# CVEs published 2026-05-05

191 CVEs were published on May 5, 2026: 28 critical, 76 high. Days are UTC.

- [CVE-2026-44405](https://cve.now/CVE-2026-44405.md): In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm. (CVSS 3.4, Paramiko)
- [CVE-2026-40934](https://cve.now/CVE-2026-40934.md): jupyter-server authentication cookies remain valid after password reset due to static cookie secret (CVSS 7.6, jupyter-server jupyter\_server · jupyter-server)
- [CVE-2026-28780](https://cve.now/CVE-2026-28780.md): Apache HTTP Server: buffer overflow in mod\_proxy\_ajp via ajp\_msg\_check\_header() (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-40110](https://cve.now/CVE-2026-40110.md): jupyter-server CORS origin validation bypass via unanchored regex in allow\_origin\_pat (CVSS 7.6, jupyter-server jupyter\_server · jupyter-server)
- [CVE-2026-40075](https://cve.now/CVE-2026-40075.md): OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet (CVSS 8.2, openmrs-core · org.openmrs.web:openmrs-web)
- [CVE-2026-39852](https://cve.now/CVE-2026-39852.md): Quarkus authorization bypass via semicolon path normalization inconsistency (CVSS 8.8, quarkusio quarkus · io.quarkus:quarkus-vertx-http)
- [CVE-2026-40068](https://cve.now/CVE-2026-40068.md): Claude Code arbitrary code execution via git worktree commondir trust dialog bypass (CVSS 7.7, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2026-39849](https://cve.now/CVE-2026-39849.md): Pi-hole FTL remote code execution via newline injection in dns.interface configuration (CVSS 8.7, pi-hole FTL)
- [CVE-2026-39402](https://cve.now/CVE-2026-39402.md): lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion (CVSS 4.3, lxc)
- [CVE-2026-39383](https://cve.now/CVE-2026-39383.md): Gotenberg unauthenticated blind SSRF via unfiltered webhook URL (CVSS 6.9, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-41950](https://cve.now/CVE-2026-41950.md): Dify \< 1.14.0 Authorization Bypass via File UUID (CVSS 6.0, langgenius dify)
- [CVE-2026-35579](https://cve.now/CVE-2026-35579.md): CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports (CVSS 8.2, coredns · github.com/coredns/coredns)
- [CVE-2026-35527](https://cve.now/CVE-2026-35527.md): Incus blind SSRF via image import preflight HEAD request (CVSS 5.3, lxc incus · github.com/lxc/incus +3)
- [CVE-2026-40280](https://cve.now/CVE-2026-40280.md): Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists (CVSS 7.8, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-40331](https://cve.now/CVE-2026-40331.md): Masa CMS unauthenticated SQL injection via altTable parameter in JSON API (CVSS 9.3, MasaCMS)
- [CVE-2026-40330](https://cve.now/CVE-2026-40330.md): Masa CMS SQL injection via sortDirection parameter in beanFeed (CVSS 9.3, MasaCMS)
- [CVE-2026-40329](https://cve.now/CVE-2026-40329.md): SQL Injection vulnerability via sortBy in beanFeed (CVSS 9.3, MasaCMS)
- [CVE-2026-44331](https://cve.now/CVE-2026-44331.md): In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab\_fetch\_clients\_cb() in contrib/mod\_wrap2\_sql.c allows a rem (CVSS 8.1, ProFTPD)
- [CVE-2026-35453](https://cve.now/CVE-2026-35453.md): PhpSpreadsheet XSS via number format text substitution in HTML Writer (CVSS 4.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-35397](https://cve.now/CVE-2026-35397.md): jupyter-server path traversal allows access to sibling directories sharing root\_dir name prefix (CVSS 7.6, jupyter-server jupyter\_server · jupyter-server)
- [CVE-2026-34596](https://cve.now/CVE-2026-34596.md): Sandboxie-Plus local privilege escalation via TOCTOU race condition in UpdUtil addon installation (CVSS 5.4, sandboxie-plus Sandboxie)
- [CVE-2026-34527](https://cve.now/CVE-2026-34527.md): Sandboxie-Plus EditPassword hash entropy reduced from 160 bits to 80 bits due to incorrect nibble extraction (CVSS 2.0, sandboxie-plus Sandboxie)
