# CVEs published 2026-05-04

188 CVEs were published on May 4, 2026: 43 critical, 51 high. Days are UTC.

- [CVE-2026-7785](https://cve.now/CVE-2026-7785.md): A-G-U-P-T-A wireshark-mcp pyshark\_mcp.py quick\_capture os command injection (CVSS 6.9, A-G-U-P-T-A wireshark-mcp)
- [CVE-2026-7784](https://cve.now/CVE-2026-7784.md): RTGS2017 NagaAgent Skills Endpoint extensions.py path traversal (CVSS 6.9, RTGS2017 NagaAgent)
- [CVE-2026-7783](https://cve.now/CVE-2026-7783.md): CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection (CVSS 5.3, CodeCanyon Perfex CRM)
- [CVE-2026-7782](https://cve.now/CVE-2026-7782.md): CodeCanyon Perfex CRM Tenant Clients.php project authorization (CVSS 5.3, CodeCanyon Perfex CRM)
- [CVE-2026-7781](https://cve.now/CVE-2026-7781.md): Open5GS amf-3gpp-access Endpoint nudm-handler.c udm\_nudm\_uecm\_handle\_amf\_registration\_update denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-7791](https://cve.now/CVE-2026-7791.md): Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent (CVSS 7.8, Amazon Workspaces)
- [CVE-2026-7780](https://cve.now/CVE-2026-7780.md): Open5GS smf-registrations Endpoint udm-sm.c udm\_state\_operational denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-7776](https://cve.now/CVE-2026-7776.md): Boundary Workers Vulnerable to Denial of Service During TLS Handshake (CVSS 7.5, HashiCorp Boundary · github.com/hashicorp/boundary)
- [CVE-2026-7779](https://cve.now/CVE-2026-7779.md): Open5GS authentication-subscription Endpoint nudr-handler.c udm\_nudr\_dr\_handle\_subscription\_authentication denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-42238](https://cve.now/CVE-2026-42238.md): Unauthenticated Remote Code Execution via Backup Restore in nginx-ui (CVSS 9.0, 0xJacky nginx-ui · github.com/0xJacky/nginx-ui)
- [CVE-2026-42223](https://cve.now/CVE-2026-42223.md): nginx-ui: Settings API Exposes Protected Secrets (CVSS 6.5, 0xJacky nginx-ui · github.com/0xJacky/nginx-ui)
- [CVE-2026-42222](https://cve.now/CVE-2026-42222.md): nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover (CVSS 8.1, 0xJacky nginx-ui · github.com/0xJacky/nginx-ui)
- [CVE-2026-42221](https://cve.now/CVE-2026-42221.md): nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim (CVSS 8.1, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-42220](https://cve.now/CVE-2026-42220.md): nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback (CVSS 6.5, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2026-6321](https://cve.now/CVE-2026-6321.md): fast-uri vulnerable to path traversal via percent-encoded dot segments (CVSS 7.5, fast-uri)
- [CVE-2026-41927](https://cve.now/CVE-2026-41927.md): WDR201A WiFi Extender Stack-Based Buffer Overflow via firewall.cgi (CVSS 8.3, Shenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…)
- [CVE-2026-41926](https://cve.now/CVE-2026-41926.md): WDR201A WiFi Extender OS Command Injection via firewall.cgi (CVSS 9.3, Shenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…)
- [CVE-2026-41925](https://cve.now/CVE-2026-41925.md): WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot\_time) (CVSS 9.3, Shenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…)
- [CVE-2026-7768](https://cve.now/CVE-2026-7768.md): @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth (CVSS 7.5, @fastify/accepts-serializer)
- [CVE-2026-41924](https://cve.now/CVE-2026-41924.md): WDR201A WiFi Extender OS Command Injection via makeRequest.cgi (CVSS 9.3, Shenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…)
- [CVE-2026-41923](https://cve.now/CVE-2026-41923.md): WDR201A WiFi Extender OS Command Injection via internet.cgi (CVSS 9.3, Shenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…)
