# CVEs published 2026-05-07

203 CVEs were published on May 7, 2026: 26 critical, 85 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-8117](https://cve.now/CVE-2026-8117.md): SourceCodester Pizzafy Ecommerce System index.php cross site scripting (CVSS 5.3, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-8116](https://cve.now/CVE-2026-8116.md): huangjunsen0406 xiaozhi-mcphub dxtController.ts path traversal (CVSS 5.3, huangjunsen0406 xiaozhi-mcphub)
- [CVE-2026-8115](https://cve.now/CVE-2026-8115.md): gyoridavid short-video-maker REST API rest.ts path traversal (CVSS 6.9, gyoridavid short-video-maker · short-video-maker)
- [CVE-2026-6411](https://cve.now/CVE-2026-6411.md): MAXHUB Pivot Client Application Use of a Broken or Risky Cryptographic Algorithm (CVSS 7.3, MAXHUB Pivot client application)
- [CVE-2026-42880](https://cve.now/CVE-2026-42880.md): ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction (CVSS 9.6, argoproj argo-cd · github.com/argoproj/argo-cd/v3 +2)
- [CVE-2026-8114](https://cve.now/CVE-2026-8114.md): JeecgBoot JSON Object loadTreeData sql injection (CVSS 5.3, JeecgBoot)
- [CVE-2026-8106](https://cve.now/CVE-2026-8106.md): Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theft (CVSS 5.9, GitHub Enterprise Server)
- [CVE-2026-8034](https://cve.now/CVE-2026-8034.md): Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion (CVSS 7.9, GitHub Enterprise Server)
- [CVE-2026-7541](https://cve.now/CVE-2026-7541.md): Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint (CVSS 6.3, GitHub Enterprise Server)
- [CVE-2026-8113](https://cve.now/CVE-2026-8113.md): 8421bit MiniClaw executeSkillScript kernel.ts isPathInside path traversal (CVSS 5.3, 8421bit MiniClaw)
- [CVE-2026-6736](https://cve.now/CVE-2026-6736.md): Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity provider (CVSS 6.3, GitHub Enterprise Server)
- [CVE-2026-41928](https://cve.now/CVE-2026-41928.md): Vvveb \< 1.0.8.2 Information Disclosure via Cron Controller (CVSS 6.9, givanz Vvveb)
- [CVE-2026-41929](https://cve.now/CVE-2026-41929.md): Vvveb \< 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor (CVSS 5.1, givanz Vvveb)
- [CVE-2026-8112](https://cve.now/CVE-2026-8112.md): 8421bit MiniClaw kernel.ts executeCognitivePulse os command injection (CVSS 5.3, 8421bit MiniClaw)
- [CVE-2026-42826](https://cve.now/CVE-2026-42826.md): Azure DevOps Information Disclosure Vulnerability (CVSS 10.0, Microsoft Azure DevOps)
- [CVE-2026-35428](https://cve.now/CVE-2026-35428.md): Azure Cloud Shell Spoofing Vulnerability (CVSS 9.6, Microsoft Azure Cloud Shell)
- [CVE-2026-35435](https://cve.now/CVE-2026-35435.md): Azure AI Foundry Elevation of Privilege Vulnerability (CVSS 8.6, Microsoft Azure AI Foundry)
- [CVE-2026-34327](https://cve.now/CVE-2026-34327.md): Microsoft Partner Center Spoofing Vulnerability (CVSS 8.2, Microsoft Partner Center)
- [CVE-2026-33844](https://cve.now/CVE-2026-33844.md): Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability (CVSS 9.0, Microsoft Azure Managed Instance for Apache Cassandra)
- [CVE-2026-33823](https://cve.now/CVE-2026-33823.md): Microsoft Team Events Portal Information Disclosure Vulnerability (CVSS 9.6, Microsoft Teams)
- [CVE-2026-32207](https://cve.now/CVE-2026-32207.md): Azure Machine Learning Notebook Spoofing Vulnerability (CVSS 8.8, Microsoft Azure Machine Learning)
- [CVE-2026-33109](https://cve.now/CVE-2026-33109.md): Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability (CVSS 9.9, Microsoft Azure Managed Instance for Apache Cassandra)
- [CVE-2026-33111](https://cve.now/CVE-2026-33111.md): Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability (CVSS 7.5, Copilot Chat)
- [CVE-2026-41105](https://cve.now/CVE-2026-41105.md): Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Azure Monitor Action Group notification system)
- [CVE-2026-26129](https://cve.now/CVE-2026-26129.md): M365 Copilot Information Disclosure Vulnerability (CVSS 7.5, Microsoft 365 Copilot's Business Chat)
- [CVE-2026-26164](https://cve.now/CVE-2026-26164.md): M365 Copilot Information Disclosure Vulnerability (CVSS 7.5, Microsoft 365 Copilot's Business Chat)
