executes the package controller's install() method as the web server user, enabling remote code execution. In order to be vulnerable, the victim must be passing canInstallPackages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting. 2026-05-21 not yet calculated CVE-2026-8421 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/. An attacker who controls the remote package returned for a known marketplace item ID can overwrite the package PHP on disk and force its upgrade() method to execute in a single browser navigation. This results in remote code execution as the web server user. In order to be vulnerable, the victim must be passing canInstallPackages, victim site must be connected to the Concrete marketplace; and the attacker controls the package returned for a marketplace item ID already installed on the victim site. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting. 2026-05-21 not yet calculated CVE-2026-8426 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8427 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concrete/controllers/single_page/dashboard/system/update/update.php never calls $this->token->validate('do_update'). The form is rendered as a POST form, meaning the token reaches the browser, but because the controller discards it without verification, an attacker can craft a cross-site POST that triggers a core CMS update to an attacker-specified version string. In order to be vulnerable, theictim must be passing canUpgrade()anda valid update version must be present under DIR_CORE_UPDATES. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting. 2026-05-21 not yet calculated CVE-2026-8428 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8432 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8433 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8434 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Concrete CMS--Concrete CMS Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori (Tenzai) for reporting. 2026-05-21 not yet calculated CVE-2026-8435 https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes Creartia Internet Consulting--ICMS Content Management Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HTTP redirect headers of the login process, causing the script to continue running and enabling privilege escalation without the need for credentials. 2026-05-18 not yet calculated CVE-2026-4320 https://www.incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-icms-content-management-creartia-internet-consulting cyntler--react-doc-viewer v1.17.1 Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode 2026-05-20 not yet calculated CVE-2026-30691 https://github.com/cyntler/react-doc-viewer/issues/317 https://github.com/walidriouah/CVE-2026-30691 Dell--Portrait Dell Color Management Application An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors. On Windows, a symbolic link vulnerability allows a local low-privileged user to escalate privileges to Administrator. During installation, the software writes the file CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ while running with elevated privileges. Because the installer does not properly validate symbolic links or reparse points at the destination path, an attacker can create a malicious link that redirects the write operation to an arbitrary system location, enabling arbitrary file creation or overwrite with elevated privileges. 2026-05-19 not yet calculated CVE-2026-34883 https://www.portrait.com/dell-security-cve-updates/ https://www.portrait.com/dell Devolutions--Server Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to retrieve that entry's activity logs via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-5171 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with a stored PAM provider service account via authentication relay to an attacker-controlled server. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-7325 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-8477 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 2026-05-22 not yet calculated CVE-2026-9047 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request. 2026-05-22 not yet calculated CVE-2026-9223 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-9224 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-9245 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-9246 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-9247 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-9248 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-9249 https://devolutions.net/security/advisories/DEVO-2026-0013/ Devolutions--Server Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier 2026-05-22 not yet calculated CVE-2026-9251 https://devolutions.net/security/advisories/DEVO-2026-0013/ discourse--discourse Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, an authenticated user on a Discourse instance with the form templates feature enabled can read the name and structured content of form templates that are intended exclusively for categories they are not authorized to access. Impact is limited to disclosure of site configuration metadata. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1. 2026-05-19 not yet calculated CVE-2026-33514 https://github.com/discourse/discourse/security/advisories/GHSA-w6g7-p2p9-2m5h https://github.com/discourse/discourse/commit/ae5c9570fb918442c4d96abc83c1e7e169909b02 discourse--discourse Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, a vulnerability in the discourse-subscriptions plugin allows users to gain access to subscription-gated groups without completing payment. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1. 2026-05-19 not yet calculated CVE-2026-34154 https://github.com/discourse/discourse/security/advisories/GHSA-pjgj-7mjq-6j7g Drupal--Colorbox Inline Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS). This issue affects Colorbox Inline: from 0.0.0 before 2.1.1. 2026-05-19 not yet calculated CVE-2026-8493 https://www.drupal.org/sa-contrib-2026-036 Drupal--Date iCal Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15. 2026-05-19 not yet calculated CVE-2026-8495 https://www.drupal.org/sa-contrib-2026-037 Drupal--Drupal core Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7. 2026-05-19 not yet calculated CVE-2026-6365 https://www.drupal.org/sa-core-2026-001 Drupal--Drupal core Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7. 2026-05-19 not yet calculated CVE-2026-6366 https://www.drupal.org/sa-core-2026-002 Drupal--Drupal core Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7. 2026-05-19 not yet calculated CVE-2026-6367 https://www.drupal.org/sa-core-2026-003 Drupal--Node View Permissions Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1. 2026-05-19 not yet calculated CVE-2026-8491 https://www.drupal.org/sa-contrib-2026-034 Drupal--Obfuscate Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This issue affects Obfuscate: from 0.0.0 before 2.0.2. 2026-05-19 not yet calculated CVE-2026-6871 https://www.drupal.org/sa-contrib-2026-033 Drupal--Orejime Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This issue affects Orejime: from 0.0.0 before 2.0.16. 2026-05-19 not yet calculated CVE-2026-6095 https://www.drupal.org/sa-contrib-2026-032 Drupal--Simple Hierarchical Select (shs) Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output (shs_field_formatter_view) and term-tree child-term data generation (shs_term_get_children). Malicious taxonomy term names can be rendered unsafely depending on output context. This affects versions from 7.x-1.0 through (and including) 7.x-1.10. 2026-05-21 not yet calculated CVE-2026-4929 NES patch branch comparison https://d7es.tag1.com/security-advisories/simple-hierarchical-select-moderately-critical-cross-site-scripting Drupal--Term Reference Tree In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered. Vector B (term label rendering): Taxonomy term labels are not properly sanitized before being rendered in the widget, allowing a user with permission to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed. Exploit affects versions 7.x-1.x up to and including 7.x-1.11. 