- [CVE-2026-41922](https://cve.now/CVE-2026-41922.md): WDR201A WiFi Extender OS Command Injection via wireless.cgi (CVSS 9.3, Shenzhen Yipu Commercial and Trading Co. WDR201A WiFi Exten…)
- [CVE-2026-41686](https://cve.now/CVE-2026-41686.md): Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool (CVSS 4.8, anthropics anthropic-sdk-typescript · @anthropic-ai/sdk)
- [CVE-2026-42237](https://cve.now/CVE-2026-42237.md): n8n: SQL Injection in Snowflake and MySQL Nodes (CVSS 5.3, n8n-io n8n · n8n)
- [CVE-2026-42236](https://cve.now/CVE-2026-42236.md): n8n: Unauthenticated Denial of Service via MCP Client Registration (CVSS 8.7, n8n-io n8n · n8n)
- [CVE-2026-42235](https://cve.now/CVE-2026-42235.md): n8n: XSS via MCP OAuth client (CVSS 8.8, n8n-io n8n · n8n)
- [CVE-2026-42234](https://cve.now/CVE-2026-42234.md): n8n: Python Task Runner Sandbox Escape (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-42233](https://cve.now/CVE-2026-42233.md): n8n: SQL Injection in Oracle Database Node via Limit Field (CVSS 5.3, n8n-io n8n · n8n)
- [CVE-2026-42232](https://cve.now/CVE-2026-42232.md): n8n: XML Node Prototype Pollution to RCE (CVSS 9.4, n8n-io n8n · n8n)
- [CVE-2026-42231](https://cve.now/CVE-2026-42231.md): n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE (CVSS 9.4, n8n-io n8n · n8n)
- [CVE-2026-25863](https://cve.now/CVE-2026-25863.md): Conditional Fields for Contact Form 7 \< 2.7.3 DoS via Uncontrolled Resource Consumption (CVSS 8.7, Jules Colle Conditional Fields for Contact Form)
- [CVE-2026-42230](https://cve.now/CVE-2026-42230.md): n8n: Open Redirect in MCP OAuth Consent Flow (CVSS 5.1, n8n-io n8n · n8n)
- [CVE-2026-42229](https://cve.now/CVE-2026-42229.md): n8n: SQL Injection in SeaTable Node (CVSS 5.3, n8n-io n8n · n8n)
- [CVE-2026-42228](https://cve.now/CVE-2026-42228.md): n8n: Hijacking of Unauthenticated Chat Execution (CVSS 6.3, n8n-io n8n · n8n)
- [CVE-2026-42227](https://cve.now/CVE-2026-42227.md): n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure (CVSS 6.0, n8n-io n8n · n8n)
- [CVE-2026-42226](https://cve.now/CVE-2026-42226.md): n8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-42154](https://cve.now/CVE-2026-42154.md): Prometheus: remote read endpoint allows denial of service via crafted snappy payload (CVSS 7.5, prometheus · github.com/prometheus/prometheus +1)
- [CVE-2026-42151](https://cve.now/CVE-2026-42151.md): Prometheus Azure AD remote write OAuth client secret exposed via config API (CVSS 7.5, prometheus · github.com/prometheus/prometheus)
- [CVE-2026-43964](https://cve.now/CVE-2026-43964.md): Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced statu (CVSS 3.7, Postfix)
- [CVE-2026-29004](https://cve.now/CVE-2026-29004.md): BusyBox DHCPv6 Client Heap Buffer Overflow via DNS\_SERVERS (CVSS 7.2, vda-linux busybox\_mirror)
- [CVE-2026-0073](https://cve.now/CVE-2026-0073.md): In adbd\_tls\_verify\_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. (CVSS 8.8, Google Android)
- [CVE-2026-42146](https://cve.now/CVE-2026-42146.md): CImg Library: Uncontrolled memory allocation via nb\_colors field in \_load\_bmp (CVSS 5.5, GreycLab CImg)
- [CVE-2026-42144](https://cve.now/CVE-2026-42144.md): CImg Library: Integer overflow in PNM size check bypasses memory guard (\_load\_pnm) (CVSS 6.1, GreycLab CImg)
- [CVE-2026-41572](https://cve.now/CVE-2026-41572.md): Note Mark: Unauthenticated read of notes and assets in soft-deleted public books (CVSS 5.3, enchant97 note-mark · github.com/enchant97/note-mark/backend)
- [CVE-2026-41571](https://cve.now/CVE-2026-41571.md): Note Mark: OIDC-registered users authenticated by submitting password "null" (CVSS 9.4, enchant97 note-mark · github.com/enchant97/note-mark/backend)