- [CVE-2026-42449](https://cve.now/CVE-2026-42449.md): n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders (CVSS 8.5, czlonkowski n8n-mcp · n8n-mcp)
- [CVE-2026-42047](https://cve.now/CVE-2026-42047.md): Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods (CVSS 8.6, inngest-js · inngest)
- [CVE-2026-8098](https://cve.now/CVE-2026-8098.md): code-projects Feedback System checklogin.php sql injection (CVSS 6.9, code-projects Feedback System)
- [CVE-2026-8097](https://cve.now/CVE-2026-8097.md): CodeAstro Online Classroom askquery.php sql injection (CVSS 5.3, CodeAstro Online Classroom)
- [CVE-2026-41691](https://cve.now/CVE-2026-41691.md): i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns (CVSS 6.5, i18next-http-backend)
- [CVE-2026-41692](https://cve.now/CVE-2026-41692.md): i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes (CVSS 4.7, i18nextify)
- [CVE-2026-8142](https://cve.now/CVE-2026-8142.md): CVE-2026-8142 (CVSS 6.5, CERT/CC VINCE)
- [CVE-2026-39820](https://cve.now/CVE-2026-39820.md): Quadratic string concatentation in consumeComment in net/mail (CVSS 7.5, Go standard library net/mail · stdlib)
- [CVE-2026-42501](https://cve.now/CVE-2026-42501.md): Malicious module proxy can bypass checksum database in cmd/go (CVSS 7.5, Go toolchain cmd/go · toolchain)
- [CVE-2026-39823](https://cve.now/CVE-2026-39823.md): Bypass of meta content URL escaping causes XSS in html/template (CVSS 6.1, Go standard library html/template · stdlib)
- [CVE-2026-33811](https://cve.now/CVE-2026-33811.md): Crash when handling long CNAME response in net (CVSS 7.5, Go standard library net · stdlib)
- [CVE-2026-39826](https://cve.now/CVE-2026-39826.md): Escaper bypass leads to XSS in html/template (CVSS 6.1, Go standard library html/template · stdlib)
- [CVE-2026-39817](https://cve.now/CVE-2026-39817.md): Invoking "go tool pack" does not sanitize output paths in cmd/go (CVSS 5.9, Go toolchain cmd/go · toolchain)
- [CVE-2026-39819](https://cve.now/CVE-2026-39819.md): Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go (CVSS 5.3, Go toolchain cmd/go · toolchain)
- [CVE-2026-42499](https://cve.now/CVE-2026-42499.md): Quadratic string concatenation in consumePhrase in net/mail (CVSS 7.5, Go standard library net/mail · stdlib)
- [CVE-2026-39825](https://cve.now/CVE-2026-39825.md): ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil (CVSS 5.3, Go standard library net/http/httputil · stdlib)
- [CVE-2026-39836](https://cve.now/CVE-2026-39836.md): Panic in Dial and LookupPort when handling NUL byte on Windows in net (CVSS 7.5, Go standard library net · stdlib)
- [CVE-2026-33814](https://cve.now/CVE-2026-33814.md): Infinite loop in HTTP/2 transport when given bad SETTINGS\_MAX\_FRAME\_SIZE in net/http/internal/http2 in golang.org/x/net (CVSS 7.5, golang.org/x/net/http2 · Go standard library net/http +2)
- [CVE-2026-8088](https://cve.now/CVE-2026-8088.md): OSGeo gdal GDapi.c GDfieldinfo out-of-bounds (CVSS 4.8, OSGeo gdal · gdal)
- [CVE-2026-8087](https://cve.now/CVE-2026-8087.md): OSGeo gdal GDapi.c GDnentries heap-based overflow (CVSS 4.8, OSGeo gdal · gdal)
- [CVE-2026-42259](https://cve.now/CVE-2026-42259.md): Saltcorn: Open Redirect in \`POST /auth/login\` due to incomplete \`is\_relative\_url\` validation (backslash bypass) (CVSS 5.1, saltcorn · @saltcorn/server)
- [CVE-2026-42241](https://cve.now/CVE-2026-42241.md): ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width (CVSS 5.3, G-Research ParquetSharp · ParquetSharp)
- [CVE-2026-43510](https://cve.now/CVE-2026-43510.md): CISA manage.get.gov insecure portfolio administrative privileges (CVSS 5.9, CISA manage.get.gov)
- [CVE-2026-42239](https://cve.now/CVE-2026-42239.md): Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover (CVSS 8.1, budibase · @budibase/backend-core)
- [CVE-2026-42225](https://cve.now/CVE-2026-42225.md): GnuTLS backend silently skips certificate chain verification when verify\_peer is false (CVSS 8.2, pjsip pjproject)
- [CVE-2026-8086](https://cve.now/CVE-2026-8086.md): OSGeo gdal SWapi.c SWnentries heap-based overflow (CVSS 4.8, OSGeo gdal · gdal)
