CVEs published May 5, 2026
191 CVEs were published on May 5, 2026: 28 critical, 76 high.
- Published
- 191
- Critical
- 28
- High
- 76
- Medium
- 71
- Low
- 7
- Unrated
- 9
- Now in CISA KEV
- 0
- Fix available
- 100
Most affected products
- OpenClaw
- 26
- Linux
- 15
- sandboxie-plus Sandboxie
- 8
- D-Link DI-8100
- 6
- coredns · github.com/coredns/coredns
- 5
- jupyter-server jupyter_server · jupyter-server
- 4
- chatchat-space Langchain-Chatchat · langchain-chatchat
- 3
- djangoproject Django · django
- 3
- MasaCMS
- 3
- redis
- 3
Critical 28
- CVE-2026-28780Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()Apache Software Foundation Apache HTTP Server
- CVE-2026-40331Masa CMS unauthenticated SQL injection via altTable parameter in JSON APIMasaCMS
- CVE-2026-40330Masa CMS SQL injection via sortDirection parameter in beanFeedMasaCMS
- CVE-2026-40329SQL Injection vulnerability via sortBy in beanFeedMasaCMS
- CVE-2026-34458Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnlysandboxie-plus Sandboxie
- CVE-2026-34084PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::loadPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-33324SQLBot prompt injection allows arbitrary SQL execution and remote code executiondataease SQLBot
- CVE-2026-27960OpenCTI privilege escalation and unauthenticated access via default admin accountOpenCTI-Platform opencti · pycti
- CVE-2026-7854D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflowD-Link DI-8100
- CVE-2026-7853D-Link DI-8100 HTTP auto_reboot.asp sprintf buffer overflowD-Link DI-8100
- CVE-2026-43071dcache: Limit the minimal number of bucket to twoLinux
- CVE-2026-43067ext4: handle wraparound when searching for blocks for indirect mapped blocksLinux
- CVE-2026-7411In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauEclipse Foundation Eclipse BaSyx · org.eclipse.basyx:basyx.…
- CVE-2026-7834EFM ipTIME NAS1dual misc_main.cgi get_csrf_whites stack-based overflowEFM ipTIME NAS1dual
- CVE-2026-43566OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake EventsOpenClaw
- CVE-2026-43534OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook EventsOpenClaw
- CVE-2023-54344Eclipse Equinox OSGi 3.7.2 Remote Code Execution via ConsoleEclipse Equinox OSGi
- CVE-2023-54342Eclipse Equinox OSGi 3.8-3.18 Console Remote Code ExecutionEclipse Equinox OSGi
- CVE-2026-40797WordPress WebinarIgnition plugin <= 4.08.253 - SQL Injection vulnerabilitySaleswonder WebinarIgnition
- CVE-2026-7823Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injectionTotolink A8000RU
- CVE-2026-5294GeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Actionahmadgb GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Ge…
- CVE-2025-13618Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registrationdreamstechnologies Mentoring
- CVE-2026-5722MoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token ReuseMoreConvert Pro
- CVE-2026-34408An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0).
- CVE-2026-36356The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injec
- CVE-2026-38428Kestra v1.3.3 and before is vulnerable to SQL Injection.
- CVE-2026-38429OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplie
- CVE-2026-38431ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI).
High 76
- CVE-2026-40934jupyter-server authentication cookies remain valid after password reset due to static cookie secretjupyter-server jupyter_server · jupyter-server
- CVE-2026-40110jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_patjupyter-server jupyter_server · jupyter-server
- CVE-2026-40075OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServletopenmrs-core · org.openmrs.web:openmrs-web
- CVE-2026-39852Quarkus authorization bypass via semicolon path normalization inconsistencyquarkusio quarkus · io.quarkus:quarkus-vertx-http
- CVE-2026-40068Claude Code arbitrary code execution via git worktree commondir trust dialog bypassanthropics claude-code · @anthropic-ai/claude-code
- CVE-2026-39849Pi-hole FTL remote code execution via newline injection in dns.interface configurationpi-hole FTL
- CVE-2026-35579CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transportscoredns · github.com/coredns/coredns
- CVE-2026-40280Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-listsgotenberg · github.com/gotenberg/gotenberg/v8 +1
- CVE-2026-44331In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remProFTPD
- CVE-2026-35397jupyter-server path traversal allows access to sibling directories sharing root_dir name prefixjupyter-server jupyter_server · jupyter-server
- CVE-2026-34464Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server fieldsandboxie-plus Sandboxie
- CVE-2026-34462Sandboxie-Plus ProcessServer boxname stack buffer overflows via unterminated wide string copysandboxie-plus Sandboxie
- CVE-2026-34461Sandboxie-Plus SbieIniServer RunSbieCtrl stack buffer overflow allows local privilege escalationsandboxie-plus Sandboxie
- CVE-2026-34459Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlavesandboxie-plus Sandboxie
- CVE-2026-33975twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalizationtwentyhq twenty
- CVE-2026-7857D-Link DI-8100 CGI user_group.asp sprintf buffer overflowD-Link DI-8100
- CVE-2026-33489CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparisoncoredns · github.com/coredns/coredns