- [CVE-2026-41471](https://cve.now/CVE-2026-41471.md): Easy PayPal Events & Tickets \< 1.4 Information Disclosure via QR Code Endpoint (CVSS 8.2, Scott Paterson easy-paypal-events-tickets)
- [CVE-2026-32834](https://cve.now/CVE-2026-32834.md): Easy PayPal Events & Tickets \< 1.4 Authentication Bypass via QR Code Scanning (CVSS 8.7, Scott Paterson easy-paypal-events-tickets)
- [CVE-2026-42140](https://cve.now/CVE-2026-42140.md): Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter (CVSS 4.4, xwiki-contrib macro-plantuml · org.xwiki.contrib.plantuml:m…)
- [CVE-2026-42138](https://cve.now/CVE-2026-42138.md): Dify Vulnerable to Stored XSS via SVG-file upload (CVSS 6.9, langgenius dify)
- [CVE-2026-43616](https://cve.now/CVE-2026-43616.md): Detect-It-Easy \< 3.21 Path Traversal Arbitrary File Write (CVSS 6.8, horsicq DIE-engine)
- [CVE-2026-42092](https://cve.now/CVE-2026-42092.md): Global Settings Publication Exposes Sensitive Configuration to Any Authenticated User in Titra (CVSS 6.5, titraio titra)
- [CVE-2026-42091](https://cve.now/CVE-2026-42091.md): goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS (CVSS 6.5, patrickhener goshs · github.com/patrickhener/goshs +3)
- [CVE-2026-42088](https://cve.now/CVE-2026-42088.md): OpenC3 COSMOS: Administrative Actions via the Script Runner Tool (CVSS 9.6, OpenC3 cosmos · openc3)
- [CVE-2026-42796](https://cve.now/CVE-2026-42796.md): Arelle \< 2.39.10 Unauthenticated RCE via /rest/configure (CVSS 9.2, Arelle)
- [CVE-2026-42087](https://cve.now/CVE-2026-42087.md): OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base (CVSS 9.6, OpenC3 cosmos · openc3)
- [CVE-2026-42086](https://cve.now/CVE-2026-42086.md): OpenC3 COSMOS: Self-XSS in the Command Sender (CVSS 4.6, OpenC3 cosmos · openc3)
- [CVE-2026-42085](https://cve.now/CVE-2026-42085.md): OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames (CVSS 4.3, OpenC3 cosmos · openc3)
- [CVE-2026-42084](https://cve.now/CVE-2026-42084.md): OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence (CVSS 8.1, OpenC3 cosmos · openc3)
- [CVE-2026-42052](https://cve.now/CVE-2026-42052.md): beets is Vulnerable to XSS (CVSS 6.0, beetbox beets · beets)
- [CVE-2026-42080](https://cve.now/CVE-2026-42080.md): PPTAgent: Arbitrary File Write via \`save\_generated\_slides\` (CVSS 4.6, icip-cas PPTAgent · pptagent)
- [CVE-2026-42079](https://cve.now/CVE-2026-42079.md): PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope (CVSS 8.6, icip-cas PPTAgent · pptagent)
- [CVE-2026-40682](https://cve.now/CVE-2026-40682.md): Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor (CVSS 9.1, Apache Software Foundation Apache OpenNLP · org.apache.open…)
- [CVE-2026-42078](https://cve.now/CVE-2026-42078.md): PPTAgent: Arbitrary File Write + Directory Creation via markdown\_table\_to\_image (CVSS 4.6, icip-cas PPTAgent · pptagent)
- [CVE-2026-42077](https://cve.now/CVE-2026-42077.md): Evolver: Prototype Pollution via \`Object.assign()\` in mailbox store operations (CVSS 5.2, EvoMap evolver · @evomap/evolver)
- [CVE-2026-42076](https://cve.now/CVE-2026-42076.md): Evolver: Command Injection via \`execSync\` in \`\_extractLLM()\` function allows Remote Code Execution (CVSS 9.8, EvoMap evolver · @evomap/evolver)
- [CVE-2026-42810](https://cve.now/CVE-2026-42810.md): Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names (CVSS 9.4, Apache Software Foundation Apache Polaris · org.apache.pola…)
- [CVE-2026-42075](https://cve.now/CVE-2026-42075.md): Evolver: Path Traversal via \`--out\` flag in \`fetch\` command allows Arbitrary File Write (CVSS 8.1, EvoMap evolver · @evomap/evolver)
- [CVE-2026-25293](https://cve.now/CVE-2026-25293.md): Incorrect authorization in PLC FW (CVSS 9.6, Qualcomm Snapdragon)