- [CVE-2026-34464](https://cve.now/CVE-2026-34464.md): Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server field (CVSS 8.8, sandboxie-plus Sandboxie)
- [CVE-2026-34462](https://cve.now/CVE-2026-34462.md): Sandboxie-Plus ProcessServer boxname stack buffer overflows via unterminated wide string copy (CVSS 7.3, sandboxie-plus Sandboxie)
- [CVE-2026-34461](https://cve.now/CVE-2026-34461.md): Sandboxie-Plus SbieIniServer RunSbieCtrl stack buffer overflow allows local privilege escalation (CVSS 7.3, sandboxie-plus Sandboxie)
- [CVE-2026-34459](https://cve.now/CVE-2026-34459.md): Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave (CVSS 8.8, sandboxie-plus Sandboxie)
- [CVE-2026-34458](https://cve.now/CVE-2026-34458.md): Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly (CVSS 9.3, sandboxie-plus Sandboxie)
- [CVE-2026-34084](https://cve.now/CVE-2026-34084.md): PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load (CVSS 9.2, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-33975](https://cve.now/CVE-2026-33975.md): twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization (CVSS 8.3, twentyhq twenty)
- [CVE-2026-7857](https://cve.now/CVE-2026-7857.md): D-Link DI-8100 CGI user\_group.asp sprintf buffer overflow (CVSS 8.6, D-Link DI-8100)
- [CVE-2026-33489](https://cve.now/CVE-2026-33489.md): CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison (CVSS 8.2, coredns · github.com/coredns/coredns)
- [CVE-2026-33420](https://cve.now/CVE-2026-33420.md): Vaultwarden missing authorization check allows Manager-role users to enumerate all collections (CVSS 5.3, dani-garcia vaultwarden)
- [CVE-2026-33324](https://cve.now/CVE-2026-33324.md): SQLBot prompt injection allows arbitrary SQL execution and remote code execution (CVSS 9.4, dataease SQLBot)
- [CVE-2026-32936](https://cve.now/CVE-2026-32936.md): CoreDNS DoH GET path missing size validation causes CPU and memory amplification (CVSS 8.7, coredns · github.com/coredns/coredns)
- [CVE-2026-32934](https://cve.now/CVE-2026-32934.md): CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service (CVSS 8.7, coredns · github.com/coredns/coredns)
- [CVE-2026-33190](https://cve.now/CVE-2026-33190.md): CoreDNS TSIG authentication bypass on encrypted DNS transports (CVSS 8.7, coredns · github.com/coredns/coredns)
- [CVE-2026-32699](https://cve.now/CVE-2026-32699.md): FacturaScripts unauthorized modification of immutable nick field via EditUser controller (CVSS 5.3, NeoRazorX facturascripts · facturascripts/facturascripts)
- [CVE-2026-7856](https://cve.now/CVE-2026-7856.md): D-Link DI-8100 Web Management url\_member.asp buffer overflow (CVSS 8.6, D-Link DI-8100)
- [CVE-2026-32603](https://cve.now/CVE-2026-32603.md): Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed process (CVSS 8.2, sandboxie-plus Sandboxie)
- [CVE-2026-31893](https://cve.now/CVE-2026-31893.md): Tunnelblick arbitrary file read via symlink following in tunnelblickd (CVSS 6.8, Tunnelblick)
- [CVE-2026-31835](https://cve.now/CVE-2026-31835.md): Vaultwarden WebAuthn credential metadata tampered before signature verification (CVSS 5.3, dani-garcia vaultwarden)
- [CVE-2026-30923](https://cve.now/CVE-2026-30923.md): libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings (CVSS 8.2, owasp-modsecurity ModSecurity)
- [CVE-2026-27960](https://cve.now/CVE-2026-27960.md): OpenCTI privilege escalation and unauthenticated access via default admin account (CVSS 9.8, OpenCTI-Platform opencti · pycti)
- [CVE-2026-7855](https://cve.now/CVE-2026-7855.md): D-Link DI-8100 HTTP Request tggl.asp tggl\_asp buffer overflow (CVSS 8.7, D-Link DI-8100)
- [CVE-2026-7854](https://cve.now/CVE-2026-7854.md): D-Link DI-8100 POST Parameter url\_rule.asp url\_rule\_asp buffer overflow (CVSS 9.3, D-Link DI-8100)
- [CVE-2026-7853](https://cve.now/CVE-2026-7853.md): D-Link DI-8100 HTTP auto\_reboot.asp sprintf buffer overflow (CVSS 9.3, D-Link DI-8100)