- [CVE-2026-41653](https://cve.now/CVE-2026-41653.md): BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration (CVSS 7.0, alam00000 bentopdf)
- [CVE-2026-8084](https://cve.now/CVE-2026-8084.md): OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds (CVSS 4.8, OSGeo gdal · gdal)
- [CVE-2026-44243](https://cve.now/CVE-2026-44243.md): GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository (CVSS 7.8, gitpython-developers GitPython · gitpython)
- [CVE-2026-44244](https://cve.now/CVE-2026-44244.md): GitPython: Newline injection in config\_writer().set\_value() enables RCE via core.hooksPath (CVSS 7.8, gitpython-developers GitPython · gitpython)
- [CVE-2026-42284](https://cve.now/CVE-2026-42284.md): GitPython: Unsafe option check validates multi\_options before shlex.split transforms it (CVSS 8.1, gitpython-developers GitPython · gitpython)
- [CVE-2026-42215](https://cve.now/CVE-2026-42215.md): GitPython: Command injection via Git options bypass (CVSS 8.8, gitpython-developers GitPython · gitpython)
- [CVE-2026-8083](https://cve.now/CVE-2026-8083.md): SourceCodester Pharmacy Sales and Inventory System ajax.php save\_user sql injection (CVSS 6.9, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-42214](https://cve.now/CVE-2026-42214.md): Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext (CVSS 7.8, dail8859 NotepadNext)
- [CVE-2026-41906](https://cve.now/CVE-2026-41906.md): FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass (CVSS 7.1, freescout-help-desk freescout)
- [CVE-2026-44742](https://cve.now/CVE-2026-44742.md): Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild (CVSS 7.2, Postorius project Postorius · postorius)
- [CVE-2026-41905](https://cve.now/CVE-2026-41905.md): FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access (CVSS 7.7, freescout-help-desk freescout)
- [CVE-2026-41904](https://cve.now/CVE-2026-41904.md): FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip\_tags validator with mixed text+HTML content (CVSS 7.6, freescout-help-desk freescout)
- [CVE-2026-41902](https://cve.now/CVE-2026-41902.md): FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks (CVSS 9.1, freescout-help-desk freescout)
- [CVE-2026-41903](https://cve.now/CVE-2026-41903.md): FreeScout IDOR Vulnerability: PERM\_EDIT\_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472) (CVSS 5.4, freescout-help-desk freescout)
- [CVE-2026-8081](https://cve.now/CVE-2026-8081.md): router-for-me CLIProxyAPI api\_tools.go server-side request forgery (CVSS 5.3, router-for-me CLIProxyAPI)
- [CVE-2026-7415](https://cve.now/CVE-2026-7415.md): Open MQTT orchestration without read/write ACLs in Yarbo robot firmware (CVSS 9.8, Yarbo Firmware)
- [CVE-2026-7414](https://cve.now/CVE-2026-7414.md): Hardcoded credentials in Yarbo robot firmware (CVSS 9.8, Yarbo Firmware)
- [CVE-2026-7413](https://cve.now/CVE-2026-7413.md): Persistent undocumented backdoor access in Yarbo robot (CVSS 7.2, Yarbo Firmware)
- [CVE-2026-5787](https://cve.now/CVE-2026-5787.md): An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker (CVSS 8.9, Ivanti Endpoint Manager Mobile)
- [CVE-2026-5788](https://cve.now/CVE-2026-5788.md): An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invok (CVSS 7.0, Ivanti Endpoint Manager Mobile)
- [CVE-2026-7821](https://cve.now/CVE-2026-7821.md): Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to (CVSS 7.4, Ivanti Endpoint Manager Mobile)
- [CVE-2026-6973](https://cve.now/CVE-2026-6973.md): An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with admin (CVSS 7.2, KEV, Ivanti Endpoint Manager Mobile)
- [CVE-2026-5786](https://cve.now/CVE-2026-5786.md): An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attac (CVSS 8.8, Ivanti Endpoint Manager Mobile)
- [CVE-2025-4397](https://cve.now/CVE-2025-4397.md): Medtronic MyCareLink Patient Monitor Data Encryption Weakness (CVSS 6.8, Medtronic MyCareLink Patient Monitor)
- [CVE-2025-4386](https://cve.now/CVE-2025-4386.md): Medtronic MyCareLink Patient Monitor Hardware Debug Port (CVSS 6.8, Medtronic MyCareLink Patient Monitor)
