CVEs published May 4, 2026
188 CVEs were published on May 4, 2026: 43 critical, 51 high.
- Published
- 188
- Critical
- 43
- High
- 51
- Medium
- 85
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 90
Most affected products
- n8n-io n8n · n8n
- 12
- Qualcomm Snapdragon
- 10
- Apache Software Foundation Apache HTTP Server
- 9
- GeoVision GV-LPC2011/LPC2211
- 6
- mutt
- 6
- Shenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…
- 6
- CodeAstro Online Classroom
- 5
- MediaTek chipset
- 5
- OpenC3 cosmos · openc3
- 5
- patriksimek vm2 · vm2
- 5
Critical 43
- CVE-2026-42238Unauthenticated Remote Code Execution via Backup Restore in nginx-ui0xJacky nginx-ui · github.com/0xJacky/nginx-ui
- CVE-2026-41926WDR201A WiFi Extender OS Command Injection via firewall.cgiShenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…
- CVE-2026-41925WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time)Shenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…
- CVE-2026-41924WDR201A WiFi Extender OS Command Injection via makeRequest.cgiShenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…
- CVE-2026-41923WDR201A WiFi Extender OS Command Injection via internet.cgiShenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…
- CVE-2026-41922WDR201A WiFi Extender OS Command Injection via wireless.cgiShenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…
- CVE-2026-42232n8n: XML Node Prototype Pollution to RCEn8n-io n8n · n8n
- CVE-2026-42231n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCEn8n-io n8n · n8n
- CVE-2026-41571Note Mark: OIDC-registered users authenticated by submitting password "null"enchant97 note-mark · github.com/enchant97/note-mark/backend
- CVE-2026-42088OpenC3 COSMOS: Administrative Actions via the Script Runner ToolOpenC3 cosmos · openc3
- CVE-2026-42796Arelle < 2.39.10 Unauthenticated RCE via /rest/configureArelle
- CVE-2026-42087OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data BaseOpenC3 cosmos · openc3
- CVE-2026-40682Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistorApache Software Foundation Apache OpenNLP · org.apache.open…
- CVE-2026-42076Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code ExecutionEvoMap evolver · @evomap/evolver
- CVE-2026-42810Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table namesApache Software Foundation Apache Polaris · org.apache.pola…
- CVE-2026-25293Incorrect authorization in PLC FWQualcomm Snapdragon
- CVE-2026-42027Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderApache Software Foundation Apache OpenNLP · org.apache.open…
- CVE-2026-42090Notesnook: RCE via stored XSS in note export renderingstreetwriters notesnook
- CVE-2026-26956vm2: WASM Sandbox Escape (Node 25 only)patriksimek vm2 · vm2
- CVE-2026-42811Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditionsApache Software Foundation Apache Polaris · org.apache.pola…
- CVE-2026-26332vm2: Sandbox Escapepatriksimek vm2 · vm2
- CVE-2026-24781vm2: Sandbox Breakout Through Inspectpatriksimek vm2 · vm2
- CVE-2026-24120vm2: Sandbox Breakout Through Promise Speciespatriksimek vm2 · vm2
- CVE-2026-24118VM2 Sandbox Breakout Through __lookupGetter__patriksimek vm2 · vm2
- CVE-2026-42809Apache Polaris: staged table creation could vend storage credentials for unvalidated locationsApache Software Foundation Apache Polaris · org.apache.pola…
- CVE-2026-42812Apache Polaris: No protection on `write.metadata.path`Apache Software Foundation Apache Polaris · org.apache.pola…
- CVE-2026-42376D-Link DIR-456U A1 Hardcoded Telnet Backdoor CredentialsD-Link DIR-456U Firmware
- CVE-2026-42375D-Link DIR-600L A1 Hardcoded Telnet Backdoor CredentialsD-Link DIR-600L Firmware
- CVE-2026-42374D-Link DIR-600L B1 Hardcoded Telnet Backdoor CredentialsD-Link DIR-600L Firmware
- CVE-2026-42373D-Link DIR-605L B2 Hardcoded Telnet Backdoor CredentialsD-Link DIR-605L Firmware
- CVE-2025-13605Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway3onedata GW1101-1D(RS-485)-TB-P
- CVE-2026-7482Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackersollama · github.com/ollama/ollama