2026-05-21 not yet calculated CVE-2026-4093 https://www.herodevs.com/vulnerability-directory/cve-2026-4093 https://d7es.tag1.com/security-advisories/taxonomy-term-reference-tree-widget-moderately-critical-cross-site-scripting Drupal--Translate Drupal with GTranslate Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5. 2026-05-19 not yet calculated CVE-2026-8492 https://www.drupal.org/sa-contrib-2026-035 Easy Chat--Easy Chat Server 3.1 Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via the UserName parameter 2026-05-22 not yet calculated CVE-2026-36227 http://easy.com https://github.com/NullByte8080/CVE-2026-36227 Easy Chat--Easy Chat Server 3.1 Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via the chat message functionality 2026-05-22 not yet calculated CVE-2026-36228 http://easy.com https://github.com/NullByte8080/CVE-2026-36228 Espon--Epson L14150 FL27PB Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Printing Service (JetDirect) on TCP port 9100 2026-05-20 not yet calculated CVE-2026-39047 https://github.com/AzhariRamadhan/CVE-PORT-9100 https://gist.github.com/AzhariRamadhan/1defc815542fb72e6025da2ce53a1046 Follett--Software's Destiny Library Manager Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 allows remote attackers to read arbitrary system and application files via the image parameter 2026-05-22 not yet calculated CVE-2025-45145 http://follett.com https://medium.com/@jaredutahusa/cve-2025-45145-unauthenticated-local-file-inclusion-in-fsc-destiny-40a3f11b3a4d frappe--frappe Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above. 2026-05-20 not yet calculated CVE-2026-39352 https://github.com/frappe/frappe/security/advisories/GHSA-67rf-pxgh-vfqv https://github.com/frappe/frappe/releases/tag/v16.15.0 frappe--lms Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended directory. This issue has been resolved in version 2.50.1. 2026-05-20 not yet calculated CVE-2026-39405 https://github.com/frappe/lms/security/advisories/GHSA-mxh7-g3r7-g96h https://github.com/frappe/lms/releases/tag/v2.50.1 FreeBSD--FreeBSD libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024). An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges. 2026-05-21 not yet calculated CVE-2026-39461 https://security.freebsd.org/advisories/FreeBSD-SA-26:22.libcasper.asc FreeBSD--FreeBSD The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length. If the supplied list exceeds the capacity of that buffer, a stack buffer overflow occurs. Because the bounds check on the supplementary groups list occurs after the kernel stack buffer has already been written, an unprivileged local user may trigger the overflow without holding any special privilege. Successful exploitation may allow an attacker to execute arbitrary code in the context of the kernel, allowing an unprivileged local user to gain elevated privileges on the affected system. 2026-05-21 not yet calculated CVE-2026-45250 https://security.freebsd.org/advisories/FreeBSD-SA-26:18.setcred.asc FreeBSD--FreeBSD A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, the kernel must remove the blocked thread from the per-object wait queue prior to freeing the object. In the case of some file descriptor types, the kernel failed to unlink blocked threads from the object before freeing it. When the blocked thread is subsequently woken, it accesses memory that has already been freed resulting in a use-after-free vulnerability. The use-after-free vulnerability may be triggered by an unprivileged local user and can be exploited to obtain superuser privileges. 2026-05-21 not yet calculated CVE-2026-45251 https://security.freebsd.org/advisories/FreeBSD-SA-26:19.file.asc FreeBSD--FreeBSD When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel module calls strlen() on this daemon-supplied buffer without first verifying that the entire list is NUL-terminated. If a malicious daemon sends a non-NUL-terminated list, the fusefs kernel module may read beyond the end of one heap-allocated buffer and potentially write beyond the end of a second buffer. A malicious daemon could disclose up to 253 bytes of kernel heap memory, or it could inject up to 250 attacker-controlled bytes into unallocated kernel heap space. 2026-05-21 not yet calculated CVE-2026-45252 https://security.freebsd.org/advisories/FreeBSD-SA-26:20.fusefs.asc FreeBSD--FreeBSD ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target process has no special privileges. The missing validation allows an unprivileged local user to escalate privileges, potentially gaining full control of the affected system. 2026-05-21 not yet calculated CVE-2026-45253 https://security.freebsd.org/advisories/FreeBSD-SA-26:21.ptrace.asc FreeBSD--FreeBSD In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected. In certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process. 2026-05-21 not yet calculated CVE-2026-45254 https://security.freebsd.org/advisories/FreeBSD-SA-26:24.cap_net.asc FreeBSD--FreeBSD When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled network names was not careful to prevent expansion by the shell. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker would need to create an access point with a specially crafted name and be within range of a Wi-Fi scan. Note that bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan for nearby networks; they do not need to actually select the malicious network. 2026-05-21 not yet calculated CVE-2026-45255 https://security.freebsd.org/advisories/FreeBSD-SA-26:23.bsdinstall.asc FreePBX--security-reporting FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compromise if the backup contains carefully crafted hostile data. During backup restore operations, FreePBX extracts selected files from a user-supplied tar archive. If a malicious file exists in the archive, it is read and passed directly to unserialize() without validation, class restrictions, or integrity checks. This issue allows Remote Code Execution during restoration of the backup as the web server user (typically asterisk or www-data). The attack does not require shell access, CLI access, or filesystem write permissions beyond the normal restore workflow. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This issue has been fixed in versions 16.0.71 and 17.0.6. 2026-05-18 not yet calculated CVE-2026-26978 https://github.com/FreePBX/security-reporting/security/advisories/GHSA-5v7h-49gr-jcwr https://github.com/FreePBX/backup/commit/45c57e1207cbf9fd1c5f76f8a3e72d204a69a472 https://github.com/FreePBX/backup/commit/64781af5c80cce0cff21a981be4d8e6a7a71f2c4 glpi-project--glpi GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7. 2026-05-18 not yet calculated CVE-2026-32312 https://github.com/glpi-project/glpi/security/advisories/GHSA-cg63-qchq-q626 https://github.com/glpi-project/glpi/releases/tag/11.0.7 goauthentik--authentik authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against, exposing sensitive information to users without the correct permissions. This logic is GET /api/v3/oauth2/access_tokens/. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential, which should not be accessible to low-privilege users. This issue has been fixed in versions 2025.12.5 and 2026.2.3. 2026-05-22 not yet calculated CVE-2026-40166 https://github.com/goauthentik/authentik/security/advisories/GHSA-hhpc-rqgm-pxj4 https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.5 https://github.com/goauthentik/authentik/releases/tag/version%2F2026.2.3 gohttp--gohttp An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request. 2026-05-19 not yet calculated CVE-2025-70950 https://github.com/itang/gohttp/issues/13 https://gist.github.com/Lime-Cocoa/202127ae5f4dcc4b39909ce7ac1c8466 golang.org/x/crypto--golang.org/x/crypto/ssh An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection. 