# CVEs published 2026-05-09

68 CVEs were published on May 9, 2026: 4 critical, 24 high. Days are UTC.

- [CVE-2026-8213](https://cve.now/CVE-2026-8213.md): OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow (CVSS 4.8, OSGeo gdal · gdal)
- [CVE-2026-8212](https://cve.now/CVE-2026-8212.md): OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow (CVSS 4.8, OSGeo gdal · gdal)
- [CVE-2026-45184](https://cve.now/CVE-2026-45184.md): Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used. (CVSS 6.5, Kdenlive)
- [CVE-2026-8211](https://cve.now/CVE-2026-8211.md): codelibs Fess JSP File AdminDesignAction.java update code injection (CVSS 5.1, codelibs Fess)
- [CVE-2026-45182](https://cve.now/CVE-2026-45182.md): GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClos (CVSS 2.2, GrapheneOS)
- [CVE-2026-45181](https://cve.now/CVE-2026-45181.md): Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers (CVSS 6.5, Hex-Rays IDA)
- [CVE-2026-8210](https://cve.now/CVE-2026-8210.md): aandrew-me tgpt Update helper.go helper.Update command injection (CVSS 4.8, aandrew-me tgpt)
- [CVE-2026-8196](https://cve.now/CVE-2026-8196.md): JeecgBoot mLogin Endpoint LoginController.java authorization (CVSS 6.3, JeecgBoot)
- [CVE-2026-8195](https://cve.now/CVE-2026-8195.md): JeecgBoot SVG File CommonController.java cross site scripting (CVSS 5.3, JeecgBoot)
- [CVE-2026-42605](https://cve.now/CVE-2026-42605.md): AzuraCast: Path Traversal in \`currentDirectory\` Parameter Enables Remote Code Execution via Media Upload (CVSS 8.8, AzuraCast · azuracast/azuracast)
- [CVE-2026-42606](https://cve.now/CVE-2026-42606.md): AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass (CVSS 8.1, AzuraCast · azuracast/azuracast)
- [CVE-2026-42258](https://cve.now/CVE-2026-42258.md): net-imap: Command Injection via unvalidated Symbol inputs (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-42257](https://cve.now/CVE-2026-42257.md): net-imap: Command Injection via "raw" arguments to multiple commands (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-42256](https://cve.now/CVE-2026-42256.md): net-imap: Denial of service via high iteration count for \`SCRAM-\*\` authentication (CVSS 6.0, ruby net-imap · net-imap)
- [CVE-2026-42245](https://cve.now/CVE-2026-42245.md): net-imap: Quadratic complexity when reading response literals (CVSS 2.3, ruby net-imap · net-imap)
- [CVE-2026-42246](https://cve.now/CVE-2026-42246.md): net-imap vulnerable to STARTTLS stripping via invalid response timing (CVSS 7.6, ruby net-imap · net-imap)
- [CVE-2026-8194](https://cve.now/CVE-2026-8194.md): osTicket Dispatcher class.dispatcher.php cross-site request forgery (CVSS 5.3, osTicket)
- [CVE-2026-42601](https://cve.now/CVE-2026-42601.md): ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView (CVSS 9.3, ArchiveBox)
- [CVE-2026-42576](https://cve.now/CVE-2026-42576.md): apko \`DiscoverKeys\` has a panic on non-rsa jwks key that causes crash during key discovery (CVSS 6.5, chainguard-dev apko · chainguard.dev/apko)
- [CVE-2026-42575](https://cve.now/CVE-2026-42575.md): apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) (CVSS 7.5, chainguard-dev apko · chainguard.dev/apko)
- [CVE-2026-42574](https://cve.now/CVE-2026-42574.md): apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root (CVSS 7.5, chainguard-dev apko · chainguard.dev/apko)
- [CVE-2026-42569](https://cve.now/CVE-2026-42569.md): phpvms: /importer authorization bypass causing full database wipe (CVSS 9.4, phpvms · nabeel/phpvms)
- [CVE-2026-42571](https://cve.now/CVE-2026-42571.md): Privilege Escalation Attack affecting Pelican Web UI (CVSS 9.0, PelicanPlatform pelican · github.com/pelicanplatform/pelican)