- [CVE-2026-25266](https://cve.now/CVE-2026-25266.md): Exposed dangerous function in windows host (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2026-24082](https://cve.now/CVE-2026-24082.md): Use After Free in Automotive GPU (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47408](https://cve.now/CVE-2025-47408.md): Untrusted Pointer Dereference in Power Optimization Firmware (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47407](https://cve.now/CVE-2025-47407.md): Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-42027](https://cve.now/CVE-2026-42027.md): Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader (CVSS 9.8, Apache Software Foundation Apache OpenNLP · org.apache.open…)
- [CVE-2025-47406](https://cve.now/CVE-2025-47406.md): Buffer Over-read in DSP Service (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2025-47405](https://cve.now/CVE-2025-47405.md): Untrusted Pointer Dereference in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-47404](https://cve.now/CVE-2025-47404.md): Buffer Copy Without Checking Size of Input in Automotive Audio (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2025-47403](https://cve.now/CVE-2025-47403.md): Buffer Over-read in WLAN Firmware (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2025-47401](https://cve.now/CVE-2025-47401.md): Buffer Over-read in WLAN HAL (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2026-42090](https://cve.now/CVE-2026-42090.md): Notesnook: RCE via stored XSS in note export rendering (CVSS 9.6, streetwriters notesnook)
- [CVE-2026-42440](https://cve.now/CVE-2026-42440.md): Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader (CVSS 7.5, Apache Software Foundation Apache OpenNLP · org.apache.open…)
- [CVE-2026-26956](https://cve.now/CVE-2026-26956.md): vm2: WASM Sandbox Escape (Node 25 only) (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2026-42811](https://cve.now/CVE-2026-42811.md): Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions (CVSS 9.4, Apache Software Foundation Apache Polaris · org.apache.pola…)
- [CVE-2026-26332](https://cve.now/CVE-2026-26332.md): vm2: Sandbox Escape (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2026-24781](https://cve.now/CVE-2026-24781.md): vm2: Sandbox Breakout Through Inspect (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2026-24120](https://cve.now/CVE-2026-24120.md): vm2: Sandbox Breakout Through Promise Species (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2026-24118](https://cve.now/CVE-2026-24118.md): VM2 Sandbox Breakout Through \_\_lookupGetter\_\_ (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2026-42809](https://cve.now/CVE-2026-42809.md): Apache Polaris: staged table creation could vend storage credentials for unvalidated locations (CVSS 9.4, Apache Software Foundation Apache Polaris · org.apache.pola…)
- [CVE-2026-42812](https://cve.now/CVE-2026-42812.md): Apache Polaris: No protection on \`write.metadata.path\` (CVSS 9.4, Apache Software Foundation Apache Polaris · org.apache.pola…)
- [CVE-2026-29514](https://cve.now/CVE-2026-29514.md): NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin (CVSS 8.7, netbox-community netbox)
- [CVE-2026-42376](https://cve.now/CVE-2026-42376.md): D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials (CVSS 9.8, D-Link DIR-456U Firmware)
- [CVE-2026-42375](https://cve.now/CVE-2026-42375.md): D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials (CVSS 9.8, D-Link DIR-600L Firmware)
- [CVE-2026-42374](https://cve.now/CVE-2026-42374.md): D-Link DIR-600L B1 Hardcoded Telnet Backdoor Credentials (CVSS 9.8, D-Link DIR-600L Firmware)
- [CVE-2026-42373](https://cve.now/CVE-2026-42373.md): D-Link DIR-605L B2 Hardcoded Telnet Backdoor Credentials (CVSS 9.8, D-Link DIR-605L Firmware)