- CVE-2026-7747Totolink N300RH Parameter cstecgi.cgi loginauth buffer overflowTotolink N300RH
- CVE-2025-14320XSS in Tegsoft's Online Support ApplicationTegsoft Management and Information Services Trade Limited C…
- CVE-2026-29200A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1.WebPros Comet Backup
- CVE-2026-7719Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflowTotolink WA300
- CVE-2026-42370GeoVision GV-VMS V20 WebCam Server Login stack overflow vulnerabilityGeoVision GV-VMS
- CVE-2026-7372GeoVision GV-VMS V20 WebCam Server Login stack overflow vulnerabilityGeoVision GV-VMS
- CVE-2026-42369GeoVision GV-VMS V20 WebCam Server stack overflow vulnerabilityGeoVision GV-VMS
- CVE-2026-42368GeoVision LPC2011/LPC2211 Web Interface privilege escalation vulnerabilityGeoVision GV-LPC2011/LPC2211
- CVE-2026-42364GeoVision LPC2011/LPC2211 Web Interface / DdnsSetting.cgi OS command injection vulnerabilityGeoVision GV-LPC2011/LPC2211
- CVE-2026-7161GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerabilityGeoVision GV-IP Device Utility
- CVE-2025-70067Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer.
High 51
- CVE-2026-7791Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight AgentAmazon Workspaces
- CVE-2026-7776Boundary Workers Vulnerable to Denial of Service During TLS HandshakeHashiCorp Boundary · github.com/hashicorp/boundary
- CVE-2026-42222nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover0xJacky nginx-ui · github.com/0xJacky/nginx-ui
- CVE-2026-42221nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-6321fast-uri vulnerable to path traversal via percent-encoded dot segmentsfast-uri
- CVE-2026-41927WDR201A WiFi Extender Stack-Based Buffer Overflow via firewall.cgiShenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…
- CVE-2026-7768@fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth@fastify/accepts-serializer
- CVE-2026-42236n8n: Unauthenticated Denial of Service via MCP Client Registrationn8n-io n8n · n8n
- CVE-2026-42235n8n: XSS via MCP OAuth clientn8n-io n8n · n8n
- CVE-2026-42234n8n: Python Task Runner Sandbox Escapen8n-io n8n · n8n
- CVE-2026-25863Conditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource ConsumptionJules Colle Conditional Fields for Contact Form
- CVE-2026-42226n8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replayn8n-io n8n · n8n
- CVE-2026-42154Prometheus: remote read endpoint allows denial of service via crafted snappy payloadprometheus · github.com/prometheus/prometheus +1
- CVE-2026-42151Prometheus Azure AD remote write OAuth client secret exposed via config APIprometheus · github.com/prometheus/prometheus
- CVE-2026-29004BusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERSvda-linux busybox_mirror
- CVE-2026-0073In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code.Google Android
- CVE-2026-41471Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code EndpointScott Paterson easy-paypal-events-tickets
- CVE-2026-32834Easy PayPal Events & Tickets < 1.4 Authentication Bypass via QR Code ScanningScott Paterson easy-paypal-events-tickets
- CVE-2026-42084OpenC3 COSMOS: Hijacked session token can be used to reset password for persistenceOpenC3 cosmos · openc3
- CVE-2026-42079PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scopeicip-cas PPTAgent · pptagent
- CVE-2026-42075Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File WriteEvoMap evolver · @evomap/evolver
- CVE-2026-24082Use After Free in Automotive GPUQualcomm Snapdragon
- CVE-2025-47408Untrusted Pointer Dereference in Power Optimization FirmwareQualcomm Snapdragon
- CVE-2025-47407Time-of-check Time-of-use (TOCTOU) Race Condition in DSP ServiceQualcomm Snapdragon
- CVE-2025-47405Untrusted Pointer Dereference in CameraQualcomm Snapdragon
- CVE-2026-42440Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderApache Software Foundation Apache OpenNLP · org.apache.open…
- CVE-2026-29514NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixinnetbox-community netbox