2026-05-22 not yet calculated CVE-2026-39827 https://go.dev/issue/35127 https://go.dev/cl/781320 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://pkg.go.dev/vuln/GO-2026-5016 golang.org/x/crypto--golang.org/x/crypto/ssh When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error. 2026-05-22 not yet calculated CVE-2026-39828 https://go.dev/issue/79562 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://go.dev/cl/781621 https://pkg.go.dev/vuln/GO-2026-5014 golang.org/x/crypto--golang.org/x/crypto/ssh The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2. 2026-05-22 not yet calculated CVE-2026-39829 https://go.dev/issue/79565 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://go.dev/cl/781641 https://go.dev/cl/781661 https://pkg.go.dev/vuln/GO-2026-5018 golang.org/x/crypto--golang.org/x/crypto/ssh A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded. 2026-05-22 not yet calculated CVE-2026-39830 https://go.dev/issue/79564 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://go.dev/cl/781640 https://go.dev/cl/781664 https://pkg.go.dev/vuln/GO-2026-5017 golang.org/x/crypto--golang.org/x/crypto/ssh The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback. 2026-05-22 not yet calculated CVE-2026-39831 https://go.dev/issue/79566 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://go.dev/cl/781662 https://pkg.go.dev/vuln/GO-2026-5019 golang.org/x/crypto--golang.org/x/crypto/ssh When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation. 2026-05-22 not yet calculated CVE-2026-39834 https://go.dev/issue/79567 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://go.dev/cl/781663 https://pkg.go.dev/vuln/GO-2026-5020 golang.org/x/crypto--golang.org/x/crypto/ssh SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. 2026-05-22 not yet calculated CVE-2026-39835 https://go.dev/issue/79563 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://go.dev/cl/781660 https://pkg.go.dev/vuln/GO-2026-5015 golang.org/x/crypto--golang.org/x/crypto/ssh Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. 2026-05-22 not yet calculated CVE-2026-46595 https://go.dev/issue/79570 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://go.dev/cl/781642 https://pkg.go.dev/vuln/GO-2026-5023 golang.org/x/crypto--golang.org/x/crypto/ssh An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. 2026-05-22 not yet calculated CVE-2026-46597 https://go.dev/issue/79561 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://go.dev/cl/781620 https://pkg.go.dev/vuln/GO-2026-5013 golang.org/x/crypto--golang.org/x/crypto/ssh/agent When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them. 2026-05-22 not yet calculated CVE-2026-39832 https://go.dev/issue/79435 https://go.dev/cl/778642 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://pkg.go.dev/vuln/GO-2026-5006 golang.org/x/crypto--golang.org/x/crypto/ssh/agent The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested. 2026-05-22 not yet calculated CVE-2026-39833 https://go.dev/issue/79436 https://go.dev/cl/778640 https://go.dev/cl/778641 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://pkg.go.dev/vuln/GO-2026-5005 golang.org/x/crypto--golang.org/x/crypto/ssh/agent For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. 2026-05-22 not yet calculated CVE-2026-46598 https://go.dev/issue/79596 https://go.dev/cl/781360 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://pkg.go.dev/vuln/GO-2026-5033 golang.org/x/crypto--golang.org/x/crypto/ssh/knownhosts Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. 2026-05-22 not yet calculated CVE-2026-42508 https://go.dev/issue/79568 https://go.dev/cl/781220 https://groups.google.com/g/golang-announce/c/a082jnz-LvI https://pkg.go.dev/vuln/GO-2026-5021 golang.org/x/net--golang.org/x/net/html Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. 2026-05-22 not yet calculated CVE-2026-25680 https://go.dev/cl/781702 https://go.dev/issue/79573 https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 https://pkg.go.dev/vuln/GO-2026-5028 golang.org/x/net--golang.org/x/net/html Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. 2026-05-22 not yet calculated CVE-2026-25681 https://go.dev/issue/79574 https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 https://go.dev/cl/781703 https://pkg.go.dev/vuln/GO-2026-5029 golang.org/x/net--golang.org/x/net/html Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. 2026-05-22 not yet calculated CVE-2026-27136 https://go.dev/issue/79575 https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 https://go.dev/cl/781685 https://pkg.go.dev/vuln/GO-2026-5030 golang.org/x/net--golang.org/x/net/html Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. 2026-05-22 not yet calculated CVE-2026-42502 https://go.dev/issue/79572 https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 https://go.dev/cl/781701 https://pkg.go.dev/vuln/GO-2026-5027 golang.org/x/net--golang.org/x/net/html Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. 2026-05-22 not yet calculated CVE-2026-42506 https://go.dev/issue/79571 https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 https://go.dev/cl/781700 https://pkg.go.dev/vuln/GO-2026-5025 golang.org/x/net--golang.org/x/net/idna The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". 2026-05-22 not yet calculated CVE-2026-39821 https://go.dev/cl/767220 https://go.dev/issue/78760 https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 https://pkg.go.dev/vuln/GO-2026-5026 golang.org/x/sys--golang.org/x/sys/windows NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error. 2026-05-22 not yet calculated CVE-2026-39824 https://go.dev/issue/78916 https://go.dev/cl/770080 https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg https://pkg.go.dev/vuln/GO-2026-5024 Google--Chrome Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Critical) 2026-05-20 not yet calculated CVE-2026-9110 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/503551154 Google--Chrome Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) 2026-05-20 not yet calculated CVE-2026-9111 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/504551032 Google--Chrome Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) 2026-05-20 not yet calculated CVE-2026-9112 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/489791425 Google--Chrome Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) 2026-05-20 not yet calculated CVE-2026-9113 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/489585044 Google--Chrome Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High) 2026-05-20 not yet calculated CVE-2026-9114 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/495798630 Google--Chrome Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High) 2026-05-20 not yet calculated CVE-2026-9115 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/495999481 Google--Chrome Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) 2026-05-20 not yet calculated CVE-2026-9116 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/497436273 Google--Chrome Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High) 2026-05-20 not yet calculated CVE-2026-9117 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/497542537 Google--Chrome Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) 2026-05-20 not yet calculated CVE-2026-9118 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/498702233 Google--Chrome Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) 2026-05-20 not yet calculated CVE-2026-9119 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/502661101 Google--Chrome Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) 2026-05-20 not yet calculated CVE-2026-9120 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/504620824 Google--Chrome Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) 2026-05-20 not yet calculated CVE-2026-9121 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/488064108 Google--Chrome Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) 2026-05-20 not yet calculated CVE-2026-9122 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/489579953 Google--Chrome Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: Medium) 2026-05-20 not yet calculated CVE-2026-9123 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/495988507 Google--Chrome Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) 2026-05-20 not yet calculated CVE-2026-9124 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/496375695 Google--Chrome Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) 2026-05-20 not yet calculated CVE-2026-9126 https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html https://issues.chromium.org/issues/496280532 HP Inc--HP Linux Imaging and Printing Software A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer overflow in the hpcups processing path when handling crafted print data. 2026-05-20 not yet calculated CVE-2026-8631 https://support.hp.com/us-en/document/ish_14942099-14942126-16/hpsbpi04118 HP Inc--HP Linux Imaging and Printing Software A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via operating system command injection. 