- [CVE-2026-42372](https://cve.now/CVE-2026-42372.md): D-Link DIR-605L A1 Hardcoded Telnet Backdoor Credentials (CVSS 8.8, D-Link DIR-605L Firmware)
- [CVE-2026-40563](https://cve.now/CVE-2026-40563.md): Apache Atlas: Script injection allows access to unintended data (CVSS 8.1, Apache Software Foundation Apache Atlas · org.apache.atlas:…)
- [CVE-2025-13605](https://cve.now/CVE-2025-13605.md): Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway (CVSS 9.3, 3onedata GW1101-1D(RS-485)-TB-P)
- [CVE-2026-29169](https://cve.now/CVE-2026-29169.md): Apache HTTP Server: mod\_dav\_lock indirect lock crash (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-23918](https://cve.now/CVE-2026-23918.md): Apache HTTP Server: http2: double free and possible RCE on early reset (CVSS 8.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-33006](https://cve.now/CVE-2026-33006.md): Apache HTTP Server: mod\_auth\_digest timing attack (CVSS 4.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-33007](https://cve.now/CVE-2026-33007.md): Apache HTTP Server: mod\_authn\_socache crash (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-33523](https://cve.now/CVE-2026-33523.md): Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line (CVSS 6.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-6501](https://cve.now/CVE-2026-6501.md): Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Ent (CVSS 5.3, ILM Informatique jOpenDocument · org.jopendocument:jOpenDo…)
- [CVE-2026-6500](https://cve.now/CVE-2026-6500.md): Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data. (CVSS 4.8, ILM Informatique OpenConcerto)
- [CVE-2026-6499](https://cve.now/CVE-2026-6499.md): Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. (CVSS 2.4, ILM Informatique OpenConcerto)
- [CVE-2026-6266](https://cve.now/CVE-2026-6266.md): Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking (CVSS 8.3, django-ansible-base · automation-controller +4)
- [CVE-2025-58074](https://cve.now/CVE-2025-58074.md): Privilege escalation during the installation of Norton Secure VPN via the Microsoft Store (CVSS 8.8, Gen Digital Norton Secure VPN)
- [CVE-2026-33857](https://cve.now/CVE-2026-33857.md): Apache HTTP Server: Off-by-one OOB reads in AJP getter functions (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-34032](https://cve.now/CVE-2026-34032.md): Apache HTTP Server: mod\_proxy\_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp\_msg\_get\_string) (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-34059](https://cve.now/CVE-2026-34059.md): Apache HTTP Server: mod\_proxy\_ajp: Heap Over-Read and memory disclosure in ajp\_parse\_data() (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-7482](https://cve.now/CVE-2026-7482.md): Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers (CVSS 9.1, ollama · github.com/ollama/ollama)
- [CVE-2026-24072](https://cve.now/CVE-2026-24072.md): Apache HTTP Server: mod\_rewrite elevation of privileges via ap\_expr (CVSS 8.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-3120](https://cve.now/CVE-2026-3120.md): RCE in Profelis Informatics' SambaBox (CVSS 7.2, Profelis Information and Consulting Trade and Industry Limi…)
- [CVE-2026-33846](https://cve.now/CVE-2026-33846.md): Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +6)
- [CVE-2026-7750](https://cve.now/CVE-2026-7750.md): Totolink N300RH POST Request cstecgi.cgi setMacFilterRules buffer overflow (CVSS 8.7, Totolink N300RH)
- [CVE-2026-7749](https://cve.now/CVE-2026-7749.md): Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflow (CVSS 8.7, Totolink N300RH)
- [CVE-2026-7748](https://cve.now/CVE-2026-7748.md): Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow (CVSS 8.7, Totolink N300RH)
