# CVEs published 2026-05-01

256 CVEs were published on May 1, 2026: 19 critical, 90 high. Days are UTC.

- [CVE-2026-7599](https://cve.now/CVE-2026-7599.md): Dayoooun hwpx-mcp MCP index.ts export\_to\_html path traversal (CVSS 5.3, Dayoooun hwpx-mcp)
- [CVE-2026-7598](https://cve.now/CVE-2026-7598.md): libssh2 userauth.c userauth\_password integer overflow (CVSS 6.9, libssh2)
- [CVE-2026-7597](https://cve.now/CVE-2026-7597.md): mem0ai mem0 faiss.py pickle.dump deserialization (CVSS 5.3, mem0ai mem0 · mem0ai)
- [CVE-2026-7596](https://cve.now/CVE-2026-7596.md): nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scripting (CVSS 5.3, nextlevelbuilder ui-ux-pro-max-skill)
- [CVE-2026-7595](https://cve.now/CVE-2026-7595.md): nextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind\_config\_gen.py \_format\_plugins code injection (CVSS 5.3, nextlevelbuilder ui-ux-pro-max-skill)
- [CVE-2026-39805](https://cve.now/CVE-2026-39805.md): CL.CL HTTP request smuggling via duplicate Content-Length in bandit (CVSS 6.3, mtrudel bandit)
- [CVE-2026-39804](https://cve.now/CVE-2026-39804.md): WebSocket permessage-deflate inflate has no output-size cap in bandit (CVSS 8.2, mtrudel bandit)
- [CVE-2026-39807](https://cve.now/CVE-2026-39807.md): Client-supplied URI scheme trusted without transport verification in bandit (CVSS 6.3, mtrudel bandit)
- [CVE-2026-42786](https://cve.now/CVE-2026-42786.md): WebSocket fragmented message reassembly unbounded in bandit (CVSS 8.7, mtrudel bandit)
- [CVE-2026-42788](https://cve.now/CVE-2026-42788.md): HTTP/2 frame size limit checked after body is buffered in bandit (CVSS 6.9, mtrudel bandit)
- [CVE-2026-7594](https://cve.now/CVE-2026-7594.md): Flux159 mcp-game-asset-gen MCP index.ts image\_to\_3d\_async path traversal (CVSS 6.9, Flux159 mcp-game-asset-gen)
- [CVE-2026-7593](https://cve.now/CVE-2026-7593.md): Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute\_command os command injection (CVSS 6.9, Sunwood-ai-labs command-executor-mcp-server)
- [CVE-2026-7592](https://cve.now/CVE-2026-7592.md): itsourcecode Courier Management System edit\_staff.php sql injection (CVSS 6.9, itsourcecode Courier Management System)
- [CVE-2026-7591](https://cve.now/CVE-2026-7591.md): TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection (CVSS 5.3, TimBroddin astro-mcp-server)
- [CVE-2026-7590](https://cve.now/CVE-2026-7590.md): eyal-gor p\_69\_branch\_monkey\_mcp Preview Endpoint advanced.py os command injection (CVSS 6.9, eyal-gor p\_69\_branch\_monkey\_mcp)
- [CVE-2026-7589](https://cve.now/CVE-2026-7589.md): ghantakiran splunk-mcp-integration CSV Export csv\_export.py create\_csv\_export path traversal (CVSS 6.9, ghantakiran splunk-mcp-integration)
- [CVE-2026-35233](https://cve.now/CVE-2026-35233.md): An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh\_link field. (CVSS 4.4, Oracle Linux)
- [CVE-2026-21996](https://cve.now/CVE-2026-21996.md): An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to an integer Divide-by-Zero in (CVSS 3.3, Oracle Linux)
- [CVE-2026-7588](https://cve.now/CVE-2026-7588.md): ggerve coding-standards-mcp server.py get\_best\_practices path traversal (CVSS 6.9, ggerve coding-standards-mcp)
- [CVE-2026-7587](https://cve.now/CVE-2026-7587.md): Open5GS AMF nsmf-handler.c amf\_nsmf\_pdusession\_handle\_update\_sm\_context denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-23866](https://cve.now/CVE-2026-23866.md): Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android (CVSS 4.3, Facebook WhatsApp for Android · Facebook WhatsApp for iOS)
- [CVE-2026-23863](https://cve.now/CVE-2026-23863.md): An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents w (CVSS 6.5, Facebook WhatsApp Desktop for Windows)
- [CVE-2026-7586](https://cve.now/CVE-2026-7586.md): Open5GS AMF nudm-handler.c ogs\_id\_get\_value denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-22166](https://cve.now/CVE-2026-22166.md): GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable (CVSS 8.1, Imagination Technologies Graphics DDK)
- [CVE-2026-22165](https://cve.now/CVE-2026-22165.md): GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs (CVSS 8.1, Imagination Technologies Graphics DDK)
- [CVE-2026-22167](https://cve.now/CVE-2026-22167.md): GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-7585](https://cve.now/CVE-2026-7585.md): Open5GS AMF nudm-handler.c amf\_nudm\_sdm\_handle\_provisioned denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-43507](https://cve.now/CVE-2026-43507.md): An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. (CVSS 5.3, Prosody)