2026-05-20 not yet calculated CVE-2026-8632 https://support.hp.com/us-en/document/ish_14942099-14942126-16/hpsbpi04118 HP-- ENVY 5000 HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing). An unauthenticated remote attacker on the same network can establish a persistent connection to port 9100 and send keep-alive packets, causing the printer's session threads to remain locked in a waiting state. The firmware lacks connection timeouts and concurrent session limits, resulting in a persistent Denial of Service (DoS) that renders the printer unresponsive to all user commands and print jobs. Physical intervention (manual restart) is required to restore functionality, and the attack can be immediately re-initiated. 2026-05-22 not yet calculated CVE-2026-42626 https://medium.com/@jacobmasse/hp-envy-5000-printer-dos-vulnerability-8cae52c87b41 HSC--MailInspector v5.3.3-7 HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization, or path restriction. This allows a remote attacker to exploit Path Traversal techniques to read arbitrary files from the underlying operating system and application directories, leading to sensitive information disclosure. 2026-05-18 not yet calculated CVE-2026-29962 https://github.com/sql3t0/cve-disclosures https://hsclabs.com/pt-br/mailinspector https://github.com/sql3t0/cve-disclosures/blob/main/01_-_CVE-2026-29962_LFI%2BPath_Traversal.md HSC--MailInspector v5.3.3-7 HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory. A remote attacker can exploit this flaw to access arbitrary files on the underlying operating system, resulting in unauthorized disclosure of sensitive information. 2026-05-18 not yet calculated CVE-2026-29963 https://hsclabs.com/pt-br/mailinspector/ https://github.com/sql3t0/cve-disclosures https://github.com/sql3t0/cve-disclosures/blob/main/02_-_CVE-2026-29963_LFI%2BPath_Traversal.md HSC--MailInspector v5.3.3-7 HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input using alternate or obfuscated JavaScript syntax. The endpoint reflects unsanitized user input in HTTP responses without adequate output encoding, allowing a remote attacker to execute arbitrary JavaScript code in the context of a victim's browser. 2026-05-18 not yet calculated CVE-2026-29964 https://hsclabs.com/pt-br/mailinspector/ https://github.com/sql3t0/cve-disclosures https://github.com/sql3t0/cve-disclosures/blob/main/03_-_CVE-2026-29964_XSS.md HSC--MailInspector v5.3.3-7 HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax. 2026-05-18 not yet calculated CVE-2026-29965 https://hsclabs.com/pt-br/mailinspector/ https://github.com/sql3t0/cve-disclosures https://github.com/sql3t0/cve-disclosures/blob/main/04_-_CVE-2026-29965_XSS.md huggingface--huggingface/transformers A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` field set to an attacker-controlled HuggingFace Hub repository ID. When a victim loads this model using the standard `AutoModelForCausalLM.from_pretrained()` API, the library downloads and executes arbitrary Python code from the attacker's repository with the victim's full OS privileges. This issue arises due to unfiltered deserialization of configuration attributes, insufficient sanitization of internal fields, and unsandboxed execution of downloaded kernels. The vulnerability bypasses the `trust_remote_code` security mechanism, is invisible to the victim, and exploits the standard documented usage pattern, making it particularly severe. Users are advised to upgrade to version 5.3.0 or later to mitigate this issue. 2026-05-24 not yet calculated CVE-2026-4372 https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884 https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f InfoScale--CmdServer InfoScale CmdServer before 7.4.2 mishandles access control. 2026-05-20 not yet calculated CVE-2026-44926 https://www.veritas.com/support/en_US/doc/109864724-141543588-0/v141217547-141543588 https://supportinfoscale.cloud.com/support-home/kbsearch/article?articleNumber=1000766081&articleTitle=InfoScale_Command_Server_Security_Bulletin_for_CVE_2026_44926 InfoScale--VIOM SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges. 2026-05-20 not yet calculated CVE-2026-44923 https://www.veritas.com/support/en_US/doc/120571566-166757640-0/viom_tot_v118836641-166757640 https://supportinfoscale.cloud.com/support-home/kbsearch/article?articleNumber=1000766080&articleTitle=InfoScale_Operations_Manager_IOM_web_application_Security_Bulletin_for_CVE_2026_44923_CVE_2026_44924_and_CVE_2026_44925 InfoScale--VIOM InfoScale VIOM 9.1.3 allows XSS. 2026-05-20 not yet calculated CVE-2026-44924 https://www.veritas.com/support/en_US/doc/120571566-166757640-0/viom_tot_v118836641-166757640 https://supportinfoscale.cloud.com/support-home/kbsearch/article?articleNumber=1000766080&articleTitle=InfoScale_Operations_Manager_IOM_web_application_Security_Bulletin_for_CVE_2026_44923_CVE_2026_44924_and_CVE_2026_44925 InfoScale--VIOM Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force the user with an active session into clicking a malicious HTML link, which triggers unintended modifications on VIOM web application without the user's knowledge. 2026-05-20 not yet calculated CVE-2026-44925 https://www.veritas.com/support/en_US/doc/120571566-166757640-0/viom_tot_v118836641-166757640 https://supportinfoscale.cloud.com/support-home/kbsearch/article?articleNumber=1000766080&articleTitle=InfoScale_Operations_Manager_IOM_web_application_Security_Bulletin_for_CVE_2026_44923_CVE_2026_44924_and_CVE_2026_44925 Innoshop--Innoshop 0.6.0 An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations. 2026-05-19 not yet calculated CVE-2026-39250 https://www.innoshop.com/ https://gist.github.com/hkdmh/4af513ea7589212cb1d49bc5d972972e Jaspersoft--JasperReports Library Community Edition Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system 2026-05-19 not yet calculated CVE-2026-6009 https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-may-19-2026-jaspersoft-library-cve-2026-6009-r11/ JJNAPIORK--Catalyst::Plugin::Authentication Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password. 