- [CVE-2026-42333](https://cve.now/CVE-2026-42333.md): quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations (CVSS 6.3, quarkiverse quarkus-openapi-generator · io.quarkiverse.open…)
- [CVE-2026-41893](https://cve.now/CVE-2026-41893.md): Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) (CVSS 8.7, signalk-server)
- [CVE-2026-42562](https://cve.now/CVE-2026-42562.md): Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control) (CVSS 8.3, alextselegidis plainpad)
- [CVE-2026-8193](https://cve.now/CVE-2026-8193.md): Akaunting Invoice PDF Rendering dompdf.php server-side request forgery (CVSS 5.3, Akaunting)
- [CVE-2026-8192](https://cve.now/CVE-2026-8192.md): Wavlink NU516U1 adm.cgi wzdap os command injection (CVSS 5.3, Wavlink NU516U1)
- [CVE-2026-8191](https://cve.now/CVE-2026-8191.md): Wavlink NU516U1 adm.cgi wifi\_region os command injection (CVSS 5.3, Wavlink NU516U1)
- [CVE-2026-8190](https://cve.now/CVE-2026-8190.md): Wavlink NU516U1 adm.cgi wan os command injection (CVSS 5.3, Wavlink NU516U1)
- [CVE-2026-8189](https://cve.now/CVE-2026-8189.md): Wavlink NU516U1 adm.cgi wzdrepeater os command injection (CVSS 5.3, Wavlink NU516U1)
- [CVE-2026-8188](https://cve.now/CVE-2026-8188.md): Wavlink NU516U1 adm.cgi change\_wifi\_password os command injection (CVSS 5.3, Wavlink NU516U1)
- [CVE-2026-8198](https://cve.now/CVE-2026-8198.md): Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity \<= 3.3.6 - Unauthenticated Information Disclosure via REST API (CVSS 5.3, Activity Logs, User Activity Tracking, Multisite Activity L…)
- [CVE-2026-8186](https://cve.now/CVE-2026-8186.md): Open5GS NF client.c ogs\_sbi\_client\_send\_via\_scp\_or\_sepp out-of-bounds (CVSS 6.9, Open5GS)
- [CVE-2026-8187](https://cve.now/CVE-2026-8187.md): Open5GS UPF gtp-path.c \_gtpv1\_u\_recv\_cb resource consumption (CVSS 6.9, Open5GS)
- [CVE-2026-8185](https://cve.now/CVE-2026-8185.md): UGREEN CM933 Administrative missing authentication (CVSS 5.3, UGREEN CM933)
- [CVE-2026-32683](https://cve.now/CVE-2026-32683.md): Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk. (CVSS 5.3, EZVIZ APP)
- [CVE-2026-3828](https://cve.now/CVE-2026-3828.md): Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficie (CVSS 7.2, Hikvision DS-3E1310P-SI · Hikvision DS-3E1318P-SI +1)
- [CVE-2026-1749](https://cve.now/CVE-2026-1749.md): There is an Access Control Vulnerability in some HikCentral Professional versions. (CVSS 6.8, Hikvision HikCentral Professional)
- [CVE-2025-15634](https://cve.now/CVE-2025-15634.md): HCL BigFix WebUI is affected by a missing authorization vulnerability (CVSS 5.3, HCLSoftware BigFix WebUI)
- [CVE-2025-15633](https://cve.now/CVE-2025-15633.md): HCL BigFix WebUI is affected by an improper authorization vulnerability (CVSS 5.3, HCLSoftware BigFix WebUI)
- [CVE-2026-42560](https://cve.now/CVE-2026-42560.md): auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation (CVSS 9.1, go-pkgz auth · github.com/go-pkgz/auth +1)
- [CVE-2026-42311](https://cve.now/CVE-2026-42311.md): Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow) (CVSS 8.6, python-pillow Pillow · pillow)
- [CVE-2026-42310](https://cve.now/CVE-2026-42310.md): Pillow: PDF Parsing Trailer Infinite Loop (DoS) (CVSS 5.1, python-pillow Pillow · pillow)
- [CVE-2026-42308](https://cve.now/CVE-2026-42308.md): Pillow: Integer overflow when processing fonts (CVSS 5.1, python-pillow Pillow · pillow)
- [CVE-2026-42309](https://cve.now/CVE-2026-42309.md): Pillow: Heap buffer overflow with nested list coordinates (CVSS 5.1, python-pillow Pillow · pillow)
- [CVE-2026-41311](https://cve.now/CVE-2026-41311.md): LiquidJS is vulnerable to Denial of Service via circular block reference in layout (CVSS 7.5, harttle liquidjs · liquidjs)