- [CVE-2026-43506](https://cve.now/CVE-2026-43506.md): An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5. (CVSS 5.3, Prosody)
- [CVE-2026-7583](https://cve.now/CVE-2026-7583.md): Open5GS BSF context.c bsf\_sess\_find\_by\_ipv6prefix denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-43505](https://cve.now/CVE-2026-43505.md): An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod\_proxy65 is enabled. (CVSS 6.5, Prosody)
- [CVE-2026-43504](https://cve.now/CVE-2026-43504.md): An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod\_proxy65 is enabled. (CVSS 6.5, Prosody)
- [CVE-2026-43057](https://cve.now/CVE-2026-43057.md): net: correctly handle tunneled traffic on IPV6\_CSUM GSO fallback (CVSS 7.5, Linux)
- [CVE-2026-43056](https://cve.now/CVE-2026-43056.md): net: mana: fix use-after-free in add\_adev() error path (CVSS 7.8, Linux)
- [CVE-2026-43055](https://cve.now/CVE-2026-43055.md): scsi: target: file: Use kzalloc\_flex for aio\_cmd (CVSS 7.5, Linux)
- [CVE-2026-43054](https://cve.now/CVE-2026-43054.md): scsi: target: tcm\_loop: Drain commands in target\_reset handler (no CVSS, Linux)
- [CVE-2026-43053](https://cve.now/CVE-2026-43053.md): xfs: close crash window in attr dabtree inactivation (no CVSS, Linux)
- [CVE-2026-43052](https://cve.now/CVE-2026-43052.md): wifi: mac80211: check tdls flag in ieee80211\_tdls\_oper (no CVSS, Linux)
- [CVE-2026-43051](https://cve.now/CVE-2026-43051.md): HID: wacom: fix out-of-bounds read in wacom\_intuos\_bt\_irq (CVSS 8.1, Linux)
- [CVE-2026-43050](https://cve.now/CVE-2026-43050.md): atm: lec: fix use-after-free in sock\_def\_readable() (no CVSS, Linux)
- [CVE-2026-43049](https://cve.now/CVE-2026-43049.md): HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (no CVSS, Linux · :linux\_kernel:)
- [CVE-2026-43048](https://cve.now/CVE-2026-43048.md): HID: core: Mitigate potential OOB by removing bogus memset() (CVSS 8.8, Linux)
- [CVE-2026-43047](https://cve.now/CVE-2026-43047.md): HID: multitouch: Check to ensure report responses match the request (CVSS 7.8, Linux)
- [CVE-2026-43046](https://cve.now/CVE-2026-43046.md): btrfs: reject root items with drop\_progress and zero drop\_level (no CVSS, Linux)
- [CVE-2026-43045](https://cve.now/CVE-2026-43045.md): mshv: Fix error handling in mshv\_region\_pin (no CVSS, Linux)
- [CVE-2026-43044](https://cve.now/CVE-2026-43044.md): crypto: caam - fix DMA corruption on long hmac keys (CVSS 7.8, Linux)
- [CVE-2026-43043](https://cve.now/CVE-2026-43043.md): crypto: af-alg - fix NULL pointer dereference in scatterwalk (no CVSS, Linux)
- [CVE-2026-43042](https://cve.now/CVE-2026-43042.md): mpls: add seqcount to protect the platform\_label{,s} pair (CVSS 7.1, Linux)
- [CVE-2026-43041](https://cve.now/CVE-2026-43041.md): net: qrtr: replace qrtr\_tx\_flow radix\_tree with xarray to fix memory leak (no CVSS, Linux)
- [CVE-2026-43040](https://cve.now/CVE-2026-43040.md): net: ipv6: ndisc: fix ndisc\_ra\_useropt to initialize nduseropt\_padX fields to zero to prevent an info-leak (no CVSS, Linux)
- [CVE-2026-43039](https://cve.now/CVE-2026-43039.md): net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch (CVSS 9.8, Linux)
- [CVE-2026-43038](https://cve.now/CVE-2026-43038.md): ipv6: icmp: clear skb2-\>cb\[\] in ip6\_err\_gen\_icmpv6\_unreach() (CVSS 9.8, Linux)
- [CVE-2026-43037](https://cve.now/CVE-2026-43037.md): ip6\_tunnel: clear skb2-\>cb\[\] in ip4ip6\_err() (CVSS 9.8, Linux)
- [CVE-2026-43036](https://cve.now/CVE-2026-43036.md): net: use skb\_header\_pointer() for TCPv4 GSO frag\_off check (no CVSS, Linux)
- [CVE-2026-43035](https://cve.now/CVE-2026-43035.md): net: sched: cls\_api: fix tc\_chain\_fill\_node to initialize tcm\_info to zero to prevent an info-leak (no CVSS, Linux)
- [CVE-2026-43034](https://cve.now/CVE-2026-43034.md): bnxt\_en: set backing store type from query type (no CVSS, Linux)
- [CVE-2026-43033](https://cve.now/CVE-2026-43033.md): crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (CVSS 7.8, Linux)
- [CVE-2026-43032](https://cve.now/CVE-2026-43032.md): NFC: pn533: bound the UART receive buffer (no CVSS, Linux)
- [CVE-2026-43031](https://cve.now/CVE-2026-43031.md): net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets (CVSS 7.5, Linux)
- [CVE-2026-43030](https://cve.now/CVE-2026-43030.md): bpf: Fix regsafe() for pointers to packet (CVSS 7.8, Linux)
- [CVE-2026-43029](https://cve.now/CVE-2026-43029.md): mptcp: fix soft lockup in mptcp\_recvmsg() (CVSS 7.5, Linux)
- [CVE-2026-43028](https://cve.now/CVE-2026-43028.md): netfilter: x\_tables: ensure names are nul-terminated (CVSS 7.1, Linux)
- [CVE-2026-43027](https://cve.now/CVE-2026-43027.md): netfilter: nf\_conntrack\_helper: pass helper to expect cleanup (no CVSS, Linux)