- [CVE-2026-32686](https://cve.now/CVE-2026-32686.md): Unbounded exponent in decimal enables unauthenticated DoS (CVSS 6.9, ericmj decimal)
- [CVE-2026-44349](https://cve.now/CVE-2026-44349.md): Daptin fuzzy search injects unvalidated column name into raw SQL (CVSS 7.1, daptin · github.com/daptin/daptin)
- [CVE-2026-41422](https://cve.now/CVE-2026-41422.md): Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API (CVSS 8.3, daptin · github.com/daptin/daptin)
- [CVE-2026-41689](https://cve.now/CVE-2026-41689.md): Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services (CVSS 6.0, ellite Wallos)
- [CVE-2026-41688](https://cve.now/CVE-2026-41688.md): Incomplete fix for CVE-2026-33399: SSRF in Wallos (CVSS 7.7, ellite Wallos)
- [CVE-2026-42011](https://cve.now/CVE-2026-42011.md): Gnutls: gnutls: security bypass due to incorrect name constraint handling (CVSS 7.4, gnutls · Red Hat Enterprise Linux +6)
- [CVE-2026-41687](https://cve.now/CVE-2026-41687.md): Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is\_cgnat\_ip() Not Used in Inline Checks (CVSS 4.3, ellite Wallos)
- [CVE-2026-44264](https://cve.now/CVE-2026-44264.md): Weblate is vulnerable to XSS via crafted Markdown (CVSS 4.3, WeblateOrg weblate · weblate)
- [CVE-2026-44263](https://cve.now/CVE-2026-44263.md): Weblate: Private Translation Enumeration via Screenshot API (CVSS 4.3, WeblateOrg weblate · weblate)
- [CVE-2026-41519](https://cve.now/CVE-2026-41519.md): Weblate's API Token Not Invalidated on Password Change (CVSS 4.2, WeblateOrg weblate · weblate)
- [CVE-2026-41654](https://cve.now/CVE-2026-41654.md): Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate\_repo\_url (CVSS 5.3, WeblateOrg weblate · weblate)
- [CVE-2026-41650](https://cve.now/CVE-2026-41650.md): fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters (CVSS 6.1, NaturalIntelligence fast-xml-parser · fast-xml-parser)
- [CVE-2026-41505](https://cve.now/CVE-2026-41505.md): RELATE: Predictable Token Generation in auth.py and exam.py (CVSS 8.7, inducer relate)
- [CVE-2026-41554](https://cve.now/CVE-2026-41554.md): WordPress Bricks Builder theme 1.9.2-2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bricks Builder)
- [CVE-2026-41589](https://cve.now/CVE-2026-41589.md): Wish has SCP Path Traversal that allows arbitrary file read/write (CVSS 9.6, charmbracelet wish · charm.land/wish/v2 +1)
- [CVE-2026-41490](https://cve.now/CVE-2026-41490.md): Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations (CVSS 8.3, dagster-io dagster · dagster-duckdb +5)
- [CVE-2025-14341](https://cve.now/CVE-2025-14341.md): Input Data Manipulation in DivvyDrive Information Technologies' DivvyDrive (CVSS 8.3, DivvyDrive Information Technologies DivvyDrive)
- [CVE-2026-41685](https://cve.now/CVE-2026-41685.md): Incus: Unbounded binary import disk exhaustion (CVSS 4.3, lxc incus · github.com/lxc/incus/v6/cmd/incusd +2)
- [CVE-2026-41684](https://cve.now/CVE-2026-41684.md): Incus: Nil Dereferences on Restore via Malformed YAML (CVSS 6.5, lxc incus · github.com/lxc/incus/v6/cmd/incusd +2)
- [CVE-2026-41648](https://cve.now/CVE-2026-41648.md): Incus: Unbounded YAML Metadata Decode via Parsing (CVSS 5.3, lxc incus · github.com/lxc/incus +2)
- [CVE-2026-41647](https://cve.now/CVE-2026-41647.md): Incus: Nil-Pointer Dereference via S3 Bucket Import (CVSS 6.5, lxc incus · github.com/lxc/incus +2)
- [CVE-2026-6795](https://cve.now/CVE-2026-6795.md): Open Redirect in DivvyDrive Information Technologies' DivvyDrive (CVSS 9.6, DivvyDrive Information Technologies DivvyDrive)
- [CVE-2026-5784](https://cve.now/CVE-2026-5784.md): Stored XSS in DivvyDrive Information Technologies' DivvyDrive (CVSS 8.8, DivvyDrive Information Technologies DivvyDrive)
- [CVE-2026-6002](https://cve.now/CVE-2026-6002.md): HTML Injection in DivvyDrive Information Technologies' DivvyDrive (CVSS 8.8, DivvyDrive Information Technologies DivvyDrive)
