CVEs published May 11, 2026
353 CVEs were published on May 11, 2026: 11 critical, 139 high.
- Published
- 353
- Critical
- 11
- High
- 139
- Medium
- 182
- Low
- 21
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 240
Most affected products
- Apple iOS and iPadOS · Apple macOS +3
- 21
- Apple macOS
- 20
- OpenClaw
- 17
- Apple Safari · Apple iOS and iPadOS +4
- 14
- WWBN AVideo · wwbn/avideo
- 13
- Open5GS
- 10
- getgrav grav · getgrav/grav
- 9
- Apple iOS and iPadOS · Apple macOS +2
- 8
- pgadmin.org pgAdmin · pgadmin4
- 8
- Apple iOS and iPadOS · Apple macOS
- 7
Critical 11
- CVE-2026-43899DeepChat: Incomplete Fix for CVE-2025-55733 leads to Remote Code Execution via Markdown Links bypassing `isValidExternalUrl`ThinkInAIXYZ deepchat
- CVE-2026-43900DeepChat: Persistent DOM XSS via HTML Entity Encoding in `<antArtifact>` SVG Rendering (Bypass of `svgSanitizer.ts`)ThinkInAIXYZ deepchat
- CVE-2026-42882oxyno-zeta/s3-proxy: Security Issues in Resource Path Matchingoxyno-zeta s3-proxy · github.com/oxyno-zeta/s3-proxy
- CVE-2026-42869SOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC toolssocfortress CoPilot
- CVE-2026-42864FireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theftManoManoTech firefighter-incident · firefighter-incident
- CVE-2026-42613Grav: Privilege Escalation via Missing Server-Side Validation of groups/accessgetgrav grav · getgrav/grav
- CVE-2026-42607Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Featuregetgrav grav · getgrav/grav
- CVE-2026-7813pgAdmin 4: Cross-user data access and shared-server privilege escalation in server modepgadmin.org pgAdmin · pgadmin4
- CVE-2026-44643Angular Expressions - Remote Code Execution using filterspeerigon angular-expressions · angular-expressions
- CVE-2026-40636Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerabiDell ECS · Dell ObjectScale
- CVE-2026-38567HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints.
High 139
- CVE-2026-34963barebox EFI PE Loader Memory Safety Vulnerabilitiesbarebox
- CVE-2026-43914Vaultwarden: Brute-force protection bypass vulnerabilitydani-garcia vaultwarden
- CVE-2026-43913Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vaultdani-garcia vaultwarden
- CVE-2026-43912Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organizationdani-garcia vaultwarden
- CVE-2026-42046libcaca: Heap OOB write in canvas import functions caused by int overflowcacalabs libcaca
- CVE-2026-42564jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impactfccview jotty
- CVE-2026-43897Link Preview JS: vunerable to IPv6 and internal loopback attacksOP-Engineering link-preview-js · link-preview-js
- CVE-2026-43888Outline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Importoutline
- CVE-2026-43890Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7)outline
- CVE-2026-43886Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Accessoutline
- CVE-2026-43887Outline: Stored XSS via Comment Mentionsoutline
- CVE-2026-43893exiftool-vendored: Argument injection via newline characters in tag namesphotostructure exiftool-vendored.js · exiftool-vendored
- CVE-2026-43885WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing AuthorizationWWBN AVideo · wwbn/avideo
- CVE-2026-43884WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()WWBN AVideo · wwbn/avideo
- CVE-2026-43873WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone ServerWWBN AVideo · wwbn/avideo
- CVE-2026-43874WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay BypassWWBN AVideo · wwbn/avideo
- CVE-2026-41489Pi-hole: Local privilege escalation via config-controlled path in root-executed service hookspi-hole
- CVE-2026-28976An information leakage was addressed with additional validation.Apple macOS
- CVE-2026-28872A resource exhaustion issue was addressed with improved input validation.Apple iOS and iPadOS
- CVE-2026-28848A buffer overflow was addressed with improved bounds checking.Apple macOS
- CVE-2026-28995A logic issue was addressed with improved restrictions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28983A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28940The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-28941The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2026-43668A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-43652A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-28936The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-28873This issue was addressed with additional entitlement checks.Apple iOS and iPadOS
- CVE-2026-28907The issue was addressed with improved input validation.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-43655An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-43654The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28930A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-28951An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS
- CVE-2026-28906This issue was addressed through improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-28947A use-after-free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-43658The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28952An integer overflow was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2026-28905The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +3
- CVE-2026-28840A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-43661A buffer overflow issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-28913The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +3
- CVE-2026-28944The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-28987A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-28991An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28929A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2026-28883A use-after-free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28964An inconsistent user interface issue was addressed with improved state management.Apple iOS and iPadOS · Apple visionOS
- CVE-2026-28860The issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28925A buffer overflow was addressed with improved bounds checking.Apple macOS
- CVE-2026-28924A race condition was addressed with improved handling of symbolic links.Apple macOS
- CVE-2026-28965A privacy issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2026-43656An out-of-bounds write issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2026-28908A denial of service issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2026-28990The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28986A race condition was addressed with additional validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-28969A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-43660A validation issue was addressed with improved logic.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28904The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28953The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-39871A path handling issue was addressed with improved logic.Apple macOS
- CVE-2026-28919A consistency issue was addressed with improved state handling.Apple macOS
- CVE-2026-28962This issue was addressed with improved access restrictions.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-28974This issue was addressed with improved checks to prevent unauthorized actions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28923A logging issue was addressed with improved data redaction.Apple macOS
- CVE-2026-28954A file quarantine bypass was addressed with additional checks.Apple iOS and iPadOS · Apple macOS
- CVE-2026-28846A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28915A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2026-28978A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-28943A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-28847The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28955The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-39870The issue was addressed with improved memory handling.Apple macOS
- CVE-2026-28959A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2022-4988Alien::FreeImage versions through 1.001 for Perl contains several vulnerable librariesKMX Alien::FreeImage
- CVE-2026-2614Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-45223Crabbox < 0.9.0 Authentication Bypass via Admin Claim Injectionopenclaw crabbox
- CVE-2026-7790Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoSninenines cowlib
- CVE-2026-42856Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool callsJovancoding Network-AI · network-ai
- CVE-2026-44413In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised accessJetBrains TeamCity
- CVE-2026-42860Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpointopenedx edx-enterprise · edx-enterprise
- CVE-2026-42859Neat VNC: Buffer overflow due to oversized RSA public keysany1 neatvnc
- CVE-2026-42858Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpointopenedx-platform
- CVE-2026-43640Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Keybitwarden server
- CVE-2026-43639Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clientsbitwarden server
- CVE-2026-41431Zen Browser MAR updater ships with signature verification removed — unsigned updates acceptedzen-browser desktop
- CVE-2026-5172CVE-2026-5172dnsmasq
- CVE-2026-4892CVE-2026-4892dnsmasq
- CVE-2026-4890CVE-2026-4890dnsmasq
- CVE-2026-2291CVE-2026-2291dnsmasq
- CVE-2026-45006OpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist BypassOpenClaw
- CVE-2026-45004OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working DirectoryOpenClaw
- CVE-2026-42315pyLoad: Path Traversal via Package Folder Name in set_package_datapyload · pyload-ng
- CVE-2026-42313pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxypyload · pyload-ng