- [CVE-2026-43026](https://cve.now/CVE-2026-43026.md): netfilter: ctnetlink: zero expect NAT fields when CTA\_EXPECT\_NAT absent (no CVSS, Linux)
- [CVE-2026-43025](https://cve.now/CVE-2026-43025.md): netfilter: ctnetlink: ignore explicit helper on new expectations (CVSS 7.3, Linux)
- [CVE-2026-43024](https://cve.now/CVE-2026-43024.md): netfilter: nf\_tables: reject immediate NF\_QUEUE verdict (no CVSS, Linux)
- [CVE-2026-43023](https://cve.now/CVE-2026-43023.md): Bluetooth: SCO: fix race conditions in sco\_sock\_connect() (CVSS 7.8, Linux)
- [CVE-2026-43022](https://cve.now/CVE-2026-43022.md): Bluetooth: hci\_sync: hci\_cmd\_sync\_queue\_once() return -EEXIST if exists (no CVSS, Linux)
- [CVE-2026-43021](https://cve.now/CVE-2026-43021.md): Bluetooth: hci\_sync: fix leaks when hci\_cmd\_sync\_queue\_once fails (no CVSS, Linux)
- [CVE-2026-43020](https://cve.now/CVE-2026-43020.md): Bluetooth: MGMT: validate LTK enc\_size on load (no CVSS, Linux)
- [CVE-2026-43019](https://cve.now/CVE-2026-43019.md): Bluetooth: hci\_conn: fix potential UAF in set\_cig\_params\_sync (CVSS 7.8, Linux)
- [CVE-2026-43018](https://cve.now/CVE-2026-43018.md): Bluetooth: hci\_event: fix potential UAF in hci\_le\_remote\_conn\_param\_req\_evt (CVSS 8.8, Linux)
- [CVE-2026-43017](https://cve.now/CVE-2026-43017.md): Bluetooth: MGMT: validate mesh send advertising payload length (no CVSS, Linux)
- [CVE-2026-43016](https://cve.now/CVE-2026-43016.md): bpf: sockmap: Fix use-after-free of sk-\>sk\_socket in sk\_psock\_verdict\_data\_ready(). (CVSS 7.8, Linux)
- [CVE-2026-43015](https://cve.now/CVE-2026-43015.md): net: macb: fix clk handling on PCI glue driver removal (no CVSS, Linux)
- [CVE-2026-43014](https://cve.now/CVE-2026-43014.md): net: macb: properly unregister fixed rate clocks (no CVSS, Linux)
- [CVE-2026-43013](https://cve.now/CVE-2026-43013.md): net/mlx5: lag: Check for LAG device before creating debugfs (no CVSS, Linux)
- [CVE-2026-43012](https://cve.now/CVE-2026-43012.md): net/mlx5: Fix switchdev mode rollback in case of failure (no CVSS, Linux)
- [CVE-2026-43011](https://cve.now/CVE-2026-43011.md): net/x25: Fix potential double free of skb (CVSS 9.8, Linux)
- [CVE-2026-43010](https://cve.now/CVE-2026-43010.md): bpf: Reject sleepable kprobe\_multi programs at attach time (no CVSS, Linux)
- [CVE-2026-43009](https://cve.now/CVE-2026-43009.md): bpf: Fix incorrect pruning due to atomic fetch precision tracking (CVSS 7.8, Linux)
- [CVE-2026-43008](https://cve.now/CVE-2026-43008.md): gpio: qixis-fpga: Fix error handling for devm\_regmap\_init\_mmio() (no CVSS, Linux)
- [CVE-2026-43007](https://cve.now/CVE-2026-43007.md): accel/qaic: Handle DBC deactivation if the owner went away (no CVSS, Linux)
- [CVE-2026-43006](https://cve.now/CVE-2026-43006.md): io\_uring/rsrc: reject zero-length fixed buffer import (CVSS 7.1, Linux)
- [CVE-2026-43005](https://cve.now/CVE-2026-43005.md): hwmon: (tps53679) Fix array access with zero-length block read (no CVSS, Linux)
- [CVE-2026-43004](https://cve.now/CVE-2026-43004.md): spi: stm32-ospi: Fix resource leak in remove() callback (no CVSS, Linux)
- [CVE-2026-31785](https://cve.now/CVE-2026-31785.md): drm/xe/xe\_pagefault: Disallow writes to read-only VMAs (no CVSS, Linux)
- [CVE-2026-31784](https://cve.now/CVE-2026-31784.md): drm/xe/pxp: Clear restart flag in pxp\_start after jumping back (no CVSS, Linux)
- [CVE-2026-31783](https://cve.now/CVE-2026-31783.md): spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback (no CVSS, Linux)
- [CVE-2026-31782](https://cve.now/CVE-2026-31782.md): perf/x86: Fix potential bad container\_of in intel\_pmu\_hw\_config (CVSS 7.8, Linux)
- [CVE-2026-31781](https://cve.now/CVE-2026-31781.md): drm/ioc32: stop speculation on the drm\_compat\_ioctl path (no CVSS, Linux)
- [CVE-2026-31780](https://cve.now/CVE-2026-31780.md): wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation (CVSS 7.8, Linux)
- [CVE-2026-31779](https://cve.now/CVE-2026-31779.md): wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl\_mvm\_nd\_match\_info\_handler() (CVSS 8.1, Linux)
- [CVE-2026-31778](https://cve.now/CVE-2026-31778.md): ALSA: caiaq: fix stack out-of-bounds read in init\_card (no CVSS, Linux)
- [CVE-2026-31777](https://cve.now/CVE-2026-31777.md): ALSA: ctxfi: Check the error for index mapping (no CVSS, Linux)
- [CVE-2026-31776](https://cve.now/CVE-2026-31776.md): ALSA: ctxfi: Fix missing SPDIFI1 index handling (no CVSS, Linux)
- [CVE-2026-31775](https://cve.now/CVE-2026-31775.md): ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization (no CVSS, Linux)