- [CVE-2026-7851](https://cve.now/CVE-2026-7851.md): D-Link DI-8100 yyxz.asp sprintf stack-based overflow (CVSS 8.6, D-Link DI-8100)
- [CVE-2026-25589](https://cve.now/CVE-2026-25589.md): RedisBloom RESTORE invalid memory access may allow remote code execution (CVSS 7.7, RedisBloom)
- [CVE-2026-25588](https://cve.now/CVE-2026-25588.md): RedisTimeSeries RESTORE invalid memory access may allow remote code execution (CVSS 7.7, RedisTimeSeries)
- [CVE-2026-25243](https://cve.now/CVE-2026-25243.md): redis-server RESTORE invalid memory access may allow remote code execution (CVSS 7.7, redis)
- [CVE-2026-23631](https://cve.now/CVE-2026-23631.md): redis-server Lua use-after-free may allow remote code execution (CVSS 6.1, redis)
- [CVE-2026-23479](https://cve.now/CVE-2026-23479.md): redis-server use-after-free in unblock client flow may allow remote code execution (CVSS 7.7, redis)
- [CVE-2026-7847](https://cve.now/CVE-2026-7847.md): chatchat-space Langchain-Chatchat Uploaded File openai\_routes.py \_get\_file\_id random values (CVSS 2.1, chatchat-space Langchain-Chatchat · langchain-chatchat)
- [CVE-2026-7846](https://cve.now/CVE-2026-7846.md): chatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai\_routes.py files toctou (CVSS 2.1, chatchat-space Langchain-Chatchat · langchain-chatchat)
- [CVE-2026-7845](https://cve.now/CVE-2026-7845.md): chatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hash (CVSS 2.1, chatchat-space Langchain-Chatchat · langchain-chatchat)
- [CVE-2026-34956](https://cve.now/CVE-2026-34956.md): Openvswitch: open vswitch: denial of service via malformed ftp epasv command (CVSS 5.9, Red Hat Fast Datapath for RHEL · Red Hat Enterprise Linux +2)
- [CVE-2026-43073](https://cve.now/CVE-2026-43073.md): x86-64: rename misleadingly named '\_\_copy\_user\_nocache()' function (no CVSS, Linux)
- [CVE-2026-43072](https://cve.now/CVE-2026-43072.md): drm/vc4: platform\_get\_irq\_byname() returns an int (no CVSS, Linux)
- [CVE-2026-43071](https://cve.now/CVE-2026-43071.md): dcache: Limit the minimal number of bucket to two (CVSS 9.1, Linux)
- [CVE-2025-61669](https://cve.now/CVE-2025-61669.md): jupyter\_server next parameter open redirect can redirect users to external domains (CVSS 6.3, jupyter-server jupyter\_server · jupyter-server)
- [CVE-2026-43070](https://cve.now/CVE-2026-43070.md): bpf: Reset register ID for BPF\_END value tracking (CVSS 7.8, Linux)
- [CVE-2026-43069](https://cve.now/CVE-2026-43069.md): Bluetooth: hci\_ll: Fix firmware leak on error path (no CVSS, Linux)
- [CVE-2026-43068](https://cve.now/CVE-2026-43068.md): ext4: avoid allocate block from corrupted group in ext4\_mb\_find\_by\_goal() (no CVSS, Linux)
- [CVE-2026-43067](https://cve.now/CVE-2026-43067.md): ext4: handle wraparound when searching for blocks for indirect mapped blocks (CVSS 9.8, Linux)
- [CVE-2026-43066](https://cve.now/CVE-2026-43066.md): ext4: fix iloc.bh leak in ext4\_fc\_replay\_inode() error paths (no CVSS, Linux)
- [CVE-2026-43065](https://cve.now/CVE-2026-43065.md): ext4: always drain queued discard work in ext4\_mb\_release() (no CVSS, Linux)
- [CVE-2026-43064](https://cve.now/CVE-2026-43064.md): dmaengine: idxd: Fix not releasing workqueue on .release() (no CVSS, Linux)
- [CVE-2026-43063](https://cve.now/CVE-2026-43063.md): xfs: don't irele after failing to iget in xfs\_attri\_recover\_work (CVSS 7.8, Linux)
- [CVE-2026-32689](https://cve.now/CVE-2026-32689.md): Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix (CVSS 8.7, phoenixframework phoenix)
- [CVE-2026-43062](https://cve.now/CVE-2026-43062.md): Bluetooth: L2CAP: Fix type confusion in l2cap\_ecred\_reconf\_rsp() (CVSS 7.1, Linux)
- [CVE-2026-43061](https://cve.now/CVE-2026-43061.md): serial: 8250: Fix TX deadlock when using DMA (no CVSS, Linux)