2026-05-21 not yet calculated CVE-2026-5091 https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10_025/changes https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b0515f492257438cf07082acf1e10d06e8088a5e.patch LalanaChami--Pharmacy Management System The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint fails to validate the role parameter in the request body 2026-05-19 not yet calculated CVE-2026-31070 https://github.com/LalanaChami/Pharmacy-Mangment-System/blob/5c3d02888631166649856f71d542387114b3010b/backend/routes/user.js#L16 https://gist.github.com/nedlir/22bf6d1a3a07209be3e343744bc81d51 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the maximum server registration per node Current code does no bound checking on the number of servers added per node. A malicious client can flood NEW_SERVER messages and exhaust memory. Fix this issue by limiting the maximum number of server registrations to 256 per node. If the NEW_SERVER message is received for an old port, then don't restrict it as it will get replaced. While at it, also rate limit the error messages in the failure path of qrtr_ns_worker(). Note that the limit of 256 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased. 2026-05-19 not yet calculated CVE-2026-43491 https://git.kernel.org/stable/c/e6f6cd501fb54060940a6eb3f4103eeb5e426ae7 https://git.kernel.org/stable/c/3efaad55cad1ded429e3a873bfece389058a526b https://git.kernel.org/stable/c/35fb4a0c077c5d1049c2628b769e0a1b1e65df0d https://git.kernel.org/stable/c/868202aa2adae427060a42d5bd663b4d782ec02c https://git.kernel.org/stable/c/d5ee2ff98322337951c56398e79d51815acbf955 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Yiming reports an integer underflow in mpi_read_raw_from_sgl() when subtracting "lzeros" from the unsigned "nbytes". For this to happen, the scatterlist "sgl" needs to occupy more bytes than the "nbytes" parameter and the first "nbytes + 1" bytes of the scatterlist must be zero. Under these conditions, the while loop iterating over the scatterlist will count more zeroes than "nbytes", subtract the number of zeroes from "nbytes" and cause the underflow. When commit 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") originally introduced the bug, it couldn't be triggered because all callers of mpi_read_raw_from_sgl() passed a scatterlist whose length was equal to "nbytes". However since commit 63ba4d67594a ("KEYS: asymmetric: Use new crypto interface without scatterlists"), the underflow can now actually be triggered. When invoking a KEYCTL_PKEY_ENCRYPT system call with a larger "out_len" than "in_len" and filling the "in" buffer with zeroes, crypto_akcipher_sync_prep() will create an all-zero scatterlist used for both the "src" and "dst" member of struct akcipher_request and thereby fulfil the conditions to trigger the bug: sys_keyctl() keyctl_pkey_e_d_s() asymmetric_key_eds_op() software_key_eds_op() crypto_akcipher_sync_encrypt() crypto_akcipher_sync_prep() crypto_akcipher_encrypt() rsa_enc() mpi_read_raw_from_sgl() To the user this will be visible as a DoS as the kernel spins forever, causing soft lockup splats as a side effect. Fix it. 2026-05-19 not yet calculated CVE-2026-43492 https://git.kernel.org/stable/c/2aa77a18dc7f2670497fe3ee5acbeda0b57659e5 https://git.kernel.org/stable/c/26d3a97ad46c7a9226ec04d4bf35bd4998a97d16 https://git.kernel.org/stable/c/8637dfb4c1d8a7026ef681f2477c6de8b71c4003 https://git.kernel.org/stable/c/30e513e755bb381afce6fb57cdc8694136193f22 https://git.kernel.org/stable/c/8c2f1288250a90a4b5cabed5d888d7e3aeed4035 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user(). 2026-05-21 not yet calculated CVE-2026-43494 https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799 https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353 https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51 https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479 https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as a loop bound over port_msg->data[] without checking that the message buffer contains sufficient data. A modem sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up to 262140 bytes. Add a sizeof(*port_msg) check before accessing the port message header fields to guard against undersized messages. Add a struct_size() check after extracting port_count and before the loop. In t7xx_parse_host_rt_data(), guard the rt_feature header read with a remaining-buffer check before accessing data_len, validate feat_data_len against the actual remaining buffer to prevent OOB reads and signed integer overflow on offset. Pass msg_len from both call sites: skb->len at the DPMAIF path after skb_pull(), and the validated feat_data_len at the handshake path. 2026-05-21 not yet calculated CVE-2026-43495 https://git.kernel.org/stable/c/f94450ce5053b36002995b72d1fa1db3bb08c5bf https://git.kernel.org/stable/c/9855e063e063158cc5bded576382599dc3133202 https://git.kernel.org/stable/c/2b56d7903ab804481f5233a259d5f341e9fd513c https://git.kernel.org/stable/c/dd4f4c93c1488d7100b9964f2da4c8b3c29652f1 https://git.kernel.org/stable/c/0e7c074cfcd9bd93765505f9eb8b42f03ed2a744 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked When red qdisc has children (eg qfq qdisc) whose peek() callback is qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from its child (red in this case), it will do the following: 1a. do a peek() - and when sensing there's an skb the child can offer, then - the child in this case(red) calls its child's (qfq) peek. qfq does the right thing and will return the gso_skb queue packet. Note: if there wasnt a gso_skb entry then qfq will store it there. 1b. invoke a dequeue() on the child (red). And herein lies the problem. - red will call the child's dequeue() which will essentially just try to grab something of qfq's queue. [ 78.667668][ T363] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f] [ 78.667927][ T363] CPU: 1 UID: 0 PID: 363 Comm: ping Not tainted 7.1.0-rc1-00033-g46f74a3f7d57-dirty #790 PREEMPT(full) [ 78.668263][ T363] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 78.668486][ T363] RIP: 0010:qfq_dequeue+0x446/0xc90 [sch_qfq] [ 78.668718][ T363] Code: 54 c0 e8 dd 90 00 f1 48 c7 c7 e0 03 54 c0 48 89 de e8 ce 90 00 f1 48 8d 7b 48 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74 05 e8 ef a1 e1 f1 48 8b 7b 48 48 8d 54 24 58 48 8d [ 78.669312][ T363] RSP: 0018:ffff88810de573e0 EFLAGS: 00010216 [ 78.669533][ T363] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 78.669790][ T363] RDX: 0000000000000009 RSI: 0000000000000004 RDI: 0000000000000048 [ 78.670044][ T363] RBP: ffff888110dc4000 R08: ffffffffb1b0885a R09: fffffbfff6ba9078 [ 78.670297][ T363] R10: 0000000000000003 R11: ffff888110e31c80 R12: 0000001880000000 [ 78.670560][ T363] R13: ffff888110dc4150 R14: ffff888110dc42b8 R15: 0000000000000200 [ 78.670814][ T363] FS: 00007f66a8f09c40(0000) GS:ffff888163428000(0000) knlGS:0000000000000000 [ 78.671110][ T363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 78.671324][ T363] CR2: 000055db4c6a30a8 CR3: 000000010da67000 CR4: 0000000000750ef0 [ 78.671585][ T363] PKRU: 55555554 [ 78.671713][ T363] Call Trace: [ 78.671843][ T363] [ 78.671936][ T363] ? __pfx_qfq_dequeue+0x10/0x10 [sch_qfq] [ 78.672148][ T363] ? __pfx__printk+0x10/0x10 [ 78.672322][ T363] ? srso_alias_return_thunk+0x5/0xfbef5 [ 78.672496][ T363] ? lockdep_hardirqs_on_prepare+0xa8/0x1a0 [ 78.672706][ T363] ? srso_alias_return_thunk+0x5/0xfbef5 [ 78.672875][ T363] ? trace_hardirqs_on+0x19/0x1a0 [ 78.673047][ T363] red_dequeue+0x65/0x270 [sch_red] [ 78.673217][ T363] ? srso_alias_return_thunk+0x5/0xfbef5 [ 78.673385][ T363] tbf_dequeue.cold+0xb0/0x70c [sch_tbf] [ 78.673566][ T363] __qdisc_run+0x169/0x1900 The right thing to do in #1b is to grab the skb off gso_skb queue. This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked() method instead. 2026-05-21 not yet calculated CVE-2026-43496 https://git.kernel.org/stable/c/36aa34f42cb6842cf371f3a2d3e855d24fd57a50 https://git.kernel.org/stable/c/ce051eede433f876d322ac3550a36a3c6fc4c231 https://git.kernel.org/stable/c/8d09618840b99ef00154d3e731ce9b11e096196d https://git.kernel.org/stable/c/587dcf970a525f543d8b5855d9f37a4ca97b76ef https://git.kernel.org/stable/c/458d5615272d3de535748342eb68ca492343048c Linux--Linux In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages to userspace but sets no vm_ops on the VMA. This means the kernel cannot track active mmaps. When dlfb_realloc_framebuffer() replaces the backing buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated. On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages while userspace PTEs still reference them, resulting in a use-after-free: the process retains read/write access to freed kernel pages. Add vm_operations_struct with open/close callbacks that maintain an atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(), check mmap_count and return -EBUSY if the buffer is currently mapped, preventing buffer replacement while userspace holds stale PTEs. Tested with PoC using dummy_hcd + raw_gadget USB device emulation. 