- CVE-2026-2393Server-Side Request Forgery (SSRF) in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-42603OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_targetOWASP-BLT BLT
- CVE-2026-42349Clerk: Authorization bypass when combining organization, billing, or reverification checksclerk javascript · @clerk shared +32
- CVE-2026-33362Meari SDK hardcoded cryptographic keyscom.meari.sdk
- CVE-2026-33361Meari weak XOR obfuscationcom.meari.sdk
- CVE-2026-33359Meari unauthenticated alert image access in cloud object storageMeari Alibaba OSS Hosted
- CVE-2026-33357Meari OpenAPI device status IDORcom.meari.sdk
- CVE-2026-33356Meari MQTT broker missing per-device subscribe ACLMeari IoT Cloud MQTT Broker EMQX
- CVE-2026-42843grav-plugin-api: Grav API Privilege Escalation to Super Admingetgrav grav-plugin-api · getgrav/grav-plugin-api
- CVE-2026-44738Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()getgrav grav · getgrav/grav
- CVE-2026-42845Grav: Anonymous Page Content Overwrite via Form File Upload filename Overridegetgrav grav-plugin-form · getgrav/grav-plugin-form
- CVE-2026-42612Grav: Publisher-Level Stored XSS via Unquoted Event Attributesgetgrav grav · getgrav/grav
- CVE-2026-42611Grav: Stored XSS via Tag Injectiongetgrav grav · getgrav/grav
- CVE-2026-42609Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logicgetgrav grav · getgrav/grav
- CVE-2026-42608Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.getgrav grav · getgrav/grav
- CVE-2026-7819pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file writepgadmin.org pgAdmin · pgadmin4
- CVE-2026-7818pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code executionpgadmin.org pgAdmin · pgadmin4
- CVE-2026-7816pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakoutpgadmin.org pgAdmin · pgadmin4
- CVE-2026-7815pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code executionpgadmin.org pgAdmin · pgadmin4
- CVE-2026-4802Cockpit: cockpit: arbitrary command execution via crafted links in system logs uiRed Hat Enterprise Linux
- CVE-2025-10470Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service UnavailabilityWSO2 Identity Server · WSO2 Carbon MagicLink Authenticator…
- CVE-2026-41951Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the serveGROWI
- CVE-2025-10908Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized AccessWSO2 Identity Server · WSO2 Carbon MagicLink Authenticator…
- CVE-2026-32658Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability.Dell Automation Platform
- CVE-2026-43500rxrpc: Also unshare DATA/RESPONSE packets when paged frags are presentLinux
- CVE-2026-6433Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCECustom css-js-php
- CVE-2026-8260D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflowD-Link DCS-935L
- CVE-2025-61311A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_alerts.php component of GmbH Mecury Managed Print Services (docuForm) v1
- CVE-2025-61312A reflected cross-site scripted (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Mecury Managed Print Services (docuForm) v
- CVE-2025-61313A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_markeralerts.php component of GmbH Mecury Managed Print Services (docuFo
- CVE-2025-61314A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_orderopt.php component of GmbH Mecury Managed Print Services (docuForm)
- CVE-2025-65418docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attackers to read arbitrary files via crafted u
- CVE-2026-30635Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka vautomagik-genie
- CVE-2026-31247Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.docling
- CVE-2026-31248Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0.docling
- CVE-2026-31249CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in
- CVE-2026-31250CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in
- CVE-2026-31251CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in
- CVE-2026-31253The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserializatioflash-attn
- CVE-2026-31254The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-9
- CVE-2026-36734EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection.
- CVE-2026-36962SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized admini
- CVE-2026-36983D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd.
- CVE-2026-37630An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function
- CVE-2026-38566HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint.
- CVE-2026-38568HireFlow v1.2 is vulnerable to Incorrect Access Control.
Medium, low and unrated 203
- CVE-2026-8349omec-project amf NGAP Message memory corruptionomec-project amf · github.com/omec-project/amf
- CVE-2026-8346D-Link DIR-816 portForward command injectionD-Link DIR-816
- CVE-2026-8345D-Link DIR-816 singlePortForward sub_445E7C command injectionD-Link DIR-816
- CVE-2026-34962barebox ext4 Directory Parsing Infinite Loop Denial of Servicebarebox