- [CVE-2026-43060](https://cve.now/CVE-2026-43060.md): netfilter: nft\_ct: drop pending enqueued packets on removal (CVSS 7.8, Linux)
- [CVE-2026-43059](https://cve.now/CVE-2026-43059.md): Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (no CVSS, Linux)
- [CVE-2026-7865](https://cve.now/CVE-2026-7865.md): Hidden Console Command (CVSS 7.4, Crestron Electronics Touchpanels)
- [CVE-2026-7844](https://cve.now/CVE-2026-7844.md): chatchat-space Langchain-Chatchat Compatible File Service openai\_routes.py delete\_file missing authentication (CVSS 5.3, chatchat-space Langchain-Chatchat)
- [CVE-2026-35192](https://cve.now/CVE-2026-35192.md): Session fixation via public cached pages and SESSION\_SAVE\_EVERY\_REQUEST (CVSS 2.3, djangoproject Django · django)
- [CVE-2026-6907](https://cve.now/CVE-2026-6907.md): Potential exposure of private data due to incorrect handling of Vary: \* in UpdateCacheMiddleware (CVSS 4.3, djangoproject Django · django)
- [CVE-2026-5766](https://cve.now/CVE-2026-5766.md): Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (CVSS 5.3, djangoproject Django · django)
- [CVE-2026-34002](https://cve.now/CVE-2026-34002.md): Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling (CVSS 6.1, Red Hat Enterprise Linux 10.0 Extended Update Support ·… +14)
- [CVE-2026-34000](https://cve.now/CVE-2026-34000.md): Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing. (CVSS 6.1, Red Hat Enterprise Linux 10.0 Extended Update Support ·… +10)
- [CVE-2026-7412](https://cve.now/CVE-2026-7412.md): In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination UR (CVSS 8.6, Eclipse Foundation Eclipse BaSyx · org.eclipse.basyx:basyx.…)
- [CVE-2026-7411](https://cve.now/CVE-2026-7411.md): In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unau (CVSS 10.0, Eclipse Foundation Eclipse BaSyx · org.eclipse.basyx:basyx.…)
- [CVE-2026-7834](https://cve.now/CVE-2026-7834.md): EFM ipTIME NAS1dual misc\_main.cgi get\_csrf\_whites stack-based overflow (CVSS 9.3, EFM ipTIME NAS1dual)
- [CVE-2026-7778](https://cve.now/CVE-2026-7778.md): runZero Platform dashboard configuration exposure (CVSS 5.0, runZero Platform)
- [CVE-2026-4304](https://cve.now/CVE-2026-4304.md): WeePie Cookie Allow \<= 3.4.11 - Unauthenticated SQL Injection via 'consent' Parameter (CVSS 7.5, WeePie Cookie Allow)
- [CVE-2026-29168](https://cve.now/CVE-2026-29168.md): Apache HTTP Server: mod\_md unrestricted OCSP response (CVSS 7.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2026-30246](https://cve.now/CVE-2026-30246.md): github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters (CVSS 6.5, gofiber fiber · github.com/gofiber/fiber/v3)
- [CVE-2026-7833](https://cve.now/CVE-2026-7833.md): EFM ipTIME C200 ApplyRestore Endpoint iux\_set.cgi sub\_408F90 command injection (CVSS 8.6, EFM ipTIME C200)
- [CVE-2026-6918](https://cve.now/CVE-2026-6918.md): In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message. (CVSS 8.7, Eclipse Foundation Eclipse OpenJ9)
- [CVE-2026-28510](https://cve.now/CVE-2026-28510.md): elabftw allows MFA bypass during login (CVSS 5.9, elabftw)
- [CVE-2026-27694](https://cve.now/CVE-2026-27694.md): traccar allows stored HTML injection in notification emails (CVSS 5.4, traccar)
- [CVE-2026-27693](https://cve.now/CVE-2026-27693.md): traccar allows XML injection in KML and GPX exports (CVSS 5.4, traccar)
- [CVE-2026-7832](https://cve.now/CVE-2026-7832.md): IObit Advanced SystemCare Service ASC.exe symlink (CVSS 7.3, IObit Advanced SystemCare)
- [CVE-2026-27644](https://cve.now/CVE-2026-27644.md): traccar allows CSV formula injection via exported position data (CVSS 6.5, traccar)
- [CVE-2026-43574](https://cve.now/CVE-2026-43574.md): OpenClaw \< 2026.4.12 - Improper Authorization via Empty Approver Lists (CVSS 6.0, OpenClaw)
- [CVE-2026-43573](https://cve.now/CVE-2026-43573.md): OpenClaw \< 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes (CVSS 4.9, OpenClaw)