- [CVE-2026-7747](https://cve.now/CVE-2026-7747.md): Totolink N300RH Parameter cstecgi.cgi loginauth buffer overflow (CVSS 9.3, Totolink N300RH)
- [CVE-2026-7746](https://cve.now/CVE-2026-7746.md): SourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injection (CVSS 5.3, SourceCodester Web-based Pharmacy Product Management System)
- [CVE-2026-7745](https://cve.now/CVE-2026-7745.md): CodeAstro Online Classroom facultydetails sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2025-14320](https://cve.now/CVE-2025-14320.md): XSS in Tegsoft's Online Support Application (CVSS 9.8, Tegsoft Management and Information Services Trade Limited C…)
- [CVE-2026-7744](https://cve.now/CVE-2026-7744.md): CodeAstro Online Classroom addnewstudent sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-7743](https://cve.now/CVE-2026-7743.md): CodeAstro Online Classroom studentdetails sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-7742](https://cve.now/CVE-2026-7742.md): CodeAstro Online Classroom facultylogin sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-7741](https://cve.now/CVE-2026-7741.md): CodeAstro Online Classroom studentlogin sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-7740](https://cve.now/CVE-2026-7740.md): justdan96 tsMuxer vvc.cpp setFPS denial of service (CVSS 4.8, justdan96 tsMuxer)
- [CVE-2026-7739](https://cve.now/CVE-2026-7739.md): justdan96 tsMuxer hevc.cpp setFPS denial of service (CVSS 4.8, justdan96 tsMuxer)
- [CVE-2026-43864](https://cve.now/CVE-2026-43864.md): mutt before 2.3.2 has a show\_sig\_summary NULL pointer dereference. (CVSS 2.5, mutt)
- [CVE-2026-43863](https://cve.now/CVE-2026-43863.md): mutt before 2.3.2 has an infinite loop in data\_object\_to\_stream in crypt-gpgme.c. (CVSS 3.7, mutt)
- [CVE-2026-43862](https://cve.now/CVE-2026-43862.md): In mutt before 2.3.2, the imap\_auth\_gss security level is mishandled. (CVSS 3.7, mutt)
- [CVE-2026-7738](https://cve.now/CVE-2026-7738.md): puchunjie doc-tools-mcp MCP mcp-server.ts open\_document path traversal (CVSS 5.3, puchunjie doc-tools-mcp · @puchunjie/doc-tools-mcp)
- [CVE-2026-5335](https://cve.now/CVE-2026-5335.md): Magic Export & Import \< 1.2.0 - Unauthenticated PII Disclosure (CVSS 5.3, Magic Export & Import)
- [CVE-2026-43861](https://cve.now/CVE-2026-43861.md): mutt before 2.3.2 does not check for '\\0' in url\_pct\_decode. (CVSS 3.7, mutt)
- [CVE-2026-7737](https://cve.now/CVE-2026-7737.md): osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds (CVSS 6.9, osrg GoBGP · github.com/osrg/gobgp/v4 +1)
- [CVE-2026-43860](https://cve.now/CVE-2026-43860.md): mutt before 2.3.2 sometimes truncates the hash\_passwd by one byte for IMAP auth\_cram MD5 digest. (CVSS 3.7, mutt)
- [CVE-2026-20451](https://cve.now/CVE-2026-20451.md): In slbc, there is a possible out of bounds write due to type confusion. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-29200](https://cve.now/CVE-2026-29200.md): A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. (CVSS 9.9, WebPros Comet Backup)
- [CVE-2026-29199](https://cve.now/CVE-2026-29199.md): phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. (CVSS 8.1, phpBB · phpbb/phpbb)
- [CVE-2026-20450](https://cve.now/CVE-2026-20450.md): In Modem, there is a possible system crash due to incorrect error handling. (CVSS 6.5, MediaTek chipset)
- [CVE-2026-20449](https://cve.now/CVE-2026-20449.md): In Modem, there is a possible system crash due to a heap buffer overflow. (CVSS 6.5, MediaTek chipset)
- [CVE-2026-20448](https://cve.now/CVE-2026-20448.md): In geniezone, there is a possible escalation of privilege due to a missing permission check. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20447](https://cve.now/CVE-2026-20447.md): In geniezone, there is a possible escalation of privilege due to a missing bounds check. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-43859](https://cve.now/CVE-2026-43859.md): mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth\_cram MD5 digest. (CVSS 3.7, mutt)