- [CVE-2026-8094](https://cve.now/CVE-2026-8094.md): Other issue in the WebRTC component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8093](https://cve.now/CVE-2026-8093.md): Memory safety bugs fixed in Thunderbird 150.0.2 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8092](https://cve.now/CVE-2026-8092.md): Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8091](https://cve.now/CVE-2026-8091.md): Incorrect boundary conditions in the Audio/Video: Playback component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8090](https://cve.now/CVE-2026-8090.md): Use-after-free in the DOM: Networking component (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-5791](https://cve.now/CVE-2026-5791.md): CSRF in DivvyDrive Information Technologies' DivvyDrive (CVSS 6.5, DivvyDrive Information Technologies DivvyDrive)
- [CVE-2026-8080](https://cve.now/CVE-2026-8080.md): MISP core - Stored XSS in MISP template (old engine) element attribute type (CVSS 6.8, misp)
- [CVE-2026-42010](https://cve.now/CVE-2026-42010.md): Gnutls: gnutls: authentication bypass via nul character in username (CVSS 7.1, gnutls · Red Hat Enterprise Linux +7)
- [CVE-2026-41644](https://cve.now/CVE-2026-41644.md): monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh (CVSS 8.3, monetr · github.com/monetr/monetr)
- [CVE-2026-41643](https://cve.now/CVE-2026-41643.md): GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE (CVSS 7.5, osrg gobgp · github.com/osrg/gobgp/v4)
- [CVE-2026-42285](https://cve.now/CVE-2026-42285.md): GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) (CVSS 7.5, osrg gobgp · github.com/osrg/gobgp/v4)
- [CVE-2026-41642](https://cve.now/CVE-2026-41642.md): GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute (CVSS 7.5, osrg gobgp · github.com/osrg/gobgp/v4)
- [CVE-2026-6508](https://cve.now/CVE-2026-6508.md): RCE in TUBITAK BILGEM's Liderahenk (CVSS 9.8, TUBITAK BILGEM Software Technologies Research Institute Lid…)
- [CVE-2026-3953](https://cve.now/CVE-2026-3953.md): Reflected XSS in Gosoft Software's Proticaret E-Commerce (CVSS 8.8, Gosoft Software Industry and Trade Ltd. Proticaret E-Commer…)
- [CVE-2026-33589](https://cve.now/CVE-2026-33589.md): Arbitrary File Read via Local File Inclusion (LFI) (CVSS 8.2, Open Notebook)
- [CVE-2026-33588](https://cve.now/CVE-2026-33588.md): Arbitrary File Write Through Path Traversal (CVSS 7.0, Open Notebook)
- [CVE-2026-33587](https://cve.now/CVE-2026-33587.md): Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) (CVSS 9.2, Open Notebook)
- [CVE-2026-27415](https://cve.now/CVE-2026-27415.md): WordPress BEAR plugin \<= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, PluginUs.Net BEAR)
- [CVE-2026-28201](https://cve.now/CVE-2026-28201.md): SurrealDB Injection on Open Notebook (CVSS 8.7, Open Notebook)
- [CVE-2026-6805](https://cve.now/CVE-2026-6805.md): Vulnerability on Cryptobox external sharing feature (CVSS 6.9, Ercom Cryptobox)
- [CVE-2026-27416](https://cve.now/CVE-2026-27416.md): WordPress PDF Poster plugin \<= 2.4.1 - Broken Access Control vulnerability (CVSS 5.3, bPlugins PDF Poster)
- [CVE-2024-43384](https://cve.now/CVE-2024-43384.md): Phoenix Contact: Improper removal of sensitive information in MGUARD products (CVSS 8.0, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2025-1978](https://cve.now/CVE-2025-1978.md): Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console (CVSS 8.3, Hitachi Virtual Storage Platform G130, G150, G350, G370,… +1)
- [CVE-2025-62127](https://cve.now/CVE-2025-62127.md): WordPress WEN Logo Slider plugin \<= 3.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WEN Themes WEN Logo Slider)
- [CVE-2025-66105](https://cve.now/CVE-2025-66105.md): WordPress Bus Ticket Booking with Seat Reservation plugin \< 5.6.8 - Broken Access Control vulnerability (CVSS 5.3, Magepeople Bus Ticket Booking with Seat Reservation)
- [CVE-2025-68060](https://cve.now/CVE-2025-68060.md): WordPress Team Member plugin \<= 8.5 - SQL Injection vulnerability (CVSS 7.6, WPMart Team Member)
- [CVE-2025-68604](https://cve.now/CVE-2025-68604.md): WordPress WPGraphQL plugin \<= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WPGraphQL)