- [CVE-2026-43572](https://cve.now/CVE-2026-43572.md): OpenClaw 2026.4.10 \< 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler (CVSS 6.3, OpenClaw)
- [CVE-2026-43571](https://cve.now/CVE-2026-43571.md): OpenClaw \< 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup (CVSS 7.7, OpenClaw)
- [CVE-2026-43570](https://cve.now/CVE-2026-43570.md): OpenClaw 2026.3.22 \< 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling (CVSS 6.0, OpenClaw)
- [CVE-2026-43569](https://cve.now/CVE-2026-43569.md): OpenClaw \< 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Auth (CVSS 7.7, OpenClaw)
- [CVE-2026-43568](https://cve.now/CVE-2026-43568.md): OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint (CVSS 7.1, OpenClaw)
- [CVE-2026-43567](https://cve.now/CVE-2026-43567.md): OpenClaw \< 2026.4.10 - Path Traversal in screen\_record outPath Parameter (CVSS 7.1, OpenClaw)
- [CVE-2026-43566](https://cve.now/CVE-2026-43566.md): OpenClaw 2026.4.7 \< 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events (CVSS 9.1, OpenClaw)
- [CVE-2026-43535](https://cve.now/CVE-2026-43535.md): OpenClaw \< 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches (CVSS 7.6, OpenClaw)
- [CVE-2026-43534](https://cve.now/CVE-2026-43534.md): OpenClaw \< 2026.4.10 - Unsanitized External Input in Agent Hook Events (CVSS 9.3, OpenClaw)
- [CVE-2026-43533](https://cve.now/CVE-2026-43533.md): OpenClaw \< 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags (CVSS 8.9, OpenClaw)
- [CVE-2026-43532](https://cve.now/CVE-2026-43532.md): OpenClaw 2026.4.7 \< 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image (CVSS 4.9, OpenClaw)
- [CVE-2026-43531](https://cve.now/CVE-2026-43531.md): OpenClaw \< 2026.4.9 - Environment Variable Injection via Workspace .env File (CVSS 7.0, OpenClaw)
- [CVE-2026-43530](https://cve.now/CVE-2026-43530.md): OpenClaw 2026.2.23 \< 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet Execution (CVSS 8.7, OpenClaw)
- [CVE-2026-43529](https://cve.now/CVE-2026-43529.md): OpenClaw \< 2026.4.10 - Time-of-Check-Time-of-Use (TOCTOU) Race Condition in exec Script Preflight Validator (CVSS 2.0, OpenClaw)
- [CVE-2026-6261](https://cve.now/CVE-2026-6261.md): Betheme \<= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload (CVSS 8.8, MuffinGroup Betheme)
- [CVE-2026-6262](https://cve.now/CVE-2026-6262.md): Betheme \<= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload' (CVSS 6.5, MuffinGroup Betheme)
- [CVE-2026-43528](https://cve.now/CVE-2026-43528.md): OpenClaw \< 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases (CVSS 7.1, OpenClaw)
- [CVE-2026-43527](https://cve.now/CVE-2026-43527.md): OpenClaw \< 2026.4.14 - Server-Side Request Forgery via Private Network Navigation (CVSS 6.3, OpenClaw)
- [CVE-2026-43526](https://cve.now/CVE-2026-43526.md): OpenClaw \< 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling (CVSS 8.3, OpenClaw)
- [CVE-2026-42439](https://cve.now/CVE-2026-42439.md): OpenClaw \< 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes (CVSS 4.9, OpenClaw)
- [CVE-2026-42438](https://cve.now/CVE-2026-42438.md): OpenClaw 2026.4.9 \< 2026.4.10 - Sender Policy Bypass in Host Media Attachment Reads (CVSS 4.9, OpenClaw)
- [CVE-2026-42437](https://cve.now/CVE-2026-42437.md): OpenClaw 2026.4.9 \< 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path (CVSS 8.2, OpenClaw)
- [CVE-2026-42436](https://cve.now/CVE-2026-42436.md): OpenClaw \< 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot Routes (CVSS 4.9, OpenClaw)
- [CVE-2026-42435](https://cve.now/CVE-2026-42435.md): OpenClaw 2026.2.22 \< 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment Injection (CVSS 8.7, OpenClaw)
- [CVE-2026-42434](https://cve.now/CVE-2026-42434.md): OpenClaw 2026.4.5 \< 2026.4.10 - Sandbox Escape via host Parameter Override in Exec Routing (CVSS 8.7, OpenClaw)