- CVE-2026-42372D-Link DIR-605L A1 Hardcoded Telnet Backdoor CredentialsD-Link DIR-605L Firmware
- CVE-2026-40563Apache Atlas: Script injection allows access to unintended dataApache Software Foundation Apache Atlas · org.apache.atlas:…
- CVE-2026-29169Apache HTTP Server: mod_dav_lock indirect lock crashApache Software Foundation Apache HTTP Server
- CVE-2026-23918Apache HTTP Server: http2: double free and possible RCE on early resetApache Software Foundation Apache HTTP Server
- CVE-2026-6266Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linkingdjango-ansible-base · automation-controller +4
- CVE-2025-58074Privilege escalation during the installation of Norton Secure VPN via the Microsoft StoreGen Digital Norton Secure VPN
- CVE-2026-34059Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()Apache Software Foundation Apache HTTP Server
- CVE-2026-24072Apache HTTP Server: mod_rewrite elevation of privileges via ap_exprApache Software Foundation Apache HTTP Server
- CVE-2026-3120RCE in Profelis Informatics' SambaBoxProfelis Information and Consulting Trade and Industry Limi…
- CVE-2026-33846Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassemblyRed Hat Enterprise Linux · Red Hat OpenShift Container P… +6
- CVE-2026-7750Totolink N300RH POST Request cstecgi.cgi setMacFilterRules buffer overflowTotolink N300RH
- CVE-2026-7749Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflowTotolink N300RH
- CVE-2026-7748Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflowTotolink N300RH
- CVE-2026-29199phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning.phpBB · phpbb/phpbb
- CVE-2026-7717Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflowTotolink WA300
- CVE-2026-7371GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilitiesGeoVision GV-LPC2011/LPC2211
- CVE-2026-42366GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilitiesGeoVision GV-LPC2011/LPC2211
- CVE-2026-42365GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerabilityGeoVision GV-LPC2011/LPC2211
- CVE-2025-67796IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as otherrdiffweb
- CVE-2025-70069An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() met
- CVE-2026-36365An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary
- CVE-2026-37459An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a craft
- CVE-2026-37461An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) viagithub.com/osrg/gobgp/v4
- CVE-2026-38751OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality…devcode-it/openstamanager
Medium, low and unrated 94
- CVE-2026-7785A-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injectionA-G-U-P-T-A wireshark-mcp
- CVE-2026-7784RTGS2017 NagaAgent Skills Endpoint extensions.py path traversalRTGS2017 NagaAgent
- CVE-2026-7783CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injectionCodeCanyon Perfex CRM
- CVE-2026-7782CodeCanyon Perfex CRM Tenant Clients.php project authorizationCodeCanyon Perfex CRM
- CVE-2026-7781Open5GS amf-3gpp-access Endpoint nudm-handler.c udm_nudm_uecm_handle_amf_registration_update denial of serviceOpen5GS
- CVE-2026-7780Open5GS smf-registrations Endpoint udm-sm.c udm_state_operational denial of serviceOpen5GS
- CVE-2026-7779Open5GS authentication-subscription Endpoint nudr-handler.c udm_nudr_dr_handle_subscription_authentication denial of serviceOpen5GS
- CVE-2026-42223nginx-ui: Settings API Exposes Protected Secrets0xJacky nginx-ui · github.com/0xJacky/nginx-ui
- CVE-2026-42220nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-41686Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Toolanthropics anthropic-sdk-typescript · @anthropic-ai/sdk
- CVE-2026-42237n8n: SQL Injection in Snowflake and MySQL Nodesn8n-io n8n · n8n
- CVE-2026-42233n8n: SQL Injection in Oracle Database Node via Limit Fieldn8n-io n8n · n8n
- CVE-2026-42230n8n: Open Redirect in MCP OAuth Consent Flown8n-io n8n · n8n
- CVE-2026-42229n8n: SQL Injection in SeaTable Noden8n-io n8n · n8n
- CVE-2026-42228n8n: Hijacking of Unauthenticated Chat Executionn8n-io n8n · n8n
- CVE-2026-42227n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosuren8n-io n8n · n8n