- [CVE-2026-25468](https://cve.now/CVE-2026-25468.md): WordPress Happy Addons for Elementor plugin \<= 3.20.8 - Sensitive Data Exposure vulnerability (CVSS 5.3, weDevs Happy Addons for Elementor)
- [CVE-2026-27329](https://cve.now/CVE-2026-27329.md): WordPress YITH WooCommerce Wishlist plugin \<= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, YITH WooCommerce Wishlist)
- [CVE-2026-25436](https://cve.now/CVE-2026-25436.md): WordPress Royal Elementor Addons plugin \< 1.7.1053 - Broken Access Control vulnerability (CVSS 5.3, WProyal Royal Elementor Addons)
- [CVE-2026-44407](https://cve.now/CVE-2026-44407.md): Remote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartview (CVSS 4.7, ZTE ZXCLOUD iRAI)
- [CVE-2026-27421](https://cve.now/CVE-2026-27421.md): WordPress Royal Elementor Addons plugin \< 1.7.1053 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WProyal Royal Elementor Addons)
- [CVE-2025-2514](https://cve.now/CVE-2025-2514.md): Improper Restriction of Excessive Authentication Attempts vulnerability in Hitachi Virtual Storage Platform (CVSS 5.3, Hitachi Virtual Storage Platform G130, G150, G350, G370,… +1)
- [CVE-2026-4430](https://cve.now/CVE-2026-4430.md): Heap Buffer Overflow in AgileEngine (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2025-9661](https://cve.now/CVE-2025-9661.md): OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23/24/26/28 (CVSS 8.1, Hitachi Virtual Storage Platform One Block)
- [CVE-2026-44406](https://cve.now/CVE-2026-44406.md): DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview (CVSS 5.7, ZTE ZXCLOUD iRAI)
- [CVE-2026-41586](https://cve.now/CVE-2026-41586.md): ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE (CVSS 9.3, hyperledger fabric · org.hyperledger.fabric-sdk-java:fabric…)
- [CVE-2026-41143](https://cve.now/CVE-2026-41143.md): YesWiki vulnerable to authenticated SQL Injection via id\_fiche in EntryManager::formatDataBeforeSave() (CVSS 8.8, yeswiki · yeswiki/yeswiki)
- [CVE-2026-41139](https://cve.now/CVE-2026-41139.md): Unsafe array index getter in mathjs (CVSS 8.8, josdejong mathjs · mathjs)
- [CVE-2026-7252](https://cve.now/CVE-2026-7252.md): WP-Optimize \<= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta (CVSS 8.1, davidanderson WP-Optimize – Cache, Compress images, Minify…)
- [CVE-2026-6692](https://cve.now/CVE-2026-6692.md): Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via \_get\_media\_url (CVSS 8.8, Revolution Slider Slider Revolution)
- [CVE-2026-4348](https://cve.now/CVE-2026-4348.md): BetterDocs Pro \<= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter (CVSS 7.5, BetterDocs Pro)
- [CVE-2026-41413](https://cve.now/CVE-2026-41413.md): Istio Vulnerable to SSRF via RequestAuthentication jwksUri (CVSS 5.0, istio · istio.io/istio)
- [CVE-2026-41641](https://cve.now/CVE-2026-41641.md): NocoBase Vulnerable to SQL Validation Bypass via \`sqlCollection:update\` Missing \`checkSQL\` Call (CVSS 7.2, nocobase · @nocobase/plugin-collection-sql)
- [CVE-2026-8063](https://cve.now/CVE-2026-8063.md): Post-auth null pointer dereference when aggregating against a view with empty search pipeline (CVSS 7.1, MongoDB Server)
- [CVE-2026-41640](https://cve.now/CVE-2026-41640.md): NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading (CVSS 7.5, nocobase · @nocobase/database)
- [CVE-2026-42217](https://cve.now/CVE-2026-42217.md): OpenEXR: Shift exponent overflow in \`readVariableLengthInteger()\` (\`ImfIDManifest.cpp\`) (CVSS 6.3, AcademySoftwareFoundation openexr)
- [CVE-2026-42216](https://cve.now/CVE-2026-42216.md): OpenEXR: Out-of-bounds read in \`IDManifest::init()\` during prefix expansion (CVSS 8.8, AcademySoftwareFoundation openexr)
- [CVE-2026-41142](https://cve.now/CVE-2026-41142.md): OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API (CVSS 8.8, AcademySoftwareFoundation openexr)
- [CVE-2026-40981](https://cve.now/CVE-2026-40981.md): When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentia (CVSS 7.5, Spring Cloud Config · org.springframework.cloud:spring-clou…)
- [CVE-2026-41002](https://cve.now/CVE-2026-41002.md): The base directory (\`spring.cloud.config.server.git.basedir\`) used by the Spring Cloud Config Server to clone Git repositories to is suscept (CVSS 7.4, Spring Cloud Config · org.springframework.cloud:spring-clou…)