- CVE-2026-43911Vaultwarden: Refresh tokens not invalidated on security stamp rotationdani-garcia vaultwarden
- CVE-2026-43901Wireshark MCP: Arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configuredbx33661 Wireshark-MCP · wireshark-mcp
- CVE-2026-42554Fiber: XSS in AutoFormat Content Negotiationgofiber fiber · github.com/gofiber/fiber/v3 +1
- CVE-2026-8344D-Link DIR-816 formDMZ.cgi sub_445E7C command injectionD-Link DIR-816
- CVE-2026-42188Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URLGeyserMC Geyser · org.geysermc.geyser:core
- CVE-2026-7010HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header valuesHAARG HTTP::Tiny
- CVE-2026-44695Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identityoutline
- CVE-2026-43889Outline: Unauthorized Document Publication via Mixed collectionId+documentId Shareoutline
- CVE-2026-34961barebox ext4 Extent Parsing Out-of-Bounds Readbarebox
- CVE-2026-42600MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpointminio · github.com/minio/minio
- CVE-2026-34960barebox Out-of-Bounds Read in DHCP Option Parsingbarebox
- CVE-2026-43883WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription AgreementsWWBN AVideo · wwbn/avideo
- CVE-2026-43882WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event SpoofingWWBN AVideo · wwbn/avideo
- CVE-2026-43881WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing GuardWWBN AVideo · wwbn/avideo
- CVE-2026-43880WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From AddressWWBN AVideo · wwbn/avideo
- CVE-2026-43879WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect BypassWWBN AVideo · wwbn/avideo
- CVE-2026-43878WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String LiteralWWBN AVideo · wwbn/avideo
- CVE-2026-43877WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary BytesWWBN AVideo · wwbn/avideo
- CVE-2026-43876WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel SubscribersWWBN AVideo · wwbn/avideo
- CVE-2026-43875WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account TakeoverWWBN AVideo · wwbn/avideo
- CVE-2026-42888Audiobookshelf: Path Traversal vulnerability in the audiobookshelf projectadvplyr audiobookshelf
- CVE-2026-43653The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-28917The issue was addressed with improved input validation.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-39869The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28901The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28956A memory corruption issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28957An issue with app access to camera metadata was addressed with improved logic.Apple iOS and iPadOS · Apple visionOS
- CVE-2026-28994A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-28961This issue was addressed with improved checks.Apple macOS
- CVE-2026-28977The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28920An information leakage was addressed with additional validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28993This issue was addressed by adding an additional prompt for user consent.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-28985A null pointer dereference was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-43659A race condition was addressed with additional validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-28897A buffer overflow was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28946A use-after-free issue was addressed with improved memory management.Apple Safari · Apple macOS
- CVE-2026-28819An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2026-28967A denial-of-service issue was addressed with improved input validation.Apple iOS and iPadOS
- CVE-2026-28988A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-28971The issue was addressed with improved UI handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-20696An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-28910This issue was addressed with improved permissions checking.Apple macOS
- CVE-2026-28992A memory corruption vulnerability was addressed with improved locking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28972An out-of-bounds write issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28958This issue was addressed with improved data protection.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-28903The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28942A use-after-free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28996A race condition was addressed with additional validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28914A logic issue was addressed with improved file handling.Apple macOS
- CVE-2026-43666An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28902The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28922This issue was addressed through improved state management.Apple macOS