- [CVE-2026-7736](https://cve.now/CVE-2026-7736.md): osrg GoBGP mrt.go parseRibEntry integer underflow (CVSS 6.9, osrg GoBGP · github.com/osrg/gobgp/v4)
- [CVE-2026-7735](https://cve.now/CVE-2026-7735.md): osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow (CVSS 6.9, osrg GoBGP)
- [CVE-2026-7734](https://cve.now/CVE-2026-7734.md): osrg GoBGP SRv6 L3 Service prefix\_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service (CVSS 6.9, osrg GoBGP · github.com/osrg/gobgp/v4)
- [CVE-2026-7733](https://cve.now/CVE-2026-7733.md): funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload (CVSS 6.9, funadmin · funadmin/funadmin)
- [CVE-2026-7732](https://cve.now/CVE-2026-7732.md): code-projects BloodBank Managing System request\_blood.php unrestricted upload (CVSS 5.3, code-projects BloodBank Managing System)
- [CVE-2026-7731](https://cve.now/CVE-2026-7731.md): code-projects BloodBank Managing System get\_state.php sql injection (CVSS 5.3, code-projects BloodBank Managing System)
- [CVE-2026-7730](https://cve.now/CVE-2026-7730.md): privsim mcp-test-runner MCP index.ts child\_process.spawn os command injection (CVSS 5.3, privsim mcp-test-runner)
- [CVE-2026-7729](https://cve.now/CVE-2026-7729.md): pixelsock directus-mcp MCP index.ts validateUrl server-side request forgery (CVSS 5.3, pixelsock directus-mcp)
- [CVE-2026-7728](https://cve.now/CVE-2026-7728.md): ryanjoachim mcp-rtfm MCP update\_doc path traversal (CVSS 5.3, ryanjoachim mcp-rtfm)
- [CVE-2026-7727](https://cve.now/CVE-2026-7727.md): Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection (CVSS 6.9, Shandong Hoteam Software PDM Product Data Management System)
- [CVE-2026-7725](https://cve.now/CVE-2026-7725.md): PrefectHQ prefect GitRepository Pull storage.py argument injection (CVSS 5.3, PrefectHQ prefect · prefect)
- [CVE-2026-7724](https://cve.now/CVE-2026-7724.md): PrefectHQ prefect Webhook/Notification validate\_restricted\_url toctou (CVSS 2.3, PrefectHQ prefect · prefect)
- [CVE-2026-7723](https://cve.now/CVE-2026-7723.md): PrefectHQ prefect WebSocket Endpoint in missing authentication (CVSS 6.9, PrefectHQ prefect · prefect)
- [CVE-2026-7722](https://cve.now/CVE-2026-7722.md): PrefectHQ prefect Health Check API health endswith improper authentication (CVSS 6.9, PrefectHQ prefect · prefect)
- [CVE-2026-7721](https://cve.now/CVE-2026-7721.md): Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection (CVSS 5.3, Totolink WA300)
- [CVE-2026-7720](https://cve.now/CVE-2026-7720.md): Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection (CVSS 5.3, Totolink WA300)
- [CVE-2026-7719](https://cve.now/CVE-2026-7719.md): Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow (CVSS 9.3, Totolink WA300)
- [CVE-2026-7718](https://cve.now/CVE-2026-7718.md): Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection (CVSS 5.3, Totolink WA300)
- [CVE-2026-7717](https://cve.now/CVE-2026-7717.md): Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow (CVSS 8.7, Totolink WA300)
- [CVE-2026-42370](https://cve.now/CVE-2026-42370.md): GeoVision GV-VMS V20 WebCam Server Login stack overflow vulnerability (CVSS 9.0, GeoVision GV-VMS)
- [CVE-2026-7372](https://cve.now/CVE-2026-7372.md): GeoVision GV-VMS V20 WebCam Server Login stack overflow vulnerability (CVSS 9.0, GeoVision GV-VMS)
- [CVE-2026-42369](https://cve.now/CVE-2026-42369.md): GeoVision GV-VMS V20 WebCam Server stack overflow vulnerability (CVSS 10.0, GeoVision GV-VMS)