- [CVE-2026-41004](https://cve.now/CVE-2026-41004.md): When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. (CVSS 4.4, Spring Cloud Config · org.springframework.cloud:spring-clou…)
- [CVE-2026-41675](https://cve.now/CVE-2026-41675.md): xmldom: XML node injection through unvalidated processing instruction serialization (CVSS 8.7, xmldom · @xmldom/xmldom)
- [CVE-2026-40982](https://cve.now/CVE-2026-40982.md): Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. (CVSS 9.1, Spring Cloud Config · org.springframework.cloud:spring-clou…)
- [CVE-2026-41674](https://cve.now/CVE-2026-41674.md): xmldom: XML injection through unvalidated DocumentType serialization (CVSS 8.7, xmldom · @xmldom/xmldom)
- [CVE-2026-40004](https://cve.now/CVE-2026-40004.md): openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview (CVSS 5.5, ZTE ZXCLOUD iRAI)
- [CVE-2026-41673](https://cve.now/CVE-2026-41673.md): xmldom: Denial of service via uncontrolled recursion in XML serialization (CVSS 8.7, xmldom · @xmldom/xmldom)
- [CVE-2026-41672](https://cve.now/CVE-2026-41672.md): xmldom: XML node injection through unvalidated comment serialization (CVSS 8.7, xmldom · @xmldom/xmldom)
- [CVE-2026-6214](https://cve.now/CVE-2026-6214.md): Forminator Forms \<= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator\_export\_entries Action on wp\_loaded Hook (CVSS 6.5, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-41891](https://cve.now/CVE-2026-41891.md): CI4MS: Deactivated User Session Bypass (active=0) (CVSS 5.3, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-41890](https://cve.now/CVE-2026-41890.md): CI4MS: Arbitrary Database Table Drop via Theme deleteProcess (CVSS 6.9, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-44603](https://cve.now/CVE-2026-44603.md): Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. (CVSS 3.7, torproject Tor)
- [CVE-2026-41203](https://cve.now/CVE-2026-41203.md): ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE (CVSS 9.4, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-41202](https://cve.now/CVE-2026-41202.md): ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE (CVSS 9.4, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-44602](https://cve.now/CVE-2026-44602.md): Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006. (CVSS 3.7, torproject Tor)
- [CVE-2026-41201](https://cve.now/CVE-2026-41201.md): CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2 (CVSS 9.1, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-41587](https://cve.now/CVE-2026-41587.md): CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution (CVSS 8.6, ci4-cms-erp ci4ms · ci4-cms-erp/ci4ms)
- [CVE-2026-44601](https://cve.now/CVE-2026-44601.md): Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TRO (CVSS 3.7, torproject Tor)
- [CVE-2026-42194](https://cve.now/CVE-2026-42194.md): Incomplete fix for CVE-2026-32812: SSRF in admidio (CVSS 6.8, admidio · admidio/admidio)
- [CVE-2026-41671](https://cve.now/CVE-2026-41671.md): Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation (CVSS 6.8, admidio · admidio/admidio)
- [CVE-2026-41670](https://cve.now/CVE-2026-41670.md): Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest (CVSS 8.2, admidio · admidio/admidio)
- [CVE-2026-41669](https://cve.now/CVE-2026-41669.md): Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed (CVSS 8.2, admidio · admidio/admidio)
- [CVE-2026-41663](https://cve.now/CVE-2026-41663.md): Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send (CVSS 3.5, admidio · admidio/admidio)
- [CVE-2026-41662](https://cve.now/CVE-2026-41662.md): Admidio: Missing Minimum Administrator Check in Role Membership Removal (CVSS 5.2, admidio · admidio/admidio)
- [CVE-2026-41661](https://cve.now/CVE-2026-41661.md): Admidio: Reflected XSS in msg\_window.php via Square Bracket to HTML Tag Conversion (CVSS 6.1, admidio · admidio/admidio)
- [CVE-2026-41660](https://cve.now/CVE-2026-41660.md): Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP (CVSS 7.1, admidio · admidio/admidio)