- CVE-2026-28830A race condition was addressed with additional validation.Apple macOS
- CVE-2026-28963A privacy issue was addressed by removing the vulnerable code.Apple iOS and iPadOS
- CVE-2026-28918An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-42887Audiobookshelf: Stored Cross-Site Scripting in Login Page Custom Messageadvplyr audiobookshelf
- CVE-2026-42886Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup uploadadvplyr audiobookshelf
- CVE-2026-42885Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existenceadvplyr audiobookshelf
- CVE-2026-42884Audiobookshelf: Collection endpoints bypass library access controls exposing restricted library dataadvplyr audiobookshelf
- CVE-2026-42883Audiobookshelf: Cross-library file exfiltration via unscoped bulk download endpointadvplyr audiobookshelf
- CVE-2026-42050ImageMagick: Stack buffer overflow in XTileImageImageMagick
- CVE-2026-8321inkeep agents runAuth Middleware runAuth.ts createDevContext authentication bypassinkeep agents
- CVE-2026-8320jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgeryjishenghua jshERP
- CVE-2026-6146Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keysBIGFOOT Amazon::Credentials
- CVE-2026-42874Microdot: HTTP response splitting in Response.set_cookie()miguelgrinberg microdot · microdot
- CVE-2026-42565@workos/authkit-session: Open Redirect via state-derived redirect targetworkos authkit-session · @workos/authkit-session
- CVE-2026-42876External Secrets Operator: Privilege escalation with secret overwritingexternal-secrets · github.com/external-secrets/external-sec…
- CVE-2026-42875External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStoreexternal-secrets · github.com/external-secrets/external-sec…
- CVE-2026-8319aiwaves-cn agents cheshire_cat_core stray_cat.py recall_relevant_memories_to_working_memory resource consumptionaiwaves-cn agents · ai-agents
- CVE-2026-45026WeGIA: Stored XSS in html/atendido/processo_aceitacao.phpLabRedesCefetRJ WeGIA
- CVE-2026-45025WeGIA: Stored XSS in html/atendido/etapa_processo.phpLabRedesCefetRJ WeGIA
- CVE-2026-42873WeGIA: Error Handling Upload DocDependenteLabRedesCefetRJ WeGIA
- CVE-2026-42872WeGIA: Reflected XSS in listar_arquivos_etapa.phpLabRedesCefetRJ WeGIA
- CVE-2026-42870WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'LabRedesCefetRJ WeGIA
- CVE-2026-42871WeGIA: Error Handling familiar_docfamiliarLabRedesCefetRJ WeGIA
- CVE-2026-42866Tookie: Arbitrary file write via path traversal in -u username / -U userfile output filenameAlfredredbird tookie-osint
- CVE-2026-45224Crabbox < 0.9.0 Path Traversal via Islo Provider Workspace Resolutionopenclaw crabbox · github.com/openclaw/crabbox
- CVE-2026-43968CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1ninenines cowlib
- CVE-2026-43969Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1ninenines cowlib · cowlib
- CVE-2026-45222Summarize Insecure Daemon Configuration File Permissionssteipete summarize · @steipete/summarize
- CVE-2026-8318VectifyAI PageIndex PDF Table of Contents page_index.py toc_transformer infinite loopVectifyAI PageIndex
- CVE-2026-42865Inbox Zero: Cross-account cleaner email stream exposureelie222 inbox-zero
- CVE-2026-43995Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)FlowiseAI Flowise · flowise +1
- CVE-2026-42857Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitizationopenedx-platform
- CVE-2026-43896jq: Stack Overflow in Recursive Object Mergejqlang jq
- CVE-2026-43895jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifactsjqlang jq
- CVE-2026-44777jq: stack overflow in module loading on mutual `include`jqlang jq
- CVE-2026-43894jq: Wild stack write via signed-integer overflow in decNumber D2U() macrojqlang jq
- CVE-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protectionPython Software Foundation CPython · libpython +2
- CVE-2026-41256jq: Embedded NUL truncates top-level jq programs loaded with -fjqlang jq
- CVE-2026-7308Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via HTML Browse PageSonatype Nexus Repository
- CVE-2026-40612jq: Stack overflow via unbounded recursion in jv_containsjqlang jq
- CVE-2026-41257jq: Signed-int overflow in `stack_reallocate` (jq VM stack)jqlang jq
- CVE-2026-43638Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Importbitwarden server
- CVE-2026-3048Nexus Repository 3 - Improper LDAP Referral HandlingSonatype Nexus Repository
- CVE-2026-44659Zen Browser Mac - Address Bar Spoofing via Long Subdomainzen-browser desktop
- CVE-2026-44658Zen Browser: RSS Live-Folder Item URLs Are Not Scheme-Restricted Before Trusted Tab Creationzen-browser desktop
- CVE-2026-5266Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo.Wikimedia Foundation Echo
- CVE-2026-34095action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript requestWikimedia Foundation MediaWiki
- CVE-2026-34094Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefixWikimedia Foundation MediaWiki