- CVE-2026-32936CoreDNS DoH GET path missing size validation causes CPU and memory amplificationcoredns · github.com/coredns/coredns
- CVE-2026-32934CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of servicecoredns · github.com/coredns/coredns
- CVE-2026-33190CoreDNS TSIG authentication bypass on encrypted DNS transportscoredns · github.com/coredns/coredns
- CVE-2026-7856D-Link DI-8100 Web Management url_member.asp buffer overflowD-Link DI-8100
- CVE-2026-32603Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed processsandboxie-plus Sandboxie
- CVE-2026-30923libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query stringsowasp-modsecurity ModSecurity
- CVE-2026-7855D-Link DI-8100 HTTP Request tggl.asp tggl_asp buffer overflowD-Link DI-8100
- CVE-2026-7851D-Link DI-8100 yyxz.asp sprintf stack-based overflowD-Link DI-8100
- CVE-2026-25589RedisBloom RESTORE invalid memory access may allow remote code executionRedisBloom
- CVE-2026-25588RedisTimeSeries RESTORE invalid memory access may allow remote code executionRedisTimeSeries
- CVE-2026-25243redis-server RESTORE invalid memory access may allow remote code executionredis
- CVE-2026-23479redis-server use-after-free in unblock client flow may allow remote code executionredis
- CVE-2026-43070bpf: Reset register ID for BPF_END value trackingLinux
- CVE-2026-43063xfs: don't irele after failing to iget in xfs_attri_recover_workLinux
- CVE-2026-32689Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenixphoenixframework phoenix
- CVE-2026-43062Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()Linux
- CVE-2026-43060netfilter: nft_ct: drop pending enqueued packets on removalLinux
- CVE-2026-7865Hidden Console CommandCrestron Electronics Touchpanels
- CVE-2026-7412In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination UREclipse Foundation Eclipse BaSyx · org.eclipse.basyx:basyx.…
- CVE-2026-4304WeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' ParameterWeePie Cookie Allow
- CVE-2026-29168Apache HTTP Server: mod_md unrestricted OCSP responseApache Software Foundation Apache HTTP Server
- CVE-2026-7833EFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injectionEFM ipTIME C200
- CVE-2026-6918In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.Eclipse Foundation Eclipse OpenJ9
- CVE-2026-7832IObit Advanced SystemCare Service ASC.exe symlinkIObit Advanced SystemCare
- CVE-2026-43571OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel SetupOpenClaw
- CVE-2026-43569OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider AuthOpenClaw
- CVE-2026-43568OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming EndpointOpenClaw
- CVE-2026-43567OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath ParameterOpenClaw
- CVE-2026-43535OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue BatchesOpenClaw
- CVE-2026-43533OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media TagsOpenClaw
- CVE-2026-43531OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env FileOpenClaw
- CVE-2026-43530OpenClaw 2026.2.23 < 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet ExecutionOpenClaw
- CVE-2026-6261Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack UploadMuffinGroup Betheme
- CVE-2026-43528OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig AliasesOpenClaw
- CVE-2026-43526OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL HandlingOpenClaw
- CVE-2026-42437OpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime PathOpenClaw
- CVE-2026-42435OpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment InjectionOpenClaw
- CVE-2026-42434OpenClaw 2026.4.5 < 2026.4.10 - Sandbox Escape via host Parameter Override in Exec RoutingOpenClaw
- CVE-2026-42433OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message ToolsOpenClaw
- CVE-2023-54348ERPGo SaaS 3.9 CSV Injection via Vendor CreationRajodiya ERPGo SaaS
- CVE-2023-54347OpenEMR 7.0.1 Authentication Brute Force Mitigation BypassOpen-Emr OpenEMR
- CVE-2023-54346WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup DownloadBackupbliss WordPress Plugin Backup Migration
- CVE-2023-54345Frappe Framework ERPNext 13.4.0 Remote Code ExecutionFrappe Technologies Frappe Framework
- CVE-2026-6322fast-uri vulnerable to host confusion via percent-encoded authority delimitersfast-uri
- CVE-2026-43870Apache Thrift: Node.js web_server.js multi-vulnerabilityApache Software Foundation Apache Thrift · thrift
- CVE-2026-3359Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-43869Apache Thrift: TSSLTransportFactory.java hostname verificationApache Software Foundation Apache Thrift · org.apache.thrif…
- CVE-2026-5192Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'wpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-4803Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_metawproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-3456GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'ahmadgb GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Ge…
- CVE-2026-35228Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component: helper tool).Oracle MCP Server Helper Tool product of Oracle Open Source…
- CVE-2026-5100AWP Classifieds <= 4.4.5 - Unauthenticated SQL Injection via 'regions'strategy11team AWP Classifieds
- CVE-2026-44028An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2.NixOS Nix · Lix Project Lix
- CVE-2024-52911Bitcoin Core through 28.x has a security issue, the details of which are not disclosed.