- [CVE-2026-42301](https://cve.now/CVE-2026-42301.md): Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2spec (CVSS 7.8, befeleme pyp2spec · pyp2spec)
- [CVE-2026-41163](https://cve.now/CVE-2026-41163.md): bubblewrap vulnerable to privilege escalation in setuid mode via ptrace (CVSS 8.7, containers bubblewrap)
- [CVE-2026-42296](https://cve.now/CVE-2026-42296.md): Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure (CVSS 8.1, argoproj argo-workflows · github.com/argoproj/argo-workf… +3)
- [CVE-2026-42295](https://cve.now/CVE-2026-42295.md): Argo Workflows: Exposure of artifact repository credentials (CVSS 8.5, argoproj argo-workflows · github.com/argoproj/argo-workf… +3)
- [CVE-2026-42294](https://cve.now/CVE-2026-42294.md): Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor (CVSS 8.2, argoproj argo-workflows · github.com/argoproj/argo-workf… +3)
- [CVE-2026-42183](https://cve.now/CVE-2026-42183.md): Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) (CVSS 2.3, argoproj argo-workflows · github.com/argoproj/argo-workf… +3)
- [CVE-2026-42297](https://cve.now/CVE-2026-42297.md): Argo Workflows Is Missing Authorization in Sync ConfigMap Provider (CVSS 8.5, argoproj argo-workflows · github.com/argoproj/argo-workf… +3)
- [CVE-2026-42174](https://cve.now/CVE-2026-42174.md): Kirby: User avatar creation, replacement and deletion are not gated by user update permissions (CVSS 5.3, getkirby kirby · getkirby/cms)
- [CVE-2026-42137](https://cve.now/CVE-2026-42137.md): Kirby: \`pages.access/list\` and \`files.access/list\` permissions are not consistently checked in the REST API and changes dialog (CVSS 7.1, getkirby kirby · getkirby/cms)
- [CVE-2026-42051](https://cve.now/CVE-2026-42051.md): Kirby: System API endpoint leaks license data and installed version to authenticated users (CVSS 5.3, getkirby kirby · getkirby/cms)
- [CVE-2026-42069](https://cve.now/CVE-2026-42069.md): Kirby: Read access to site, user and role information is not gated by permissions (CVSS 7.1, getkirby kirby · getkirby/cms)
- [CVE-2026-42461](https://cve.now/CVE-2026-42461.md): Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. \`.env\` secrets) (CVSS 8.7, getarcaneapp arcane · github.com/getarcaneapp/arcane/backend)
- [CVE-2026-8209](https://cve.now/CVE-2026-8209.md): Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application (CVSS 6.9, gibbonedu gibbon)
- [CVE-2026-8208](https://cve.now/CVE-2026-8208.md): Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directo (CVSS 8.9, gibbonedu gibbon)
- [CVE-2026-8207](https://cve.now/CVE-2026-8207.md): Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://githu (CVSS 7.0, gibbonedu gibbon)
- [CVE-2026-7652](https://cve.now/CVE-2026-7652.md): LatePoint \<= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism (CVSS 5.3, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-6667](https://cve.now/CVE-2026-6667.md): PgBouncer missing authorization check in KILL\_CLIENT admin command (CVSS 4.3, PgBouncer)
- [CVE-2026-6666](https://cve.now/CVE-2026-6666.md): PgBouncer crash in kill\_pool\_logins\_server\_error (CVSS 5.9, PgBouncer)
- [CVE-2026-6665](https://cve.now/CVE-2026-6665.md): PgBouncer buffer overflow in SCRAM (CVSS 8.1, PgBouncer)
- [CVE-2026-6664](https://cve.now/CVE-2026-6664.md): PgBouncer integer overflow in PgBouncer network packet parsing (CVSS 7.5, PgBouncer)
- [CVE-2026-41705](https://cve.now/CVE-2026-41705.md): Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. (CVSS 8.6, Spring AI · org.springframework.ai:spring-ai-milvus-store +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.