- CVE-2026-43964Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced statuPostfix
- CVE-2026-42146CImg Library: Uncontrolled memory allocation via nb_colors field in _load_bmpGreycLab CImg
- CVE-2026-42144CImg Library: Integer overflow in PNM size check bypasses memory guard (_load_pnm)GreycLab CImg
- CVE-2026-41572Note Mark: Unauthenticated read of notes and assets in soft-deleted public booksenchant97 note-mark · github.com/enchant97/note-mark/backend
- CVE-2026-42140Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameterxwiki-contrib macro-plantuml · org.xwiki.contrib.plantuml:m…
- CVE-2026-42138Dify Vulnerable to Stored XSS via SVG-file uploadlanggenius dify
- CVE-2026-43616Detect-It-Easy < 3.21 Path Traversal Arbitrary File Writehorsicq DIE-engine
- CVE-2026-42092Global Settings Publication Exposes Sensitive Configuration to Any Authenticated User in Titratitraio titra
- CVE-2026-42091goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORSpatrickhener goshs · github.com/patrickhener/goshs +3
- CVE-2026-42086OpenC3 COSMOS: Self-XSS in the Command SenderOpenC3 cosmos · openc3
- CVE-2026-42085OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenamesOpenC3 cosmos · openc3
- CVE-2026-42052beets is Vulnerable to XSSbeetbox beets · beets
- CVE-2026-42080PPTAgent: Arbitrary File Write via `save_generated_slides`icip-cas PPTAgent · pptagent
- CVE-2026-42078PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_imageicip-cas PPTAgent · pptagent
- CVE-2026-42077Evolver: Prototype Pollution via `Object.assign()` in mailbox store operationsEvoMap evolver · @evomap/evolver
- CVE-2026-25266Exposed dangerous function in windows hostQualcomm Snapdragon
- CVE-2025-47406Buffer Over-read in DSP ServiceQualcomm Snapdragon
- CVE-2025-47404Buffer Copy Without Checking Size of Input in Automotive AudioQualcomm Snapdragon
- CVE-2025-47403Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2025-47401Buffer Over-read in WLAN HALQualcomm Snapdragon
- CVE-2026-33006Apache HTTP Server: mod_auth_digest timing attackApache Software Foundation Apache HTTP Server
- CVE-2026-33007Apache HTTP Server: mod_authn_socache crashApache Software Foundation Apache HTTP Server
- CVE-2026-33523Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status lineApache Software Foundation Apache HTTP Server
- CVE-2026-6501Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External EntILM Informatique jOpenDocument · org.jopendocument:jOpenDo…
- CVE-2026-6500Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data.ILM Informatique OpenConcerto
- CVE-2026-6499Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries.ILM Informatique OpenConcerto
- CVE-2026-33857Apache HTTP Server: Off-by-one OOB reads in AJP getter functionsApache Software Foundation Apache HTTP Server
- CVE-2026-34032Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)Apache Software Foundation Apache HTTP Server
- CVE-2026-7746SourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injectionSourceCodester Web-based Pharmacy Product Management System
- CVE-2026-7745CodeAstro Online Classroom facultydetails sql injectionCodeAstro Online Classroom
- CVE-2026-7744CodeAstro Online Classroom addnewstudent sql injectionCodeAstro Online Classroom
- CVE-2026-7743CodeAstro Online Classroom studentdetails sql injectionCodeAstro Online Classroom
- CVE-2026-7742CodeAstro Online Classroom facultylogin sql injectionCodeAstro Online Classroom
- CVE-2026-7741CodeAstro Online Classroom studentlogin sql injectionCodeAstro Online Classroom
- CVE-2026-7740justdan96 tsMuxer vvc.cpp setFPS denial of servicejustdan96 tsMuxer
- CVE-2026-7739justdan96 tsMuxer hevc.cpp setFPS denial of servicejustdan96 tsMuxer
- CVE-2026-43864mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.mutt
- CVE-2026-43863mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.mutt
- CVE-2026-43862In mutt before 2.3.2, the imap_auth_gss security level is mishandled.mutt
- CVE-2026-7738puchunjie doc-tools-mcp MCP mcp-server.ts open_document path traversalpuchunjie doc-tools-mcp · @puchunjie/doc-tools-mcp
