CVEs published May 9, 2026
68 CVEs were published on May 9, 2026: 4 critical, 24 high.
- Published
- 68
- Critical
- 4
- High
- 24
- Medium
- 37
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 48
Most affected products
- argoproj argo-workflows · github.com/argoproj/argo-workf… +3
- 5
- ruby net-imap · net-imap
- 5
- Wavlink NU516U1
- 5
- getkirby kirby · getkirby/cms
- 4
- PgBouncer
- 4
- python-pillow Pillow · pillow
- 4
- chainguard-dev apko · chainguard.dev/apko
- 3
- gibbonedu gibbon
- 3
- AzuraCast · azuracast/azuracast
- 2
- HCLSoftware BigFix WebUI
- 2
Critical 4
- CVE-2026-42601ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddViewArchiveBox
- CVE-2026-42569phpvms: /importer authorization bypass causing full database wipephpvms · nabeel/phpvms
- CVE-2026-42571Privilege Escalation Attack affecting Pelican Web UIPelicanPlatform pelican · github.com/pelicanplatform/pelican
- CVE-2026-42560auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonationgo-pkgz auth · github.com/go-pkgz/auth +1
High 24
- CVE-2026-42605AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media UploadAzuraCast · azuracast/azuracast
- CVE-2026-42606AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA BypassAzuraCast · azuracast/azuracast
- CVE-2026-42246net-imap vulnerable to STARTTLS stripping via invalid response timingruby net-imap · net-imap
- CVE-2026-42575apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)chainguard-dev apko · chainguard.dev/apko
- CVE-2026-42574apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build rootchainguard-dev apko · chainguard.dev/apko
- CVE-2026-41893Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)signalk-server
- CVE-2026-42562Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)alextselegidis plainpad
- CVE-2026-3828Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficieHikvision DS-3E1310P-SI · Hikvision DS-3E1318P-SI +1
- CVE-2026-42311Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)python-pillow Pillow · pillow
- CVE-2026-41311LiquidJS is vulnerable to Denial of Service via circular block reference in layoutharttle liquidjs · liquidjs
- CVE-2026-42301Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2specbefeleme pyp2spec · pyp2spec
- CVE-2026-41163bubblewrap vulnerable to privilege escalation in setuid mode via ptracecontainers bubblewrap
- CVE-2026-42296Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secureargoproj argo-workflows · github.com/argoproj/argo-workf… +3
- CVE-2026-42295Argo Workflows: Exposure of artifact repository credentialsargoproj argo-workflows · github.com/argoproj/argo-workf… +3
- CVE-2026-42294Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptorargoproj argo-workflows · github.com/argoproj/argo-workf… +3
- CVE-2026-42297Argo Workflows Is Missing Authorization in Sync ConfigMap Providerargoproj argo-workflows · github.com/argoproj/argo-workf… +3
- CVE-2026-42137Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialoggetkirby kirby · getkirby/cms
- CVE-2026-42069Kirby: Read access to site, user and role information is not gated by permissionsgetkirby kirby · getkirby/cms
- CVE-2026-42461Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)getarcaneapp arcane · github.com/getarcaneapp/arcane/backend
- CVE-2026-8208Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directogibbonedu gibbon
- CVE-2026-8207Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://githugibbonedu gibbon
- CVE-2026-6665PgBouncer buffer overflow in SCRAMPgBouncer
- CVE-2026-6664PgBouncer integer overflow in PgBouncer network packet parsingPgBouncer
- CVE-2026-41705Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.Spring AI · org.springframework.ai:spring-ai-milvus-store +1
Medium, low and unrated 40
- CVE-2026-8213OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflowOSGeo gdal · gdal
- CVE-2026-8212OSGeo gdal SWapi.c SWSDfldsrch heap-based overflowOSGeo gdal · gdal
- CVE-2026-45184Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.Kdenlive
- CVE-2026-8211codelibs Fess JSP File AdminDesignAction.java update code injectioncodelibs Fess
- CVE-2026-45182GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosGrapheneOS
- CVE-2026-45181Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers Hex-Rays IDA
- CVE-2026-8210aandrew-me tgpt Update helper.go helper.Update command injectionaandrew-me tgpt
- CVE-2026-8196JeecgBoot mLogin Endpoint LoginController.java authorizationJeecgBoot
- CVE-2026-8195JeecgBoot SVG File CommonController.java cross site scriptingJeecgBoot
- CVE-2026-42258net-imap: Command Injection via unvalidated Symbol inputsruby net-imap · net-imap
- CVE-2026-42257net-imap: Command Injection via "raw" arguments to multiple commandsruby net-imap · net-imap
- CVE-2026-42256net-imap: Denial of service via high iteration count for `SCRAM-*` authenticationruby net-imap · net-imap
- CVE-2026-42245net-imap: Quadratic complexity when reading response literalsruby net-imap · net-imap
- CVE-2026-8194osTicket Dispatcher class.dispatcher.php cross-site request forgeryosTicket
- CVE-2026-42576apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discoverychainguard-dev apko · chainguard.dev/apko
- CVE-2026-42333quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operationsquarkiverse quarkus-openapi-generator · io.quarkiverse.open…
- CVE-2026-8193Akaunting Invoice PDF Rendering dompdf.php server-side request forgeryAkaunting
- CVE-2026-8192Wavlink NU516U1 adm.cgi wzdap os command injectionWavlink NU516U1
- CVE-2026-8191Wavlink NU516U1 adm.cgi wifi_region os command injectionWavlink NU516U1
- CVE-2026-8190Wavlink NU516U1 adm.cgi wan os command injectionWavlink NU516U1
- CVE-2026-8189Wavlink NU516U1 adm.cgi wzdrepeater os command injectionWavlink NU516U1
- CVE-2026-8188Wavlink NU516U1 adm.cgi change_wifi_password os command injectionWavlink NU516U1
- CVE-2026-8198Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST APIActivity Logs, User Activity Tracking, Multisite Activity L…
- CVE-2026-8186Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-boundsOpen5GS
- CVE-2026-8187Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumptionOpen5GS
- CVE-2026-8185UGREEN CM933 Administrative missing authenticationUGREEN CM933
- CVE-2026-32683Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk.EZVIZ APP
- CVE-2026-1749There is an Access Control Vulnerability in some HikCentral Professional versions.Hikvision HikCentral Professional
- CVE-2025-15634HCL BigFix WebUI is affected by a missing authorization vulnerabilityHCLSoftware BigFix WebUI
- CVE-2025-15633HCL BigFix WebUI is affected by an improper authorization vulnerabilityHCLSoftware BigFix WebUI
- CVE-2026-42310Pillow: PDF Parsing Trailer Infinite Loop (DoS)python-pillow Pillow · pillow
- CVE-2026-42308Pillow: Integer overflow when processing fontspython-pillow Pillow · pillow
- CVE-2026-42309Pillow: Heap buffer overflow with nested list coordinatespython-pillow Pillow · pillow
- CVE-2026-42183Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)argoproj argo-workflows · github.com/argoproj/argo-workf… +3
- CVE-2026-42174Kirby: User avatar creation, replacement and deletion are not gated by user update permissionsgetkirby kirby · getkirby/cms
- CVE-2026-42051Kirby: System API endpoint leaks license data and installed version to authenticated usersgetkirby kirby · getkirby/cms
- CVE-2026-8209Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application gibbonedu gibbon
- CVE-2026-7652LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery MechanismLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2026-6667PgBouncer missing authorization check in KILL_CLIENT admin commandPgBouncer
- CVE-2026-6666PgBouncer crash in kill_pool_logins_server_errorPgBouncer