2026-05-21 not yet calculated CVE-2026-43497 https://git.kernel.org/stable/c/4f312c30f0368e8d2a76aa650dff73f23490b5e7 https://git.kernel.org/stable/c/18dd358de72d57993422cbb5dfb29ccd74efe192 https://git.kernel.org/stable/c/da9b065cedfd3b574f229d5be594e6aa47a27ae6 https://git.kernel.org/stable/c/a2c53a3822ee26e8d758071815b9ed3bf6669fc1 https://git.kernel.org/stable/c/8de779dc40d35d39fa07387b6f921eb11df0f511 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Disallow re-exporting imported GEM objects Prevent re-exporting of imported GEM buffers by adding a custom prime_handle_to_fd callback that checks if the object is imported and returns -EOPNOTSUPP if so. Re-exporting imported GEM buffers causes loss of buffer flags settings, leading to incorrect device access and data corruption. 2026-05-21 not yet calculated CVE-2026-43498 https://git.kernel.org/stable/c/3756043dd695bba34cc728cdc5688dcb49ac8043 https://git.kernel.org/stable/c/7dd57d7a6350770dfc283287125c409e995200e0 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ] 2026-05-21 not yet calculated CVE-2026-43499 https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166 https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2 https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11 https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old header and pushes the new one plus the IPv6 header back. The recompressed header can be larger than the received one when the swap reduces the common-prefix length the segments share with daddr (CmprI=0, CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes). pskb_expand_head() was gated on segments_left == 0, so on earlier segments the push consumed unchecked headroom. Once skb_push() leaves fewer than skb->mac_len bytes in front of data, skb_mac_header_rebuild()'s call to: skb_set_mac_header(skb, -skb->mac_len); will store (data - head) - mac_len into the u16 mac_header field, which wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB past skb->head. A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv. Fix this by expanding the head whenever the remaining room is less than the push size plus mac_len, and request that much extra so the rebuilt MAC header fits afterwards. 2026-05-21 not yet calculated CVE-2026-43501 https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854 https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37 https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path. Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages. This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path. 2026-05-21 not yet calculated CVE-2026-43502 https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46 https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to ' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list(). The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but a future consumer depending on the marker would regress silently. The same omission exists in skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker. 2026-05-23 not yet calculated CVE-2026-43503 https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991 https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196 https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349 https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8 https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20 https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0 Linux--Linux In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. 2026-05-23 not yet calculated CVE-2026-46300 https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3 LiteSpeed Technologies--cPanel Plugin LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7. 2026-05-21 not yet calculated CVE-2026-48172 https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/ lostisland--faraday Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and enables off-host request forgery: a request built from a fixed-base Faraday::Connection can be redirected to an attacker-controlled host, forwarding connection-scoped values such as Authorization headers and default query parameters. This issue has been fixed in version 2.14.3. 2026-05-19 not yet calculated CVE-2026-33637 https://github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484 https://github.com/advisories/GHSA-33mh-2634-fwr2 LXQt--PCManFM-Qt An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus method call, PCManFM-Qt delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution or circumvent network namespace restrictions. NOTE: those outcomes are potentially unwanted by most users; however, the behavior of the product does comply with the applicable specification, and a simplistic solution (ensuring that the URI does not name a regular file) may have adverse consequences for I/O. 2026-05-22 not yet calculated CVE-2026-48700 https://www.openwall.com/lists/oss-security/2026/05/20/2 https://www.openwall.com/lists/oss-security/2026/05/19/1 https://github.com/lxqt/pcmanfm-qt/releases M-Files Corporation--M-Files Server Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash 2026-05-18 not yet calculated CVE-2026-0983 https://empower.m-files.com/security-advisories/CVE-2026-0983 mailcow--mailcow-dockerized mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding. This issue affects mailcow-dockerized: 2026-03b. 2026-05-20 not yet calculated CVE-2026-7460 https://fluidattacks.com/advisories/mojabi https://github.com/mailcow/mailcow-dockerized mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2. 2026-05-19 not yet calculated CVE-2026-33052 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-68w5-w573-q2r8 https://github.com/mantisbt/mantisbt/commit/3f952e68fa864e0e60abc3e84adecf3cfa84c75e https://mantisbt.org/bugs/view.php?id=36974 mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior have a Privilege Escalation vulnerability where insufficient access control checks in ProjectUsersAddCommand (manage_proj_user_add.php) allow users having manage_project_threshold access level (manager by default) to grant project-level administrator access to any user (including themselves) in any Project they have manager rights in. The normal project-user add form restricts the selectable access levels to the actor's own project role or below. However, the backend handler still accepts a forged higher access_level value and writes it. The consequences of the privilege escalation are slight, as having administrator access at Project level is effectively not very different from being manager, and it does not actually give administrator privileges on the whole MantisBT instance. In particular, it does not let the upgraded user delete the Project or grant them any access to global administrative functions such as managing Users, Projects, Plugins, Custom Fields, etc. This issue has been fixed in version 2.28.2. 2026-05-19 not yet calculated CVE-2026-34390 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-frf7-jhp9-jxm6 https://github.com/mantisbt/mantisbt/commit/69e0180f180ed5acf48a8d281a73683a7bf32461 https://mantisbt.org/bugs/view.php?id=36995 https://mantisbt.org/bugs/view.php?id=37002 mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerability. When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepends the source Project name before the category selector without proper escaping, allowing an attacker able to to inject HTML if they can set the Project's name (which typically requires manager or administrator access level). This issue has been resolved in version 2.28.2. 2026-05-19 not yet calculated CVE-2026-34463 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-fvjf-68wh-rwp2 https://github.com/mantisbt/mantisbt/commit/df22697ae497ddd93f3d9132fdf4979db8d081cd https://mantisbt.org/bugs/view.php?id=36986 mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monitoring feature . Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private issue. Direct access to the private issue remains blocked, but the user will receive email notifications for updates, leading to disclosure of the private issue's metadata and content. This issue has been fixed in version 2.28.2. 2026-05-19 not yet calculated CVE-2026-34579 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-ggw7-9675-6v4v https://github.com/mantisbt/mantisbt/commit/0a93267deba445fb9d15250c16e6fdb1246ffa65 https://mantisbt.org/bugs/view.php?id=36975 mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue created by another user even after it becomes private, bypassing read access revocation. The loss of confidentiality caused by this vulnerability is minimal, considering that only attachments previously uploaded by the user themselves remain accessible. This issue has been fixed in version 2.82.2. 2026-05-19 not yet calculated CVE-2026-34744 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-rmp5-5jj7-gmvf https://github.com/mantisbt/mantisbt/commit/de7bdeec36de066235e38a77bf056917d951c84d https://mantisbt.org/bugs/view.php?id=36977 mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This issue has been fixed in version 2.28.2. 2026-05-19 not yet calculated CVE-2026-34970 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-crmx-4p49-46m2 https://github.com/mantisbt/mantisbt/commit/71df1f67e05b2050cd4bd87839e6cc13747cf03f https://mantisbt.org/bugs/view.php?id=36978 mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating their account's font family. Upon exploitation, an XSS payload would be reflected on every MantisBT page. Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover. This issue has been fixed in version 2.28.2. 2026-05-22 not yet calculated CVE-2026-40596 https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j3v9-553h-x28j https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3 https://github.com/mantisbt/mantisbt/commit/9e8409cdd979eba86ef532756fc47c1d8112d22d https://mantisbt.org/bugs/view.php?id=37011 https://mantisbt.org/bugs/view.php?id=37016 mantisbt--mantisbt Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue that, when accessed via the file_download.php link, will be downloaded with a valid JavaScript MIME type resulting in script execution. The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a html %]’> would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example, var = “ ‘ onclick=’while (true) { alert(1) }’” Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped. 2026-05-19 not yet calculated CVE-2026-5090 https://github.com/abw/Template2/issues/327 https://github.com/abw/Template2/pull/337/changes/11c78a7a771d4af505efeb754a0b8775689c2eae TP-Link Systems Inc.–Archer AX72 (SG) v1.0 In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command usage information. An authenticated attacker with administrative privileges could exploit this issue to confirm the presence of the diagnostic utility and view its valid command-line syntax and options. The exposed information is limited in scope and does not include sensitive system data. 2026-05-19 not yet calculated CVE-2026-5511 https://www.tp-link.com/sg/support/download/archer-ax72/#Firmware https://www.tp-link.com/us/support/faq/5096/ TP-Link Systems Inc.–Archer RE650 v1 An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and reset the administrator password due to insufficient validation. Successful exploitation allows an attacker to obtain full administrative control of the affected device, potentially impacting on confidentiality, integrity, and availability. 2026-05-22 not yet calculated CVE-2026-3294 https://www.tp-link.com/en/support/download/re650/v1/#Firmware https://www.tp-link.com/us/support/download/re650/v1/#Firmware https://www.tp-link.com/us/support/download/re305/v1/#Firmware https://www.tp-link.com/en/support/download/re305/v1/#Firmware https://www.tp-link.com/us/support/download/re360/v1/#Firmware https://www.tp-link.com/en/support/download/re360/v1/#Firmware https://www.tp-link.com/us/support/download/tl-wa860re/v4/#Firmware https://www.tp-link.com/en/support/download/tl-wa860re/v4/#Firmware https://www.tp-link.com/en/support/download/re580d/#Firmware https://www.tp-link.com/us/support/download/re580d/#Firmware https://www.tp-link.com/us/support/faq/5101/ Trend Micro, Inc.–TrendAI Apex One (Mac) An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release). 2026-05-21 not yet calculated CVE-2025-71214 https://success.trendmicro.com/en-US/solution/KA-0022458 https://www.zerodayinitiative.com/advisories/ZDI-26-139/ Trend Micro, Inc.–TrendAI Apex One (Mac) A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release). 2026-05-21 not yet calculated CVE-2025-71215 https://success.trendmicro.com/en-US/solution/KA-0022458 https://www.zerodayinitiative.com/advisories/ZDI-26-141/ Trend Micro, Inc.–TrendAI Apex One (Mac) A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release). 2026-05-21 not yet calculated CVE-2025-71216 https://success.trendmicro.com/en-US/solution/KA-0022458 https://www.zerodayinitiative.com/advisories/ZDI-26-142/ Trend Micro, Inc.–TrendAI Apex One (Mac) An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release). 2026-05-21 not yet calculated CVE-2025-71217 https://success.trendmicro.com/en-US/solution/KA-0022458 https://www.zerodayinitiative.com/advisories/ZDI-26-143/ Trimble–SketchUp A cross-site scripting (XSS) vulnerability in SketchUp 2026’s Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser. 2026-05-22 not yet calculated CVE-2026-9264 https://trust.trimble.com/?tcuUid=52252bc0-c196-4b1f-9f13-4e4c9ba247d9 TYPO3–Extension “Address List” The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection. 2026-05-19 not yet calculated CVE-2026-8827 https://typo3.org/security/advisory/typo3-ext-sa-2026-012 TYPO3–Extension “Content Element Selector” The extension passes an attacker-controlled cookie directly to PHP’s unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with “Persistent Mode: Static” in the plugin settings. 2026-05-19 not yet calculated CVE-2026-46725 https://typo3.org/security/advisory/typo3-ext-sa-2026-013 TYPO3–Extension “Faceted Search” The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index. 2026-05-19 not yet calculated CVE-2026-46722 https://typo3.org/security/advisory/typo3-ext-sa-2026-011 TYPO3–Extension “Faceted Search” The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index. 2026-05-19 not yet calculated CVE-2026-46723 https://typo3.org/security/advisory/typo3-ext-sa-2026-011 TYPO3–Extension “Faceted Search” The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences. 2026-05-19 not yet calculated CVE-2026-46724 https://typo3.org/security/advisory/typo3-ext-sa-2026-011 TYPO3–Extension “Frontend User Registration” The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups. 2026-05-19 not yet calculated CVE-2026-46721 https://typo3.org/security/advisory/typo3-ext-sa-2026-009 TYPO3–Extension “News system” The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the “Date Menu of news articles” plugin. Exploitation requires the “Date Menu of news articles” plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled. 2026-05-19 not yet calculated CVE-2026-8726 https://typo3.org/security/advisory/typo3-ext-sa-2026-010 TYPO3–Extension “Site Crawler” The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP’s unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. 2026-05-19 not yet calculated CVE-2026-8727 https://typo3.org/security/advisory/typo3-ext-sa-2026-008 Unknown–Ajax Load More The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin 2026-05-18 not yet calculated CVE-2026-6495 https://wpscan.com/vulnerability/c52f28c5-547d-48ae-89dd-edcdaeadcec5/ Unknown–Autoptimize The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format. 