- CVE-2026-41250XSS in taiga-fronttaigaio taiga-front
- CVE-2026-34093Special:UserRights allows viewing user rights from private wikiWikimedia Foundation MediaWiki
- CVE-2026-4893CVE-2026-4893dnsmasq
- CVE-2026-4891CVE-2026-4891dnsmasq
- CVE-2026-45005OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After RotationOpenClaw
- CVE-2026-45003OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv FilesOpenClaw
- CVE-2026-45002OpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template MappingOpenClaw
- CVE-2026-45001OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool AccessOpenClaw
- CVE-2026-45000OpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile CreationOpenClaw
- CVE-2026-44999OpenClaw < 2026.4.20 - Improper Trust Labeling in Isolated Cron Awareness EventsOpenClaw
- CVE-2026-44998OpenClaw < 2026.4.20 - Tool Policy Bypass via Bundled MCP/LSP ToolsOpenClaw
- CVE-2026-44997OpenClaw < 2026.4.22 - Security Envelope Constraint Bypass in ACP Child SessionsOpenClaw
- CVE-2026-44996OpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio EmbeddingOpenClaw
- CVE-2026-44995OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment VariablesOpenClaw
- CVE-2026-44994OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config EndpointOpenClaw
- CVE-2026-44993OpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card ActionsOpenClaw
- CVE-2026-44992OpenClaw 2026.4.5 through 2026.4.19 - MiniMax API Host Override via Workspace dotenvOpenClaw
- CVE-2026-44991OpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel SendersOpenClaw
- CVE-2026-42316KQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kustokafka-sink-azure-kusto
- CVE-2026-44226pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUIpyload · pyload-ng
- CVE-2026-42314pyLoad: Path Traversal via Package Folder Namepyload · pyload-ng
- CVE-2026-42312pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verificationpyload · pyload-ng
- CVE-2026-8305OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authenticationOpenClaw
- CVE-2026-3609XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation VulnerabilityWellbia XIGNCODE3
- CVE-2026-44737grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]getgrav grav-plugin-admin · getgrav/grav
- CVE-2026-42842grav-plugin-form: XSS via Taxonomy Field Values in Admin Panelgetgrav grav · getgrav grav-plugin-form +1
- CVE-2026-6815CVE-2026-6815Casdoor · github.com/casdoor/casdoor
- CVE-2026-42610Grav: Sensitive Information Disclosure via Accounts Service Bypassgetgrav grav · getgrav/grav
- CVE-2026-34092Block UI elements in 'tools'-sidebar shows presence of an autoblocked IPWikimedia Foundation MediaWiki
- CVE-2026-8292Open5GS NRF conv.c yuarel_parse denial of serviceOpen5GS
- CVE-2026-34091User localization leaked by AbuseFilter + EventStreamWikimedia Foundation MediaWiki
- CVE-2026-42841Grav: Stored XSS via Markdown media attribute() action in Grav CMSgetgrav grav · getgrav/grav
- CVE-2026-34090Suggested investigations: Handle suppressed usernamesWikimedia Foundation CheckUser
- CVE-2026-34089Memory leak in Scribunto causes runJobs.php to run out of memoryWikimedia Foundation Scribunto
- CVE-2026-34088RecentChanges entries expose suppressed content via generated log page htmlWikimedia Foundation MediaWiki
- CVE-2026-44201Wagtail: Improper restriction handling on Documents and Images APIwagtail
- CVE-2026-44200Wagtail: Improper permission handling when copying pageswagtail
- CVE-2026-44199Wagtail: Improper permission handling when deleting form submissionswagtail
- CVE-2026-34087Users API leaks whether privileged users have their user groups disabled for lack of 2FAWikimedia Foundation OATHAuth
- CVE-2026-44198Wagtail: Improper permission handling when viewing page historywagtail
- CVE-2026-44197Wagtail: Improper permission handling when comparing revisionswagtail
- CVE-2026-7820pgAdmin 4: Account-lockout bypass via Flask-Security default /login viewpgadmin.org pgAdmin · pgadmin4
- CVE-2026-7817pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpointspgadmin.org pgAdmin · pgadmin4
- CVE-2026-7814pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizerpgadmin.org pgAdmin · pgadmin4
- CVE-2026-34086AbuseFilter misuses ::userCanBitfield, exposing access-controlled informationWikimedia Foundation AbuseFilter
- CVE-2026-3320Multiple vulnerabilities in Cradle e-commercee-commerce Cradle
- CVE-2026-3319Multiple vulnerabilities in Cradle e-commercee-commerce Cradle
- CVE-2026-6093Corteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escapingcortezaproject corteza
- CVE-2026-8291Open5GS NRF nnrf-handler.c ogs_nnrf_nfm_handle_nf_profile denial of serviceOpen5GS
- CVE-2026-8290Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of serviceOpen5GS
- CVE-2026-8289Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of serviceOpen5GS
- CVE-2026-8288Open5GS SMF gsm-handler.c denial of serviceOpen5GS