- [CVE-2026-31774](https://cve.now/CVE-2026-31774.md): io\_uring/net: fix slab-out-of-bounds read in io\_bundle\_nbufs() (CVSS 7.1, Linux)
- [CVE-2026-31773](https://cve.now/CVE-2026-31773.md): Bluetooth: SMP: derive legacy responder STK authentication from MITM state (CVSS 8.8, Linux)
- [CVE-2026-31772](https://cve.now/CVE-2026-31772.md): Bluetooth: hci\_sync: fix stack buffer overflow in hci\_le\_big\_create\_sync (CVSS 7.8, Linux)
- [CVE-2026-31771](https://cve.now/CVE-2026-31771.md): Bluetooth: hci\_event: move wake reason storage into validated event handlers (CVSS 8.1, Linux)
- [CVE-2026-31770](https://cve.now/CVE-2026-31770.md): hwmon: (occ) Fix division by zero in occ\_show\_power\_1() (no CVSS, Linux)
- [CVE-2026-31769](https://cve.now/CVE-2026-31769.md): gpib: fix use-after-free in IO ioctl handlers (CVSS 7.8, Linux)
- [CVE-2026-31768](https://cve.now/CVE-2026-31768.md): iio: adc: ti-adc161s626: use DMA-safe memory for spi\_read() (CVSS 7.8, Linux)
- [CVE-2026-31767](https://cve.now/CVE-2026-31767.md): drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (no CVSS, Linux)
- [CVE-2026-31766](https://cve.now/CVE-2026-31766.md): drm/amdgpu: validate doorbell\_offset in user queue creation (CVSS 7.1, Linux)
- [CVE-2026-31765](https://cve.now/CVE-2026-31765.md): drm/amdgpu: Change AMDGPU\_VA\_RESERVED\_TRAP\_SIZE to 64KB (no CVSS, Linux)
- [CVE-2026-31764](https://cve.now/CVE-2026-31764.md): iio: imu: st\_lsm6dsx: Set buffer sampling frequency for accelerometer only (no CVSS, Linux)
- [CVE-2026-31763](https://cve.now/CVE-2026-31763.md): iio: gyro: mpu3050: Fix incorrect free\_irq() variable (no CVSS, Linux)
- [CVE-2026-31762](https://cve.now/CVE-2026-31762.md): iio: gyro: mpu3050: Fix irq resource leak (no CVSS, Linux)
- [CVE-2026-31761](https://cve.now/CVE-2026-31761.md): iio: gyro: mpu3050: Move iio\_device\_register() to correct location (CVSS 7.8, Linux)
- [CVE-2026-31760](https://cve.now/CVE-2026-31760.md): gpib: lpvo\_usb: fix memory leak on disconnect (no CVSS, Linux)
- [CVE-2026-31759](https://cve.now/CVE-2026-31759.md): usb: ulpi: fix double free in ulpi\_register\_interface() error path (no CVSS, Linux)
- [CVE-2026-31758](https://cve.now/CVE-2026-31758.md): usb: usbtmc: Flush anchored URBs in usbtmc\_release (CVSS 7.8, Linux)
- [CVE-2026-31757](https://cve.now/CVE-2026-31757.md): usb: misc: usbio: Fix URB memory leak on submit failure (no CVSS, Linux)
- [CVE-2026-31756](https://cve.now/CVE-2026-31756.md): usb: dwc2: gadget: Fix spin\_lock/unlock mismatch in dwc2\_hsotg\_udc\_stop() (no CVSS, Linux)
- [CVE-2026-31755](https://cve.now/CVE-2026-31755.md): usb: cdns3: gadget: fix NULL pointer dereference in ep\_queue (no CVSS, Linux)
- [CVE-2026-31754](https://cve.now/CVE-2026-31754.md): usb: cdns3: gadget: fix state inconsistency on gadget init failure (no CVSS, Linux)
- [CVE-2026-31753](https://cve.now/CVE-2026-31753.md): auxdisplay: line-display: fix NULL dereference in linedisp\_release (no CVSS, Linux)
- [CVE-2026-31752](https://cve.now/CVE-2026-31752.md): bridge: br\_nd\_send: validate ND option lengths (no CVSS, Linux)
- [CVE-2026-31751](https://cve.now/CVE-2026-31751.md): comedi: dt2815: add hardware detection to prevent crash (no CVSS, Linux)
- [CVE-2026-31750](https://cve.now/CVE-2026-31750.md): comedi: runflags cannot determine whether to reclaim chanlist (no CVSS, Linux)
- [CVE-2026-31749](https://cve.now/CVE-2026-31749.md): comedi: ni\_atmio16d: Fix invalid clean-up after failed attach (no CVSS, Linux)
- [CVE-2026-31748](https://cve.now/CVE-2026-31748.md): comedi: me\_daq: Fix potential overrun of firmware buffer (no CVSS, Linux)
- [CVE-2026-31747](https://cve.now/CVE-2026-31747.md): comedi: me4000: Fix potential overrun of firmware buffer (no CVSS, Linux)
- [CVE-2026-31746](https://cve.now/CVE-2026-31746.md): s390/zcrypt: Fix memory leak with CCA cards used as accelerator (no CVSS, Linux)
- [CVE-2026-31745](https://cve.now/CVE-2026-31745.md): reset: gpio: fix double free in reset\_add\_gpio\_aux\_device() error path (no CVSS, Linux)
- [CVE-2026-31744](https://cve.now/CVE-2026-31744.md): PM: EM: Fix NULL pointer dereference when perf domain ID is not found (no CVSS, Linux)
- [CVE-2026-31743](https://cve.now/CVE-2026-31743.md): nvmem: zynqmp\_nvmem: Fix buffer size in DMA and memcpy (CVSS 7.8, Linux)
- [CVE-2026-31742](https://cve.now/CVE-2026-31742.md): vt: discard stale unicode buffer on alt screen exit after resize (CVSS 7.8, Linux)
- [CVE-2026-31741](https://cve.now/CVE-2026-31741.md): counter: rz-mtu3-cnt: prevent counter from being toggled multiple times (no CVSS, Linux)