- [CVE-2026-42433](https://cve.now/CVE-2026-42433.md): OpenClaw \< 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools (CVSS 7.1, OpenClaw)
- [CVE-2023-54349](https://cve.now/CVE-2023-54349.md): AmazCart CMS 3.4 Reflected Cross-Site Scripting via Search (CVSS 5.1, Spondonit AmazCart CMS)
- [CVE-2023-54348](https://cve.now/CVE-2023-54348.md): ERPGo SaaS 3.9 CSV Injection via Vendor Creation (CVSS 8.7, Rajodiya ERPGo SaaS)
- [CVE-2023-54347](https://cve.now/CVE-2023-54347.md): OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass (CVSS 8.7, Open-Emr OpenEMR)
- [CVE-2023-54346](https://cve.now/CVE-2023-54346.md): WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download (CVSS 8.7, Backupbliss WordPress Plugin Backup Migration)
- [CVE-2023-54345](https://cve.now/CVE-2023-54345.md): Frappe Framework ERPNext 13.4.0 Remote Code Execution (CVSS 8.7, Frappe Technologies Frappe Framework)
- [CVE-2023-54344](https://cve.now/CVE-2023-54344.md): Eclipse Equinox OSGi 3.7.2 Remote Code Execution via Console (CVSS 9.3, Eclipse Equinox OSGi)
- [CVE-2023-54342](https://cve.now/CVE-2023-54342.md): Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution (CVSS 9.3, Eclipse Equinox OSGi)
- [CVE-2025-42611](https://cve.now/CVE-2025-42611.md): Improper certificate validation in multiple RouterOS services (CVSS 6.5, Mikrotik RouterOS)
- [CVE-2026-6322](https://cve.now/CVE-2026-6322.md): fast-uri vulnerable to host confusion via percent-encoded authority delimiters (CVSS 7.5, fast-uri)
- [CVE-2026-3601](https://cve.now/CVE-2026-3601.md): User Registration & Membership \<= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification (CVSS 4.3, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-43868](https://cve.now/CVE-2026-43868.md): Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern (CVSS 5.3, Apache Software Foundation Apache Thrift · thrift)
- [CVE-2026-43870](https://cve.now/CVE-2026-43870.md): Apache Thrift: Node.js web\_server.js multi-vulnerability (CVSS 7.3, Apache Software Foundation Apache Thrift · thrift)
- [CVE-2026-3359](https://cve.now/CVE-2026-3359.md): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.42 - Unauthenticated SQL Injection via 'inputs' (CVSS 7.5, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-43869](https://cve.now/CVE-2026-43869.md): Apache Thrift: TSSLTransportFactory.java hostname verification (CVSS 7.3, Apache Software Foundation Apache Thrift · org.apache.thrif…)
- [CVE-2026-40797](https://cve.now/CVE-2026-40797.md): WordPress WebinarIgnition plugin \<= 4.08.253 - SQL Injection vulnerability (CVSS 9.3, Saleswonder WebinarIgnition)
- [CVE-2026-5192](https://cve.now/CVE-2026-5192.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1\[file\]\[file\_path\]' (CVSS 7.5, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-2729](https://cve.now/CVE-2026-2729.md): Forminator – Contact Form, Payment Form & Custom Form Builder \<= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter (CVSS 5.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-3454](https://cve.now/CVE-2026-3454.md): GenerateBlocks \<= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements (CVSS 6.5, edge22 GenerateBlocks)
- [CVE-2026-7824](https://cve.now/CVE-2026-7824.md): PaperCut Hive (Ricoh): Plain text password in logs (CVSS 5.9, PaperCut Hive)
- [CVE-2026-6418](https://cve.now/CVE-2026-6418.md): PaperCut NG/MF: Path Traversal in Shared Account Synchronization (CVSS 4.6, PaperCut NG/MF)
- [CVE-2026-6180](https://cve.now/CVE-2026-6180.md): PaperCut MF: Card truncation on HP readers (CVSS 4.1, PaperCut NG/MF)
- [CVE-2026-7823](https://cve.now/CVE-2026-7823.md): Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-7822](https://cve.now/CVE-2026-7822.md): itsourcecode Courier Management System print\_pdets.php sql injection (CVSS 5.3, itsourcecode Courier Management System)