- CVE-2026-5335Magic Export & Import < 1.2.0 - Unauthenticated PII DisclosureMagic Export & Import
- CVE-2026-43861mutt before 2.3.2 does not check for '\0' in url_pct_decode.mutt
- CVE-2026-7737osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-boundsosrg GoBGP · github.com/osrg/gobgp/v4 +1
- CVE-2026-43860mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.mutt
- CVE-2026-20451In slbc, there is a possible out of bounds write due to type confusion.MediaTek chipset
- CVE-2026-20450In Modem, there is a possible system crash due to incorrect error handling.MediaTek chipset
- CVE-2026-20449In Modem, there is a possible system crash due to a heap buffer overflow.MediaTek chipset
- CVE-2026-20448In geniezone, there is a possible escalation of privilege due to a missing permission check.MediaTek chipset
- CVE-2026-20447In geniezone, there is a possible escalation of privilege due to a missing bounds check.MediaTek chipset
- CVE-2026-43859mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.mutt
- CVE-2026-7736osrg GoBGP mrt.go parseRibEntry integer underflowosrg GoBGP · github.com/osrg/gobgp/v4
- CVE-2026-7735osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflowosrg GoBGP
- CVE-2026-7734osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of serviceosrg GoBGP · github.com/osrg/gobgp/v4
- CVE-2026-7733funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted uploadfunadmin · funadmin/funadmin
- CVE-2026-7732code-projects BloodBank Managing System request_blood.php unrestricted uploadcode-projects BloodBank Managing System
- CVE-2026-7731code-projects BloodBank Managing System get_state.php sql injectioncode-projects BloodBank Managing System
- CVE-2026-7730privsim mcp-test-runner MCP index.ts child_process.spawn os command injectionprivsim mcp-test-runner
- CVE-2026-7729pixelsock directus-mcp MCP index.ts validateUrl server-side request forgerypixelsock directus-mcp
- CVE-2026-7728ryanjoachim mcp-rtfm MCP update_doc path traversalryanjoachim mcp-rtfm
- CVE-2026-7727Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injectionShandong Hoteam Software PDM Product Data Management System
- CVE-2026-7725PrefectHQ prefect GitRepository Pull storage.py argument injectionPrefectHQ prefect · prefect
- CVE-2026-7724PrefectHQ prefect Webhook/Notification validate_restricted_url toctouPrefectHQ prefect · prefect
- CVE-2026-7723PrefectHQ prefect WebSocket Endpoint in missing authenticationPrefectHQ prefect · prefect
- CVE-2026-7722PrefectHQ prefect Health Check API health endswith improper authenticationPrefectHQ prefect · prefect
- CVE-2026-7721Totolink WA300 cstecgi.cgi NTPSyncWithHost command injectionTotolink WA300
- CVE-2026-7720Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injectionTotolink WA300
- CVE-2026-7718Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injectionTotolink WA300
- CVE-2026-7716code-projects Gym Management System In PHP/Windows NT index.php sql injectioncode-projects Gym Management System In PHP · code-projects…
- CVE-2026-42367GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi privilege escalation vulnerability via leak of Administrator credentialsGeoVision GV-LPC2011/LPC2211
- CVE-2026-7715ravenwits mcp-server-arangodb MCP tools.ts arango_backup path traversalravenwits mcp-server-arangodb
- CVE-2026-7714crocodilestick Calibre-Web-Automated Admin Endpoint cwa_functions.py missing authenticationcrocodilestick Calibre-Web-Automated
- CVE-2026-7713crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorizationcrocodilestick Calibre-Web-Automated
- CVE-2025-70070An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry()
- CVE-2025-70071An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()
- CVE-2025-70072An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMat
- CVE-2026-31205Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and
- CVE-2026-37458Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to caus
- CVE-2026-38669wCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog.