# CVEs published 2026-05-03

44 CVEs were published on May 3, 2026: 0 critical, 5 high. Days are UTC.

- [CVE-2026-6948](https://cve.now/CVE-2026-6948.md): Unbounded Memory Allocation in VQLResponse Result-Set Writer (CVSS 4.9, Rapid7 Velociraptor)
- [CVE-2026-7712](https://cve.now/CVE-2026-7712.md): MindsDB Pickle pickle.loads deserialization (CVSS 5.3, MindsDB)
- [CVE-2026-7711](https://cve.now/CVE-2026-7711.md): MindsDB Engine proc\_wrapper.py exec unrestricted upload (CVSS 6.9, MindsDB)
- [CVE-2026-7710](https://cve.now/CVE-2026-7710.md): YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication (CVSS 6.9, YunaiV yudao-cloud)
- [CVE-2026-7709](https://cve.now/CVE-2026-7709.md): janeczku Calibre-Web Endpoint kobo\_auth.py generate\_auth\_token improper authorization (CVSS 5.3, janeczku Calibre-Web)
- [CVE-2026-7708](https://cve.now/CVE-2026-7708.md): Open5GS UDR subscription.c ogs\_dbi\_subscription\_data denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-7707](https://cve.now/CVE-2026-7707.md): Open5GS UDR nudr-handler.c udr\_nudr\_dr\_handle\_subscription\_context denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-7706](https://cve.now/CVE-2026-7706.md): Open5GS AMF gmm-handler.c gmm\_handle\_service\_request denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-7705](https://cve.now/CVE-2026-7705.md): JD Cloud JDCOS Service jdcap set\_iptv\_info command injection (CVSS 5.3, JD Cloud JDCOS)
- [CVE-2026-7704](https://cve.now/CVE-2026-7704.md): AV Stumpfl Pixera Two Media Server Service Port 1338 path traversal (CVSS 5.3, AV Stumpfl Pixera Two Media Server)
- [CVE-2026-7703](https://cve.now/CVE-2026-7703.md): AV Stumpfl Pixera Two Media Server Websocket API code injection (CVSS 6.9, AV Stumpfl Pixera Two Media Server)
- [CVE-2026-7702](https://cve.now/CVE-2026-7702.md): toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization (CVSS 6.9, toeverything AFFiNE)
- [CVE-2026-7701](https://cve.now/CVE-2026-7701.md): Telegram Desktop Bot API url\_auth\_box.cpp RequestButton null pointer dereference (CVSS 5.3, Telegram Desktop)
- [CVE-2026-7700](https://cve.now/CVE-2026-7700.md): langflow-ai langflow LambdaFilterComponent lambda\_filter.py eval code injection (CVSS 5.3, langflow-ai langflow · langflow)
- [CVE-2026-7699](https://cve.now/CVE-2026-7699.md): Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection (CVSS 5.3, Dromara MaxKey)
- [CVE-2026-7698](https://cve.now/CVE-2026-7698.md): Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection (CVSS 6.9, Tiandy Easy7 Integrated Management Platform)
- [CVE-2026-7697](https://cve.now/CVE-2026-7697.md): AMTT Hotel Broadband Operation System cardhand\_submit.php sql injection (CVSS 5.1, AMTT Hotel Broadband Operation System)
- [CVE-2026-7696](https://cve.now/CVE-2026-7696.md): Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted upload (CVSS 5.3, Acrel Electrical EEMS Enterprise Power Operation and Mainte…)
- [CVE-2026-7695](https://cve.now/CVE-2026-7695.md): Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform elecMaxMinAvgValue sql injection (CVSS 6.9, Acrel Electrical EEMS Enterprise Power Operation and Mainte…)
- [CVE-2026-7694](https://cve.now/CVE-2026-7694.md): Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injection (CVSS 6.9, Acrel Electrical ECEMS Enterprise Microgrid Energy Efficien…)
- [CVE-2026-7692](https://cve.now/CVE-2026-7692.md): Wavlink WL-WN570HA1 adm.cgi ping\_ddns command injection (CVSS 5.3, Wavlink WL-WN570HA1)
- [CVE-2026-7691](https://cve.now/CVE-2026-7691.md): Wavlink WL-WN570HA1 adm.cgi set\_sys\_cmd command injection (CVSS 5.3, Wavlink WL-WN570HA1)