- [CVE-2026-4362](https://cve.now/CVE-2026-4362.md): ElementsKit Elementor Addons \<= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite (CVSS 6.5, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2026-7812](https://cve.now/CVE-2026-7812.md): 54yyyu code-mcp MCP Tool server.py git\_operation command injection (CVSS 6.9, 54yyyu code-mcp)
- [CVE-2026-7811](https://cve.now/CVE-2026-7811.md): 54yyyu code-mcp MCP File server.py is\_safe\_path path traversal (CVSS 6.9, 54yyyu code-mcp)
- [CVE-2026-7810](https://cve.now/CVE-2026-7810.md): UsamaK98 python-notebook-mcp server.py add\_cell path traversal (CVSS 6.9, UsamaK98 python-notebook-mcp)
- [CVE-2026-5159](https://cve.now/CVE-2026-5159.md): Royal Addons for Elementor \<= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-4665](https://cve.now/CVE-2026-4665.md): WP Carousel Free \<= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute (CVSS 6.4, shapedplugin Carousel, Slider, Photo Gallery with Lightbox,…)
- [CVE-2026-4803](https://cve.now/CVE-2026-4803.md): Royal Addons for Elementor \<= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr\_update\_form\_action\_meta (CVSS 7.2, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-5957](https://cve.now/CVE-2026-5957.md): EmailKit \<= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter (CVSS 6.5, roxnor EmailKit – Email Customizer for WooCommerce & WP)
- [CVE-2026-2948](https://cve.now/CVE-2026-2948.md): Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem \<= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl' (CVSS 6.4, jegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons…)
- [CVE-2026-5294](https://cve.now/CVE-2026-5294.md): GeekyBot \<= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot\_frontendajax' AJAX Action (CVSS 9.8, ahmadgb GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Ge…)
- [CVE-2026-3456](https://cve.now/CVE-2026-3456.md): GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation \<= 1.2.0 - Unauthenticated SQL Injection via 'attributekey' (CVSS 7.5, ahmadgb GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Ge…)
- [CVE-2026-35228](https://cve.now/CVE-2026-35228.md): Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component: helper tool). (CVSS 8.7, Oracle MCP Server Helper Tool product of Oracle Open Source…)
- [CVE-2026-1921](https://cve.now/CVE-2026-1921.md): Loco Translate \<= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter (CVSS 4.9, timwhitlock Loco Translate)
- [CVE-2026-5505](https://cve.now/CVE-2026-5505.md): WP-Clippy \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, bitacre WP-Clippy)
- [CVE-2026-6255](https://cve.now/CVE-2026-6255.md): Simple Owl Shortcodes \<= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute (CVSS 6.4, sszdh Simple Owl Shortcodes)
- [CVE-2026-6704](https://cve.now/CVE-2026-6704.md): Blog Settings \<= 1.0 - Reflected Cross-Site Scripting via 'page' Parameter (CVSS 6.1, phpsandeepkumar Blog Settings)
- [CVE-2026-2868](https://cve.now/CVE-2026-2868.md): Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem \<= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG' (CVSS 6.4, jegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons…)
- [CVE-2026-6702](https://cve.now/CVE-2026-6702.md): Publish 2 Ping.fm \<= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter (CVSS 6.1, foux Publish 2 Ping.fm)
- [CVE-2026-6700](https://cve.now/CVE-2026-6700.md): DX Sources \<= 2.0.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, xavortm DX Sources)
- [CVE-2026-5247](https://cve.now/CVE-2026-5247.md): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories \<= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute (CVSS 5.5, Schedule Post Changes With PublishPress Future: Unpublish,…)
- [CVE-2026-4409](https://cve.now/CVE-2026-4409.md): Subscribe To Comments Reloaded \<= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management (CVSS 6.5, wpkube Subscribe To Comments Reloaded)