- [CVE-2026-31740](https://cve.now/CVE-2026-31740.md): counter: rz-mtu3-cnt: do not use struct rz\_mtu3\_channel's dev member (no CVSS, Linux)
- [CVE-2026-31739](https://cve.now/CVE-2026-31739.md): crypto: tegra - Add missing CRYPTO\_ALG\_ASYNC (CVSS 8.8, Linux)
- [CVE-2026-31738](https://cve.now/CVE-2026-31738.md): vxlan: validate ND option lengths in vxlan\_na\_create (no CVSS, Linux)
- [CVE-2026-31737](https://cve.now/CVE-2026-31737.md): net: ftgmac100: fix ring allocation unwind on open failure (no CVSS, Linux)
- [CVE-2026-31736](https://cve.now/CVE-2026-31736.md): net: ethernet: mtk\_ppe: avoid NULL deref when gmac0 is disabled (no CVSS, Linux)
- [CVE-2026-31735](https://cve.now/CVE-2026-31735.md): iommupt: Fix short gather if the unmap goes into a large mapping (CVSS 8.8, Linux)
- [CVE-2026-31734](https://cve.now/CVE-2026-31734.md): sched\_ext: Fix is\_bpf\_migration\_disabled() false negative on non-PREEMPT\_RCU (no CVSS, Linux)
- [CVE-2026-31733](https://cve.now/CVE-2026-31733.md): sched\_ext: Fix stale direct dispatch state in ddsp\_dsq\_id (no CVSS, Linux)
- [CVE-2026-31732](https://cve.now/CVE-2026-31732.md): gpio: Fix resource leaks on errors in gpiochip\_add\_data\_with\_key() (no CVSS, Linux)
- [CVE-2026-31731](https://cve.now/CVE-2026-31731.md): thermal: core: Address thermal zone removal races with resume (CVSS 7.8, Linux)
- [CVE-2026-31730](https://cve.now/CVE-2026-31730.md): misc: fastrpc: possible double-free of cctx-\>remote\_heap (CVSS 7.8, Linux)
- [CVE-2026-31729](https://cve.now/CVE-2026-31729.md): usb: typec: ucsi: validate connector number in ucsi\_notify\_common() (no CVSS, Linux)
- [CVE-2026-31728](https://cve.now/CVE-2026-31728.md): usb: gadget: u\_ether: Fix race between gether\_disconnect and eth\_stop (no CVSS, Linux)
- [CVE-2026-31727](https://cve.now/CVE-2026-31727.md): usb: gadget: u\_ether: Fix NULL pointer deref in eth\_get\_drvinfo (no CVSS, Linux)
- [CVE-2026-31726](https://cve.now/CVE-2026-31726.md): usb: gadget: uvc: fix NULL pointer dereference during unbind race (no CVSS, Linux)
- [CVE-2026-31725](https://cve.now/CVE-2026-31725.md): usb: gadget: f\_ecm: Fix net\_device lifecycle with device\_move (no CVSS, Linux)
- [CVE-2026-31724](https://cve.now/CVE-2026-31724.md): usb: gadget: f\_eem: Fix net\_device lifecycle with device\_move (no CVSS, Linux)
- [CVE-2026-31723](https://cve.now/CVE-2026-31723.md): usb: gadget: f\_subset: Fix net\_device lifecycle with device\_move (no CVSS, Linux)
- [CVE-2026-31722](https://cve.now/CVE-2026-31722.md): usb: gadget: f\_rndis: Fix net\_device lifecycle with device\_move (no CVSS, Linux)
- [CVE-2026-31721](https://cve.now/CVE-2026-31721.md): usb: gadget: f\_hid: move list and spinlock inits from bind to alloc (no CVSS, Linux)
- [CVE-2026-31720](https://cve.now/CVE-2026-31720.md): usb: gadget: f\_uac1\_legacy: validate control request size (no CVSS, Linux)
- [CVE-2026-31719](https://cve.now/CVE-2026-31719.md): crypto: krb5enc - fix async decrypt skipping hash verification (CVSS 7.5, Linux)
- [CVE-2026-31718](https://cve.now/CVE-2026-31718.md): ksmbd: fix use-after-free in \_\_ksmbd\_close\_fd() via durable scavenger (CVSS 9.8, Linux)
- [CVE-2026-31717](https://cve.now/CVE-2026-31717.md): ksmbd: validate owner of durable handle on reconnect (CVSS 8.8, Linux)
- [CVE-2026-31716](https://cve.now/CVE-2026-31716.md): fs/ntfs3: validate rec-\>used in journal-replay file record check (CVSS 7.8, Linux)
- [CVE-2026-31715](https://cve.now/CVE-2026-31715.md): f2fs: fix UAF caused by decrementing sbi-\>nr\_pages\[\] in f2fs\_write\_end\_io() (no CVSS, Linux)
- [CVE-2026-31714](https://cve.now/CVE-2026-31714.md): f2fs: fix to avoid memory leak in f2fs\_rename() (no CVSS, Linux)
- [CVE-2026-31713](https://cve.now/CVE-2026-31713.md): fuse: abort on fatal signal during sync init (no CVSS, Linux)
- [CVE-2026-31712](https://cve.now/CVE-2026-31712.md): ksmbd: require minimum ACE size in smb\_check\_perm\_dacl() (CVSS 8.3, Linux)
- [CVE-2026-31711](https://cve.now/CVE-2026-31711.md): smb: server: fix active\_num\_conn leak on transport allocation failure (CVSS 7.5, Linux)
- [CVE-2026-31710](https://cve.now/CVE-2026-31710.md): smb: client: fix dir separator in SMB1 UNIX mounts (no CVSS, Linux)
- [CVE-2026-31709](https://cve.now/CVE-2026-31709.md): smb: client: validate the whole DACL before rewriting it in cifsacl (CVSS 8.8, Linux)
- [CVE-2026-31708](https://cve.now/CVE-2026-31708.md): smb: client: fix OOB read in smb2\_ioctl\_query\_info QUERY\_INFO path (CVSS 8.1, Linux)
- [CVE-2026-31707](https://cve.now/CVE-2026-31707.md): ksmbd: validate response sizes in ipc\_validate\_msg() (CVSS 7.1, Linux)