2026-05-18 not yet calculated CVE-2026-3220 https://wpscan.com/vulnerability/3ceabf11-23cd-4c38-ba14-014348b0ff2d/ Unknown–Decent Comments The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses. 2026-05-20 not yet calculated CVE-2026-7385 https://wpscan.com/vulnerability/1c5949d0-cf50-45d3-a7e2-2f94cdb42405/ Unknown–Email Encoder The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks 2026-05-20 not yet calculated CVE-2026-5776 https://wpscan.com/vulnerability/00c0b9f7-c559-463e-80ae-97d99e0ef99f/ Unknown–Feeds for YouTube (YouTube video, channel, and gallery plugin) The Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4 is vulnerable to unauthorized modification of the Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4’s license key due to a missing capability check on the ‘actions’ function. This makes it possible for subscribers and above delete the license key. 2026-05-18 not yet calculated CVE-2026-1631 https://wpscan.com/vulnerability/b19596c2-69bc-4e15-8632-eb80f4577e3c/ Unknown–Fortis for WooCommerce The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis’ API and retrieve sensitive customer information, like past orders, PII, etc. 2026-05-19 not yet calculated CVE-2025-15609 https://wpscan.com/vulnerability/220f72ea-e3b4-44c9-8c9b-15662aebb6cb/ Unknown–WP Maps The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks. 2026-05-18 not yet calculated CVE-2026-6381 https://wpscan.com/vulnerability/18b36672-58d7-44fa-b653-b728e9ef257a/ Unknown–WP Photo Album Plus The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. 2026-05-18 not yet calculated CVE-2026-6379 https://wpscan.com/vulnerability/60b88fd2-4048-4773-b319-63caaf5bd8eb/ vaadin–flow A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials supplied as secrets, any failed frontend build can expose those secrets in clear text in CI logs and archived build artifacts. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 23.0.0 - 23.6.9 Vaadin 24.0.0 - 24.9.16 Vaadin 24.10.0 - 24.10.3 Vaadin 25.0.0 - 25.0.10 Vaadin 25.1.0 - 25.1.4 Mitigation Upgrade to 23.6.10 Upgrade to 24.9.17 or newer Upgrade to 24.10.4 or newer Upgrade to 25.0.11 or newer Upgrade to 25.1.5 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, or 25 version. ArtifactsMaven coordinatesVulnerable versionsFixed versioncom.vaadin:flow-plugin-base23.0.0 - 23.6.10â‰¥23.6.11com.vaadin:flow-plugin-base24.0.0 - 24.9.17â‰¥24.9.18com.vaadin:flow-plugin-base24.10.0 - 24.10.3â‰¥24.10.4com.vaadin:flow-plugin-base25.0.0 - 25.0.11â‰¥25.0.12com.vaadin:flow-plugin-base25.1.0 - 25.1.4â‰¥25.1.5com.vaadin:flow-maven-plugin23.0.0 - 23.6.10â‰¥23.6.11com.vaadin:flow-maven-plugin24.0.0 - 24.9.17â‰¥24.9.18com.vaadin:flow-maven-plugin24.10.0 - 24.10.3â‰¥24.10.4com.vaadin:flow-maven-plugin25.0.0 - 25.0.11â‰¥25.0.12com.vaadin:flow-maven-plugin25.1.0 - 25.1.4â‰¥25.1.5com.vaadin:flow-gradle-plugin24.0.0 - 24.9.17â‰¥24.9.18com.vaadin:flow-gradle-plugin24.10.0 - 24.10.3â‰¥24.10.4com.vaadin:flow-gradle-plugin25.0.0 - 25.0.11â‰¥25.0.12com.vaadin:flow-gradle-plugin25.1.0 - 25.1.4â‰¥25.1.5 2026-05-19 not yet calculated CVE-2026-7860 https://vaadin.com/security/cve-2026-7860 https://github.com/vaadin/flow/pull/24219 vifm–vifm vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json). This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the history to cause memory corruption or application crashes. Releases from 0.12.1 to 0.14.3 (including) are considered vulnerable. This issue was fixed in commit 23063c7 2026-05-22 not yet calculated CVE-2026-8997 https://cert.pl/en/posts/2026/05/CVE-2026-8997 https://github.com/vifm/vifm/commit/23063c741f15a85621fd232dfc3ac5b779f6910d WineHQ–Wine Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine). 2026-05-24 not yet calculated CVE-2026-48831 https://bugs.winehq.org/show_bug.cgi?id=59767 https://www.openwall.com/lists/oss-security/2026/05/19/1 Xen–Xen Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen. 2026-05-19 not yet calculated CVE-2026-23557 https://xenbits.xenproject.org/xsa/advisory-484.html Xen–Xen The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of the status pages may then be freed while mappings of them would still be inserted into the guest’s secondary (P2M) page tables. 2026-05-19 not yet calculated CVE-2026-23558 https://xenbits.xenproject.org/xsa/advisory-486.html xwiki–xwiki-commons XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17. 2026-05-20 not yet calculated CVE-2026-23734 https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-xq3r-2qv5-vqqm https://github.com/xwiki/xwiki-commons/commit/a979cafd89f6a9c9c0b9ab19744d672df64429bf https://jira.xwiki.org/browse/XCOMMONS-3547 xwiki–xwiki-platform XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/{wikiName} API executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1. 2026-05-20 not yet calculated CVE-2026-33137 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qrvh-r3f2-9h4r https://github.com/xwiki/xwiki-platform/commit/4b7b95b79256374d487e9ece1dc48f527966990f https://jira.xwiki.org/browse/XWIKI-23953 Zenshin–hitarth-gg An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter. 2026-05-19 not yet calculated CVE-2026-37281 https://github.com/hitarth-gg/zenshin https://github.com/hitarth-gg/zenshin/commit/7d31c6edfbac978f0ad44c66d761bab9dcd2fa27 https://gist.github.com/MitruStefan/cf016709252aabbec7f95b7a70e0cfba zephyrproject-rtos–Zephyr A bitwise shift vulnerability in Zephyr’s PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes. An attacker sends a crafted PTP_MSG_MANAGEMENT message to set an unvalidated negative log_announce_interval value in the port’s data set. When a subsequent PTP_MSG_ANNOUNCE message is processed, port_timer_set_timeout_random computes a timeout as NSEC_PER_SEC » -log_seconds; if the attacker-supplied value is sufficiently negative (e.g., -127), the shift amount exceeds the 64-bit integer width, triggering undefined behavior in C. This can cause a system crash via a compiler-generated illegal instruction trap on some architectures, or produce an erroneous zero timeout leading to resource starvation loops or other logical errors. 2026-05-22 not yet calculated CVE-2026-5072 https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3v98-458v-388r LalanaChami–Pharmacy Management System API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder. 2026-05-19 not yet calculated CVE-2026-31071 https://github.com/LalanaChami/Pharmacy-Mangment-System/tree/5c3d02888631166649856f71d542387114b3010b/backend/routes https://gist.github.com/nedlir/bc8ad4693c53256819280e8f5de49286 Panabit–PAP-XM320 A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands. 2026-05-19 not yet calculated CVE-2026-36827 https://www.panabit.com/ https://secreu.notion.site/CVE-2026-36827-3652c0ab46158036a888ef4a12b104bf Panabit–PAP-XM320 A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. The CGI component allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter. 2026-05-19 not yet calculated CVE-2026-36828 https://www.panabit.com/ https://secreu.notion.site/CVE-2026-36828-3652c0ab461580f28f50ddc37ce4e1d6 Panabit–PAP-XM320 An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. The server validates session cookies using a filesystem existence check based on a user-controlled cookie value without proper sanitization, allowing directory traversal and bypass of authentication. 2026-05-19 not yet calculated CVE-2026-36829 https://www.panabit.com/ https://secreu.notion.site/CVE-2026-36829-3652c0ab461580e19704e87b18865714 Uncrustify– Uncrustify Buffer Overflow vulnerability in Uncrustify Project Affected v.Uncrustify_d-0.82.0-132-bcc41cbdc and Fixed in commit 68e67b9a1435a1bb173b106fedb4a4f510972bdc allows a local attacker to cause a denial of service via the check_template.cpp, check_template function, tokenize_cleanup function, uncrustify executable components 2026-05-21 not yet calculated CVE-2026-36189 https://github.com/uncrustify/uncrustify%2Chttps://github.com/uncrustify/uncrustify/issues/4636%2C https://github.com/uncrustify/uncrustify/pull/4641 https://gist.github.com/Criticayon/5da6d6c9cf068e494347c659d01982a9 Back to top Document ID SB26-145

Discovery

Learnings

Guidance

Toolbox

Alignment

API Evangelist LLC

Vulnerability Summary for the Week of May 18, 2026