- [CVE-2026-5100](https://cve.now/CVE-2026-5100.md): AWP Classifieds \<= 4.4.5 - Unauthenticated SQL Injection via 'regions' (CVSS 7.5, strategy11team AWP Classifieds)
- [CVE-2025-13618](https://cve.now/CVE-2025-13618.md): Mentoring \<= 1.2.8 - Unauthenticated Privilege Escalation in mentoring\_process\_registration (CVSS 9.8, dreamstechnologies Mentoring)
- [CVE-2026-6696](https://cve.now/CVE-2026-6696.md): Zingaya Click-to-Call \<= 1.0 - Reflected Cross-Site Scripting via 'email' Parameter (CVSS 6.1, Zingaya Click-to-Call)
- [CVE-2026-4730](https://cve.now/CVE-2026-4730.md): Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website \<= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute (CVSS 6.4, commonninja Charts Ninja: Create Beautiful Graphs & Charts…)
- [CVE-2026-6701](https://cve.now/CVE-2026-6701.md): addfreespace \<= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page (CVSS 4.3, kazunii addfreespace)
- [CVE-2026-5722](https://cve.now/CVE-2026-5722.md): MoreConvert Pro \<= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse (CVSS 9.8, MoreConvert Pro)
- [CVE-2026-44029](https://cve.now/CVE-2026-44029.md): An issue was discovered in Nix before 2.34.7. (CVSS 5.3, NixOS Nix)
- [CVE-2026-44028](https://cve.now/CVE-2026-44028.md): An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. (CVSS 7.5, NixOS Nix · Lix Project Lix)
- [CVE-2026-7788](https://cve.now/CVE-2026-7788.md): Axle-Bucamp MCP-Docusaurus document.py get\_content path traversal (CVSS 6.9, Axle-Bucamp MCP-Docusaurus)
- [CVE-2024-52911](https://cve.now/CVE-2024-52911.md): Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. (CVSS 7.5)
- [CVE-2025-52206](https://cve.now/CVE-2025-52206.md): ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. (CVSS 4.7)
- [CVE-2025-66369](https://cve.now/CVE-2025-66369.md): An issue was discovered in MM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, (CVSS 7.5)
- [CVE-2026-31195](https://cve.now/CVE-2026-31195.md): OS command injection vulnerability in the ping diagnostic handler in /bin/httpd\_clientside in ALTICE LABS / SFR France GR140DG Fibre Router (CVSS 8.8)
- [CVE-2026-31196](https://cve.now/CVE-2026-31196.md): OS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd\_clientside in ALTICE LABS / SFR France GR140DG Fibre R (CVSS 8.8)
- [CVE-2026-34408](https://cve.now/CVE-2026-34408.md): An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). (CVSS 9.1)
- [CVE-2026-36355](https://cve.now/CVE-2026-36355.md): The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access contro (CVSS 7.7)
- [CVE-2026-36356](https://cve.now/CVE-2026-36356.md): The GoAhead web server on MeiG Smart FORGE\_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injec (CVSS 9.1)
- [CVE-2026-38428](https://cve.now/CVE-2026-38428.md): Kestra v1.3.3 and before is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2026-38429](https://cve.now/CVE-2026-38429.md): OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplie (CVSS 9.8)
- [CVE-2026-38431](https://cve.now/CVE-2026-38431.md): ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). (CVSS 9.8)
- [CVE-2026-38432](https://cve.now/CVE-2026-38432.md): ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. (CVSS 6.1)
- [CVE-2026-38947](https://cve.now/CVE-2026-38947.md): FluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin. (CVSS 6.1)
- [CVE-2026-39103](https://cve.now/CVE-2026-39103.md): Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of servic (CVSS 5.5)
- [CVE-2026-42997](https://cve.now/CVE-2026-42997.md): An issue was discovered in idrac in OpenStack Ironic before 35.0.1. (CVSS 7.7, OpenStack Ironic · ironic-python-agent)
- [CVE-2026-43002](https://cve.now/CVE-2026-43002.md): An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. (CVSS 5.3, OpenStack Horizon · horizon)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.