- [CVE-2026-31706](https://cve.now/CVE-2026-31706.md): ksmbd: validate num\_aces and harden ACE walk in smb\_inherit\_dacl() (CVSS 8.8, Linux)
- [CVE-2026-31705](https://cve.now/CVE-2026-31705.md): ksmbd: fix out-of-bounds write in smb2\_get\_ea() EA alignment (CVSS 9.8, Linux)
- [CVE-2026-31704](https://cve.now/CVE-2026-31704.md): ksmbd: use check\_add\_overflow() to prevent u16 DACL size overflow (no CVSS, Linux)
- [CVE-2026-31703](https://cve.now/CVE-2026-31703.md): writeback: Fix use after free in inode\_switch\_wbs\_work\_fn() (CVSS 7.8, Linux)
- [CVE-2026-31702](https://cve.now/CVE-2026-31702.md): f2fs: fix use-after-free of sbi in f2fs\_compress\_write\_end\_io() (no CVSS, Linux)
- [CVE-2026-31701](https://cve.now/CVE-2026-31701.md): ALSA: caiaq: take a reference on the USB device in create\_card() (no CVSS, Linux)
- [CVE-2026-31700](https://cve.now/CVE-2026-31700.md): net/packet: fix TOCTOU race on mmap'd vnet\_hdr in tpacket\_snd() (CVSS 7.8, Linux)
- [CVE-2026-31699](https://cve.now/CVE-2026-31699.md): crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (CVSS 7.1, Linux)
- [CVE-2026-31698](https://cve.now/CVE-2026-31698.md): crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (CVSS 7.1, Linux)
- [CVE-2026-31697](https://cve.now/CVE-2026-31697.md): crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (CVSS 7.1, Linux)
- [CVE-2026-31696](https://cve.now/CVE-2026-31696.md): rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (no CVSS, Linux)
- [CVE-2026-31695](https://cve.now/CVE-2026-31695.md): wifi: virt\_wifi: remove SET\_NETDEV\_DEV to avoid use-after-free (CVSS 7.8, Linux)
- [CVE-2026-31694](https://cve.now/CVE-2026-31694.md): fuse: reject oversized dirents in page cache (CVSS 7.8, Linux)
- [CVE-2026-7582](https://cve.now/CVE-2026-7582.md): AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write (CVSS 4.8, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-3143](https://cve.now/CVE-2026-3143.md): Total Upkeep \<= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation (CVSS 5.3, Total Upkeep – WordPress Backup Plugin plus Restore & Migra…)
- [CVE-2026-7581](https://cve.now/CVE-2026-7581.md): alexta69 MeTube CORS Policy main.py on\_prepare cross-domain policy (CVSS 5.3, alexta69 MeTube)
- [CVE-2026-7580](https://cve.now/CVE-2026-7580.md): Exiftool JPEG/QuickTime/MOV/MP4 GM.pm Process\_mrld code injection (CVSS 4.8, Exiftool)
- [CVE-2026-7579](https://cve.now/CVE-2026-7579.md): AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials (CVSS 6.9, AstrBotDevs AstrBot · astrbot)
- [CVE-2026-3140](https://cve.now/CVE-2026-3140.md): Ultimate Dashboard \<= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation (CVSS 4.3, davidvongries Ultimate Dashboard – Custom WordPress Dashboa…)
- [CVE-2026-3772](https://cve.now/CVE-2026-3772.md): WP Editor \<= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor (CVSS 8.8, benjaminprojas WP Editor)
- [CVE-2026-7578](https://cve.now/CVE-2026-7578.md): MacCMS Pro Plugin Installation add.html install unrestricted upload (CVSS 5.1, MacCMS Pro)
- [CVE-2026-42778](https://cve.now/CVE-2026-42778.md): Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2) (CVSS 9.8, Apache Software Foundation Apache MINA · org.apache.mina:mi…)
- [CVE-2026-42779](https://cve.now/CVE-2026-42779.md): Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2) (CVSS 9.8, Apache Software Foundation Apache MINA · org.apache.mina:mi…)
- [CVE-2026-42404](https://cve.now/CVE-2026-42404.md): Apache Neethi: Unrestricted HTTP Redirect Following in Policy References (CVSS 6.5, Apache Software Foundation Apache Neethi · org.apache.neeth…)
- [CVE-2026-7567](https://cve.now/CVE-2026-7567.md): Temporary Login \<= 1.0.0 - Authentication Bypass to Account Takeover (CVSS 9.8, elemntor Temporary Login)
- [CVE-2026-42402](https://cve.now/CVE-2026-42402.md): Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS (CVSS 7.5, Apache Software Foundation Apache Neethi · org.apache.neeth…)
- [CVE-2026-42403](https://cve.now/CVE-2026-42403.md): Apache Neethi: Circular Policy Reference Infinite Loop (CVSS 7.5, Apache Software Foundation Apache Neethi · org.apache.neeth…)
- [CVE-2026-40201](https://cve.now/CVE-2026-40201.md): @diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file. (CVSS 5.4, diplodoc-platform @diplodoc/search-extension · @diplodoc/se…)
- [CVE-2026-7584](https://cve.now/CVE-2026-7584.md): Arbitrary Code Execution via Unsafe Deserialization in LabOne Q (CVSS 7.8, Zurich Instruments LabOne Q)
- [CVE-2026-42996](https://cve.now/CVE-2026-42996.md): JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed b (CVSS 10.0, JS8Call · JS8Call-improved)