- [CVE-2026-41659](https://cve.now/CVE-2026-41659.md): Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment (CVSS 2.7, admidio · admidio/admidio)
- [CVE-2026-41658](https://cve.now/CVE-2026-41658.md): Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items (CVSS 6.5, admidio · admidio/admidio)
- [CVE-2026-41657](https://cve.now/CVE-2026-41657.md): Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts\_data.php (CVSS 4.9, admidio · admidio/admidio)
- [CVE-2026-41656](https://cve.now/CVE-2026-41656.md): Admidio: Path Traversal via Unvalidated \`name\` Parameter in Document Add Mode Enables Arbitrary Server File Read (CVSS 4.5, admidio · admidio/admidio)
- [CVE-2026-41655](https://cve.now/CVE-2026-41655.md): Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials (CVSS 6.5, admidio · admidio/admidio)
- [CVE-2026-4807](https://cve.now/CVE-2026-4807.md): Appointment Booking Calendar \<= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion (CVSS 6.5, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2026-44600](https://cve.now/CVE-2026-44600.md): Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010. (CVSS 3.7, torproject Tor)
- [CVE-2026-44599](https://cve.now/CVE-2026-44599.md): Tor before 0.4.9.7 can attempt or accept BEGIN\_DIR via conflux legs, aka TROVE-2026-008. (CVSS 3.7, torproject Tor)
- [CVE-2026-6222](https://cve.now/CVE-2026-6222.md): Forminator Forms \<= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator\_action' Parameter (CVSS 5.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-40003](https://cve.now/CVE-2026-40003.md): USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM (CVSS 5.1, ZTE ZX297520V3 BootROM)
- [CVE-2026-44597](https://cve.now/CVE-2026-44597.md): Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. (CVSS 3.7, torproject Tor)
- [CVE-2025-63703](https://cve.now/CVE-2025-63703.md): npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js(). (CVSS 9.8, parse-ini)
- [CVE-2025-63704](https://cve.now/CVE-2025-63704.md): NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. (CVSS 9.8, query-string-parser)
- [CVE-2025-63705](https://cve.now/CVE-2025-63705.md): NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js. (CVSS 8.8, node-ts-ocr)
- [CVE-2025-63706](https://cve.now/CVE-2025-63706.md): NPM package next-npm-version1.0.1 is vulnerable to Command injection. (CVSS 9.8, @jswork/next-npm-version)
- [CVE-2025-65122](https://cve.now/CVE-2025-65122.md): Regex Denial of Service in youtube-regex npm package through version 1.0.5. (CVSS 7.5, youtube-regex)
- [CVE-2025-67202](https://cve.now/CVE-2025-67202.md): Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via craft (CVSS 6.1, sidekiq-cron)
- [CVE-2026-30495](https://cve.now/CVE-2026-30495.md): The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the (CVSS 8.8)
- [CVE-2026-30496](https://cve.now/CVE-2026-30496.md): The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthe (CVSS 9.8)
- [CVE-2026-36341](https://cve.now/CVE-2026-36341.md): Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. (CVSS 5.4, krayin/laravel-crm)
- [CVE-2026-36387](https://cve.now/CVE-2026-36387.md): A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add\_members.php. (CVSS 6.5)
- [CVE-2026-36388](https://cve.now/CVE-2026-36388.md): A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php pag (CVSS 5.4)
- [CVE-2026-36458](https://cve.now/CVE-2026-36458.md): ChestnutCMS v1.5.10 has a SQL injection vulnerability. (CVSS 9.8)
- [CVE-2026-37709](https://cve.now/CVE-2026-37709.md): Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote att (CVSS 9.8, snipe/snipe-it)
- [CVE-2026-40213](https://cve.now/CVE-2026-40213.md): OpenStack Cyborg before 16.0.1 uses rule:allow (check\_str='@') as the default policy for multiple API endpoints. (CVSS 7.4, OpenStack Cyborg · openstack-cyborg)
- [CVE-2026-40214](https://cve.now/CVE-2026-40214.md): In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. (CVSS 6.3, OpenStack Cyborg · openstack-cyborg)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.