- [CVE-2026-7690](https://cve.now/CVE-2026-7690.md): Wavlink WL-WN570HA1 adm.cgi set\_sys\_adm command injection (CVSS 5.3, Wavlink WL-WN570HA1)
- [CVE-2026-7689](https://cve.now/CVE-2026-7689.md): Dolibarr ERP CRM Online Signature security.lib.php dol\_verifyHash signature verification (CVSS 6.3, Dolibarr ERP CRM · dolibarr/dolibarr)
- [CVE-2026-7688](https://cve.now/CVE-2026-7688.md): Dolibarr ERP CRM Shipments API Endpoint expedition.class.php \_checkValForAPI sql injection (CVSS 2.3, Dolibarr ERP CRM · dolibarr/dolibarr)
- [CVE-2026-7687](https://cve.now/CVE-2026-7687.md): langflow-ai langflow Full Builtins code\_parser.py CodeParser.parse\_callable\_details command injection (CVSS 5.3, langflow-ai langflow)
- [CVE-2026-7686](https://cve.now/CVE-2026-7686.md): eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control (CVSS 6.9, eyeo Adblock Plus)
- [CVE-2026-7685](https://cve.now/CVE-2026-7685.md): Edimax BR-6208AC setWAN buffer overflow (CVSS 8.7, Edimax BR-6208AC)
- [CVE-2026-7684](https://cve.now/CVE-2026-7684.md): Edimax BR-6428nC setWAN buffer overflow (CVSS 8.7, Edimax BR-6428nC)
- [CVE-2026-7683](https://cve.now/CVE-2026-7683.md): Edimax BR-6428nC Web setWAN command injection (CVSS 5.3, Edimax BR-6428nC)
- [CVE-2026-7682](https://cve.now/CVE-2026-7682.md): Edimax BR-6208AC L2TP Mode setWAN command injection (CVSS 5.3, Edimax BR-6208AC)
- [CVE-2026-5337](https://cve.now/CVE-2026-5337.md): Frontend File Manager Plugin \<= 23.6 - Subscriber+ Arbitrary Download Access via IDOR (CVSS 6.5, Frontend File Manager Plugin)
- [CVE-2026-7681](https://cve.now/CVE-2026-7681.md): jsbroks COCO Annotator Dataset API datasets.py authorization (CVSS 6.9, jsbroks COCO Annotator)
- [CVE-2026-7680](https://cve.now/CVE-2026-7680.md): jsbroks COCO Annotator Data Endpoint datasets.py path traversal (CVSS 5.3, jsbroks COCO Annotator)
- [CVE-2026-5063](https://cve.now/CVE-2026-5063.md): NEX-Forms \<= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names (CVSS 7.2, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-7679](https://cve.now/CVE-2026-7679.md): YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication (CVSS 6.9, YunaiV yudao-cloud)
- [CVE-2026-7678](https://cve.now/CVE-2026-7678.md): YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection (CVSS 5.3, YunaiV yudao-cloud)
- [CVE-2026-7677](https://cve.now/CVE-2026-7677.md): kerwincui FastBee System Notice SysNoticeController.java add cross site scripting (CVSS 5.1, kerwincui FastBee)
- [CVE-2026-7676](https://cve.now/CVE-2026-7676.md): kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal (CVSS 5.3, kerwincui FastBee)
- [CVE-2026-7675](https://cve.now/CVE-2026-7675.md): Shenzhen Libituo Technology LBT-T300-HW1 apply.cgi start\_lan buffer overflow (CVSS 8.7, Shenzhen Libituo Technology LBT-T300-HW1)
- [CVE-2026-7674](https://cve.now/CVE-2026-7674.md): Shenzhen Libituo Technology LBT-T300-HW1 Web Management start\_single\_service buffer overflow (CVSS 8.7, Shenzhen Libituo Technology LBT-T300-HW1)
- [CVE-2026-7673](https://cve.now/CVE-2026-7673.md): crmeb\_java Admin Upload UploadServiceImpl.java unrestricted upload (CVSS 5.1, crmeb\_java)
- [CVE-2026-40561](https://cve.now/CVE-2026-40561.md): Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence (CVSS 5.3, KAZUHO Starlet)
- [CVE-2026-7672](https://cve.now/CVE-2026-7672.md): youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection (CVSS 5.3, youlaitech youlai-boot)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.