- [CVE-2026-7555](https://cve.now/CVE-2026-7555.md): itsourcecode Electronic Judging System login.php sql injection (CVSS 6.9, itsourcecode Electronic Judging System)
- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1, sebet Go Fetch Jobs · 5starplugins Dynamic Copyright Y… +129)
- [CVE-2026-6127](https://cve.now/CVE-2026-6127.md): Elementor Website Builder \<= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API (CVSS 6.4, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2026-7554](https://cve.now/CVE-2026-7554.md): D-Link M60 httpd password recovery (CVSS 6.3, D-Link M60)
- [CVE-2026-42994](https://cve.now/CVE-2026-42994.md): Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. (CVSS 8.8, Bitwarden CLI)
- [CVE-2026-7553](https://cve.now/CVE-2026-7553.md): code-projects Gym Management System edit\_exercises.php sql injection (CVSS 5.1, code-projects Gym Management System)
- [CVE-2026-7550](https://cve.now/CVE-2026-7550.md): SourceCodester Pharmacy Sales and Inventory System ajax.php save\_customer sql injection (CVSS 6.9, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-7549](https://cve.now/CVE-2026-7549.md): SourceCodester Pharmacy Sales and Inventory System ajax.php delete\_customer sql injection (CVSS 6.9, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-7548](https://cve.now/CVE-2026-7548.md): Totolink NR1800X cstecgi.cgi sub\_41A68C command injection (CVSS 8.7, Totolink NR1800X)
- [CVE-2026-7546](https://cve.now/CVE-2026-7546.md): Totolink NR1800X lighttpd find\_host\_ip stack-based overflow (CVSS 9.3, Totolink NR1800X)
- [CVE-2026-7545](https://cve.now/CVE-2026-7545.md): SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection (CVSS 6.9, SourceCodester Advanced School Management System)
- [CVE-2026-7538](https://cve.now/CVE-2026-7538.md): Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-7536](https://cve.now/CVE-2026-7536.md): Open5GS BSF pcfBindings bsf\_sess\_add\_by\_ip\_address denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-7535](https://cve.now/CVE-2026-7535.md): Open5GS transfer-update denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-7519](https://cve.now/CVE-2026-7519.md): Fujian Apex LiveBOS Endpoint UploadImage.do path traversal (CVSS 6.9, Fujian Apex LiveBOS)
- [CVE-2026-7518](https://cve.now/CVE-2026-7518.md): Open5GS AMF SBI Endpoint sdmsubscription-notify amf\_namf\_callback\_handle\_sdm\_data\_change\_notify denial of service (CVSS 5.3, Open5GS)
- [CVE-2025-52347](https://cve.now/CVE-2025-52347.md): An issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Bu (CVSS 7.8)
- [CVE-2025-63547](https://cve.now/CVE-2025-63547.md): An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU leng (CVSS 7.5)
- [CVE-2025-63548](https://cve.now/CVE-2025-63548.md): An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a packet specially crafted to be (CVSS 7.5)
- [CVE-2025-69606](https://cve.now/CVE-2025-69606.md): Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. (CVSS 6.1)
- [CVE-2026-26461](https://cve.now/CVE-2026-26461.md): A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execut (CVSS 6.5)
- [CVE-2026-30363](https://cve.now/CVE-2026-30363.md): flipperzero-firmware commit ad2a80 was discovered to contain a stack overflow in the "Main" function. (CVSS 8.4)
- [CVE-2026-37457](https://cve.now/CVE-2026-37457.md): An off-by-one out-of-bounds write vulnerability in the bgp\_flowspec\_op\_decode() function (bgpd/bgp\_flowspec\_util.c) of FRRouting (FRR) stabl (CVSS 7.5)
- [CVE-2026-37503](https://cve.now/CVE-2026-37503.md): Cross-Site Scripting (XSS) in V2Board thru 1.7.4. (CVSS 6.9)
- [CVE-2026-37504](https://cve.now/CVE-2026-37504.md): Sensitive server\_token exposed via GET parameter in V2Board thru 1.7.4. (CVSS 5.3)
- [CVE-2026-37505](https://cve.now/CVE-2026-37505.md): SQL Injection via ORDER BY clause in V2Board thru 1.7.4. (CVSS 4.9)
- [CVE-2026-37525](https://cve.now/CVE-2026-37525.md): AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. (CVSS 7.8)
- [CVE-2026-37526](https://cve.now/CVE-2026-37526.md): AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose (CVSS 7.8)
- [CVE-2026-37530](https://cve.now/CVE-2026-37530.md): AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. (CVSS 7.5)
- [CVE-2026-37531](https://cve.now/CVE-2026-37531.md): AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367 (CVSS 9.8)
- [CVE-2026-37532](https://cve.now/CVE-2026-37532.md): AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. (CVSS 7.1)
- [CVE-2026-37534](https://cve.now/CVE-2026-37534.md): Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE\_J1939\_Read\_Transp (CVSS 9.8)
- [CVE-2026-37535](https://cve.now/CVE-2026-37535.md): openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame r (CVSS 7.1)
- [CVE-2026-37536](https://cve.now/CVE-2026-37536.md): miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send\_diagnostic\_request. (CVSS 8.8)
- [CVE-2026-37537](https://cve.now/CVE-2026-37537.md): collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bo (CVSS 8.1)
- [CVE-2026-37538](https://cve.now/CVE-2026-37538.md): Buffer overflow vulnerability in socketcand 0.4.2 in file socketcand.c in function main allows attackers to cause a denial of service or oth (CVSS 7.5)
- [CVE-2026-37539](https://cve.now/CVE-2026-37539.md): Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function (CVSS 9.8)
- [CVE-2026-37540](https://cve.now/CVE-2026-37540.md): OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. (CVSS 8.4)
- [CVE-2026-37541](https://cve.now/CVE-2026-37541.md): Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. (CVSS 10.0)
- [CVE-2026-37552](https://cve.now/CVE-2026-37552.md): Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. (CVSS 8.4)
- [CVE-2026-37554](https://cve.now/CVE-2026-37554.md): An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. (CVSS 7.5)
- [CVE-2026-42467](https://cve.now/CVE-2026-42467.md): An issue was discovered in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE\_J1939\_Read\_Binary\_Data\_Tr (CVSS 7.5)
- [CVE-2026-42468](https://cve.now/CVE-2026-42468.md): Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. (CVSS 8.8)
- [CVE-2026-42469](https://cve.now/CVE-2026-42469.md): Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. (CVSS 8.6)
- [CVE-2026-42471](https://cve.now/CVE-2026-42471.md): Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. (CVSS 8.1)
- [CVE-2026-42472](https://cve.now/CVE-2026-42472.md): Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. (CVSS 9.8)
- [CVE-2026-42473](https://cve.now/CVE-2026-42473.md): Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. (CVSS 9.8)
- [CVE-2026-42474](https://cve.now/CVE-2026-42474.md): SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted \`data\` array to the data function in BuildHelper.php. (CVSS 6.5, mix/mix)
- [CVE-2026-42475](https://cve.now/CVE-2026-42475.md): SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted \`on\` array to the joinOn function in BuildHelper.php. (CVSS 6.5, mix/mix)
- [CVE-2026-42476](https://cve.now/CVE-2026-42476.md): Two heap-based out-of-bounds read vulnerabilities in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8\_0\_0\_rc5 exist in RWStl\_R (CVSS 5.5)
- [CVE-2026-42477](https://cve.now/CVE-2026-42477.md): A heap-based out-of-bounds read vulnerability in RWObj\_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) V8\_0\_0\_rc5 allo (CVSS 5.5)
- [CVE-2026-42478](https://cve.now/CVE-2026-42478.md): An issue was discovered in VrmlData\_IndexedFaceSet::TShape in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8\_0\_0\_rc5 allows attac (CVSS 5.5)
- [CVE-2026-42479](https://cve.now/CVE-2026-42479.md): An out-of-bounds read vulnerability in VrmlData\_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V8\_0\_0\_rc5 allow (CVSS 5.5)
- [CVE-2026-42480](https://cve.now/CVE-2026-42480.md): A stack-based out-of-bounds read vulnerability in VrmlData\_Scene::ReadLine in the VRML parser in Open CASCADE Technology (OCCT) V8\_0\_0\_rc5 a (CVSS 5.5)
- [CVE-2026-42481](https://cve.now/CVE-2026-42481.md): Open CASCADE Technology (OCCT) V8\_0\_0\_rc5 contains multiple vulnerabilities in its IGES and STEP file parsers that can be triggered by craft (CVSS 5.5)
- [CVE-2026-42482](https://cve.now/CVE-2026-42482.md): A stack-based buffer overflow in mangle\_to\_hex\_lower() and mangle\_to\_hex\_upper() in src/rp\_cpu.c in hashcat v7.1.2 allows an attacker to cau (CVSS 7.5)
- [CVE-2026-42483](https://cve.now/CVE-2026-42483.md): A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execu (CVSS 7.3)
- [CVE-2026-42484](https://cve.now/CVE-2026-42484.md): A heap-based buffer overflow in hex\_to\_binary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or (CVSS 9.8)
- [CVE-2026-42485](https://cve.now/CVE-2026-42485.md): AGL agl-service-can-low-level contains a stack buffer overflow in the uds-c library. (CVSS 7.5)
- [CVE-2026-43001](https://cve.now/CVE-2026-43001.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 7.9, OpenStack Keystone · keystone)
- [CVE-2026-43003](https://cve.now/CVE-2026-43003.md): An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. (CVSS 8.0, OpenStack ironic-python-agent · ironic-python-agent)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.