- [CVE-2026-42368](https://cve.now/CVE-2026-42368.md): GeoVision LPC2011/LPC2211 Web Interface privilege escalation vulnerability (CVSS 9.9, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-7716](https://cve.now/CVE-2026-7716.md): code-projects Gym Management System In PHP/Windows NT index.php sql injection (CVSS 5.3, code-projects Gym Management System In PHP · code-projects…)
- [CVE-2026-42367](https://cve.now/CVE-2026-42367.md): GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi privilege escalation vulnerability via leak of Administrator credentials (CVSS 6.5, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-7371](https://cve.now/CVE-2026-7371.md): GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilities (CVSS 7.4, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-42366](https://cve.now/CVE-2026-42366.md): GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilities (CVSS 7.4, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-42365](https://cve.now/CVE-2026-42365.md): GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerability (CVSS 8.6, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-42364](https://cve.now/CVE-2026-42364.md): GeoVision LPC2011/LPC2211 Web Interface / DdnsSetting.cgi OS command injection vulnerability (CVSS 9.9, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-7161](https://cve.now/CVE-2026-7161.md): GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability (CVSS 9.3, GeoVision GV-IP Device Utility)
- [CVE-2026-7715](https://cve.now/CVE-2026-7715.md): ravenwits mcp-server-arangodb MCP tools.ts arango\_backup path traversal (CVSS 5.3, ravenwits mcp-server-arangodb)
- [CVE-2026-7714](https://cve.now/CVE-2026-7714.md): crocodilestick Calibre-Web-Automated Admin Endpoint cwa\_functions.py missing authentication (CVSS 6.9, crocodilestick Calibre-Web-Automated)
- [CVE-2026-7713](https://cve.now/CVE-2026-7713.md): crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo\_auth.py generate\_auth\_token improper authorization (CVSS 5.3, crocodilestick Calibre-Web-Automated)
- [CVE-2025-67796](https://cve.now/CVE-2025-67796.md): IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other (CVSS 8.1, rdiffweb)
- [CVE-2025-70067](https://cve.now/CVE-2025-70067.md): Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. (CVSS 9.8)
- [CVE-2025-70069](https://cve.now/CVE-2025-70069.md): An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() met (CVSS 7.5)
- [CVE-2025-70070](https://cve.now/CVE-2025-70070.md): An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry() (CVSS 6.5)
- [CVE-2025-70071](https://cve.now/CVE-2025-70071.md): An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray() (CVSS 5.9)
- [CVE-2025-70072](https://cve.now/CVE-2025-70072.md): An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMat (CVSS 6.5)
- [CVE-2026-31205](https://cve.now/CVE-2026-31205.md): Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and (CVSS 5.7)
- [CVE-2026-36365](https://cve.now/CVE-2026-36365.md): An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary (CVSS 7.8)
- [CVE-2026-37458](https://cve.now/CVE-2026-37458.md): Missing input validation in the MP\_REACH\_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to caus (CVSS 6.5)
- [CVE-2026-37459](https://cve.now/CVE-2026-37459.md): An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a craft (CVSS 7.5)
- [CVE-2026-37461](https://cve.now/CVE-2026-37461.md): An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5, github.com/osrg/gobgp/v4)
- [CVE-2026-38669](https://cve.now/CVE-2026-38669.md): wCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog. (CVSS 6.1)
- [CVE-2026-38751](https://cve.now/CVE-2026-38751.md): OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality… (CVSS 7.2, devcode-it/openstamanager)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.