- CVE-2025-66369An issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380,
- CVE-2026-31195OS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router
- CVE-2026-31196OS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre R
- CVE-2026-36355The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access contro
- CVE-2026-42997An issue was discovered in idrac in OpenStack Ironic before 35.0.1.OpenStack Ironic · ironic-python-agent
Medium, low and unrated 87
- CVE-2026-44405In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.Paramiko
- CVE-2026-39402lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletionlxc
- CVE-2026-39383Gotenberg unauthenticated blind SSRF via unfiltered webhook URLgotenberg · github.com/gotenberg/gotenberg/v8 +1
- CVE-2026-41950Dify < 1.14.0 Authorization Bypass via File UUIDlanggenius dify
- CVE-2026-35527Incus blind SSRF via image import preflight HEAD requestlxc incus · github.com/lxc/incus +3
- CVE-2026-35453PhpSpreadsheet XSS via number format text substitution in HTML WriterPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-34596Sandboxie-Plus local privilege escalation via TOCTOU race condition in UpdUtil addon installationsandboxie-plus Sandboxie
- CVE-2026-34527Sandboxie-Plus EditPassword hash entropy reduced from 160 bits to 80 bits due to incorrect nibble extractionsandboxie-plus Sandboxie
- CVE-2026-33420Vaultwarden missing authorization check allows Manager-role users to enumerate all collectionsdani-garcia vaultwarden
- CVE-2026-32699FacturaScripts unauthorized modification of immutable nick field via EditUser controllerNeoRazorX facturascripts · facturascripts/facturascripts
- CVE-2026-31893Tunnelblick arbitrary file read via symlink following in tunnelblickdTunnelblick
- CVE-2026-31835Vaultwarden WebAuthn credential metadata tampered before signature verificationdani-garcia vaultwarden
- CVE-2026-23631redis-server Lua use-after-free may allow remote code executionredis
- CVE-2026-7847chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random valueschatchat-space Langchain-Chatchat · langchain-chatchat
- CVE-2026-7846chatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctouchatchat-space Langchain-Chatchat · langchain-chatchat
- CVE-2026-7845chatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hashchatchat-space Langchain-Chatchat · langchain-chatchat
- CVE-2026-34956Openvswitch: open vswitch: denial of service via malformed ftp epasv commandRed Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2
- CVE-2026-43073x86-64: rename misleadingly named '__copy_user_nocache()' functionLinux
- CVE-2026-43072drm/vc4: platform_get_irq_byname() returns an intLinux
- CVE-2025-61669jupyter_server next parameter open redirect can redirect users to external domainsjupyter-server jupyter_server · jupyter-server
- CVE-2026-43069Bluetooth: hci_ll: Fix firmware leak on error pathLinux
- CVE-2026-43068ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()Linux
- CVE-2026-43066ext4: fix iloc.bh leak in ext4_fc_replay_inode() error pathsLinux
- CVE-2026-43065ext4: always drain queued discard work in ext4_mb_release()Linux
- CVE-2026-43064dmaengine: idxd: Fix not releasing workqueue on .release()Linux
- CVE-2026-43061serial: 8250: Fix TX deadlock when using DMALinux
- CVE-2026-43059Bluetooth: MGMT: Fix list corruption and UAF in command complete handlersLinux
- CVE-2026-7844chatchat-space Langchain-Chatchat Compatible File Service openai_routes.py delete_file missing authenticationchatchat-space Langchain-Chatchat
- CVE-2026-35192Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUESTdjangoproject Django · django
- CVE-2026-6907Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddlewaredjangoproject Django · django
- CVE-2026-5766Potential denial-of-service vulnerability in ASGI requests via file upload limit bypassdjangoproject Django · django
- CVE-2026-34002Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handlingRed Hat Enterprise Linux 10.0 Extended Update Support ·… +14
- CVE-2026-34000Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.Red Hat Enterprise Linux 10.0 Extended Update Support ·… +10
- CVE-2026-7778runZero Platform dashboard configuration exposurerunZero Platform
- CVE-2026-30246github.com/gofiber/fiber/v3 cache middleware can mix responses across query parametersgofiber fiber · github.com/gofiber/fiber/v3
- CVE-2026-28510elabftw allows MFA bypass during loginelabftw
- CVE-2026-27694traccar allows stored HTML injection in notification emailstraccar
- CVE-2026-27693traccar allows XML injection in KML and GPX exportstraccar
- CVE-2026-27644traccar allows CSV formula injection via exported position datatraccar
- CVE-2026-43574OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver ListsOpenClaw
- CVE-2026-43573OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction RoutesOpenClaw
- CVE-2026-43572OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke HandlerOpenClaw
- CVE-2026-43570OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path HandlingOpenClaw
- CVE-2026-43532OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover ImageOpenClaw
- CVE-2026-43529OpenClaw < 2026.4.10 - Time-of-Check-Time-of-Use (TOCTOU) Race Condition in exec Script Preflight ValidatorOpenClaw
- CVE-2026-6262Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'MuffinGroup Betheme
- CVE-2026-43527OpenClaw < 2026.4.14 - Server-Side Request Forgery via Private Network NavigationOpenClaw
- CVE-2026-42439OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action RoutesOpenClaw
- CVE-2026-42438OpenClaw 2026.4.9 < 2026.4.10 - Sender Policy Bypass in Host Media Attachment ReadsOpenClaw
- CVE-2026-42436OpenClaw < 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot RoutesOpenClaw
- CVE-2023-54349AmazCart CMS 3.4 Reflected Cross-Site Scripting via SearchSpondonit AmazCart CMS
- CVE-2025-42611Improper certificate validation in multiple RouterOS servicesMikrotik RouterOS
- CVE-2026-3601User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modificationwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-43868Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternApache Software Foundation Apache Thrift · thrift
- CVE-2026-2729Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameterwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-3454GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacementsedge22 GenerateBlocks
- CVE-2026-7824PaperCut Hive (Ricoh): Plain text password in logsPaperCut Hive
- CVE-2026-6418PaperCut NG/MF: Path Traversal in Shared Account SynchronizationPaperCut NG/MF
- CVE-2026-6180PaperCut MF: Card truncation on HP readersPaperCut NG/MF
- CVE-2026-7822itsourcecode Courier Management System print_pdets.php sql injectionitsourcecode Courier Management System
- CVE-2026-4362ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwriteroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2026-781254yyyu code-mcp MCP Tool server.py git_operation command injection54yyyu code-mcp
- CVE-2026-781154yyyu code-mcp MCP File server.py is_safe_path path traversal54yyyu code-mcp
- CVE-2026-7810UsamaK98 python-notebook-mcp server.py add_cell path traversalUsamaK98 python-notebook-mcp
- CVE-2026-5159Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameterwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-4665WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attributeshapedplugin Carousel, Slider, Photo Gallery with Lightbox,…
- CVE-2026-5957EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameterroxnor EmailKit – Email Customizer for WooCommerce & WP
- CVE-2026-2948Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'jegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons…
- CVE-2026-1921Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parametertimwhitlock Loco Translate
- CVE-2026-5505WP-Clippy <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesbitacre WP-Clippy
- CVE-2026-6255Simple Owl Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attributesszdh Simple Owl Shortcodes
- CVE-2026-6704Blog Settings <= 1.0 - Reflected Cross-Site Scripting via 'page' Parameterphpsandeepkumar Blog Settings
- CVE-2026-2868Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'jegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons…
- CVE-2026-6702Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameterfoux Publish 2 Ping.fm
- CVE-2026-6700DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Updatexavortm DX Sources
- CVE-2026-5247Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode AttributeSchedule Post Changes With PublishPress Future: Unpublish,…
- CVE-2026-4409Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Managementwpkube Subscribe To Comments Reloaded
- CVE-2026-6696Zingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' ParameterZingaya Click-to-Call
- CVE-2026-4730Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attributecommonninja Charts Ninja: Create Beautiful Graphs & Charts…
- CVE-2026-6701addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Pagekazunii addfreespace
- CVE-2026-44029An issue was discovered in Nix before 2.34.7.NixOS Nix
- CVE-2026-7788Axle-Bucamp MCP-Docusaurus document.py get_content path traversalAxle-Bucamp MCP-Docusaurus
- CVE-2025-52206ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.
- CVE-2026-38432ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine.
- CVE-2026-38947FluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin.
- CVE-2026-39103Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of servic
- CVE-2026-43002An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3.OpenStack Horizon · horizon