- CVE-2025-9973Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account TakeoverWSO2 Identity Server · WSO2 Conditional Authentication User…
- CVE-2026-6956Reflected XSS in ATutorATutor
- CVE-2026-6909Reflected XSS in ATutorATutor
- CVE-2026-26946Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper privilege management vulnerabDell ECS · Dell ObjectScale
- CVE-2025-8325Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized OperationsWSO2 API Control Plane · WSO2 Universal Gateway +4
- CVE-2026-35157Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula eleDell ECS · Dell ObjectScale
- CVE-2025-8154HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header ManipulationWSO2 API Manager · WSO2 Universal Gateway +4
- CVE-2025-43992Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immutDell ECS · Dell ObjectScale
- CVE-2024-0391Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryWSO2 Identity Server · WSO2 Open Banking IAM +2
- CVE-2026-41018Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URLApache Software Foundation Apache Airflow Providers Elastic…
- CVE-2026-43826Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URLApache Software Foundation Apache Airflow Providers OpenSea…
- CVE-2026-5084WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurelyASPEER WebDyne::Session
- CVE-2026-1677net: TLS 1.2 connections allowed on TLS 1.3 socketszephyrproject-rtos Zephyr
- CVE-2026-8276bettercap MySQL Server mysql_server.go integer coercionbettercap · github.com/bettercap/bettercap/v2
- CVE-2026-8275bettercap zerogod IPP Service zerogod_ipp_primitives.go ippReadChunkedBody integer coercionbettercap · github.com/bettercap/bettercap +1
- CVE-2026-8274npitre cramfs-tools Directory cramfsck.c do_directory path traversalnpitre cramfs-tools
- CVE-2026-8273D-Link DNS-320 system_mgr.cgi cgi_merge_user os command injectionD-Link DNS-320
- CVE-2026-8272D-Link DNS-320 webfile_mgr.cgi chown os command injectionD-Link DNS-320
- CVE-2026-8271D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injectionD-Link DNS-320
- CVE-2026-8270Open5GS SMF ogs_nas_parse_qos_rules denial of serviceOpen5GS
- CVE-2026-8269Open5GS SMF smf_nsmf_handle_create_sm_context denial of serviceOpen5GS
- CVE-2026-8268Open5GS SMF OpenAPI_list_create denial of serviceOpen5GS
- CVE-2026-8267Open5GS SMF smf_nsmf_handle_created_data_in_vsmf denial of serviceOpen5GS
- CVE-2026-8266Open5GS SMF gsm-build.c gsm_build_pdu_session_establishment_accept denial of serviceOpen5GS
- CVE-2026-8265Tenda AC6 httpd getLogFile get_log_file os command injectionTenda AC6
- CVE-2026-8264Tenda AC6 httpd WifiApScan formWifiApScan os command injectionTenda AC6
- CVE-2026-8263Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injectionTenda AC6
- CVE-2026-8262Devs Palace ERP Online chart-save cross site scriptingDevs Palace ERP Online
- CVE-2026-8261Squirrel sqobject.cpp Load heap-based overflowSquirrel
- CVE-2026-8259Tenda AC6 httpd telnet os command injectionTenda AC6
- CVE-2026-8258Squirrel sqstdstring.cpp validate_format stack-based overflowSquirrel
- CVE-2026-8257WebAssembly Binaryen BrOn wasm-ir-builder.cpp makeBrOn assertionWebAssembly Binaryen
- CVE-2026-8256Devs Palace ERP Online mr-save cross site scriptingDevs Palace ERP Online
- CVE-2026-8255Devs Palace ERP Online add_new_customer cross site scriptingDevs Palace ERP Online
- CVE-2025-61305A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_firmware.php component of GmbH Mecury Managed Print Services (docuForm)
- CVE-2025-61306A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_coveragealerts.php component of GmbH Mecury Managed Print Services (docu
- CVE-2025-61307A reflected cross-site scripted (XSS) vulnerability in the acc-menu_papers.php component of GmbH Mecury Managed Print Services (docuForm) v1
- CVE-2025-61308A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_maintenance.php component of GmbH Mecury Managed Print Services (docuFor
- CVE-2025-61309A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_departments.php component of GmbH Mecury Managed Print Services (docuFor
- CVE-2025-61310A reflected cross-site scripted (XSS) vulnerability in the acc-menu_billings.php component of GmbH Mecury Managed Print Services (docuForm)
- CVE-2025-65415docuFORM Managed Print Service Client 11.11c is vulnerable to a session fixation attack via the login page of the application.
- CVE-2025-65416docuFORM Managed Print Service Client 11.11c is vulnerable to arbitrary file upload via pmupdate.php.
- CVE-2025-65417docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page of the application.
- CVE-2026-31246GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the Execugpt-pilot
- CVE-2026-31252CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in
- CVE-2026-36906Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record Function
- CVE-2026-38569HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fields via POST /candi