CVEs published May 13, 2026
346 CVEs were published on May 13, 2026: 26 critical, 132 high. 1 is now in CISA KEV.
- Published
- 346
- Critical
- 26
- High
- 132
- Medium
- 168
- Low
- 8
- Unrated
- 12
- Now in CISA KEV
- 1
- Fix available
- 244
Most affected products
- F5 BIG-IP
- 35
- Linux
- 14
- patriksimek vm2 · vm2
- 14
- vercel next.js · next
- 12
- cubecart
- 9
- curl
- 8
- F5 BIG-IP · F5 BIG-IQ
- 8
- Grafana OSS
- 8
- Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- 8
- frappe erpnext
- 7
Critical 26
- CVE-2026-8500Web::Passwd versions through 0.03 for Perl is vulnerable to RCEEVANK Web::Passwd
- CVE-2026-45158OPNsense: Command Injection via Attacker-Controlled DHCP Configopnsense core
- CVE-2026-44194OPNsense: RCE on user managmentopnsense core
- CVE-2026-44193OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodopnsense core
- CVE-2026-44442ERPNext: Unauthorised Document modification due to missing validationfrappe erpnext
- CVE-2026-44381MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listingsMISP
- CVE-2026-45714CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCEcubecart
- CVE-2026-45053CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files APIcubecart
- CVE-2026-44377CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCEcubecart
- CVE-2026-44364misp-modules website - Missing CSRF protection in the website home blueprintmisp-modules
- CVE-2026-44351fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassnearform fast-jwt · fast-jwt
- CVE-2026-44005vm2: Sandbox escapepatriksimek vm2 · vm2
- CVE-2026-45411vm2: Sandbox Breakout Using Async Generatorpatriksimek vm2 · vm2
- CVE-2026-44009vm2: Sandbox Breakout Through Null Proto Exceptionpatriksimek vm2 · vm2
- CVE-2026-44008vm2: Snabox breakout via `neutralizeArraySpeciesBatch`patriksimek vm2 · vm2
- CVE-2026-44007vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command executionpatriksimek vm2 · vm2
- CVE-2026-44006vm2: Sandbox Escapepatriksimek vm2 · vm2
- CVE-2026-43999vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escapepatriksimek vm2 · vm2
- CVE-2026-43997vm2: Sandbox Escapepatriksimek vm2 · vm2
- CVE-2020-37168Ecommerce Systempay 1.0 Production Key Brute ForcePaiement Ecommerce Systempay
- CVE-2026-42062ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter.ELECOM CO. WRC-BE72XSD-B · ELECOM CO. WRC-BE72XSD-BA +2
- CVE-2026-40621ELECOM wireless LAN access point devices do not require authentication to access some specific URLs.ELECOM CO. WRC-BE72XSD-B · ELECOM CO. WRC-BE72XSD-BA +2
- CVE-2026-41050Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template renderingSUSE Rancher · github.com/rancher/fleet
- CVE-2025-11159Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party ComponentHitachi Vantara Pentaho Data Integration and Analytics
- CVE-2026-32661Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version).Canon Marketing Japan GUARDIANWALL MailSuite · Canon Market…
- CVE-2025-27851The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack.
High 132
- CVE-2026-29206Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow QueryWebPros cPanel · WebPros WP Squared
- CVE-2026-32991Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.WebPros cPanel · WebPros WP Squared
- CVE-2026-29205Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment downloaWebPros cPanel · WebPros WP Squared
- CVE-2026-32992SSL verification is disabled in the DNS Cluster system.WebPros cPanel · WebPros WP Squared
- CVE-2026-32993Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arWebPros cPanel · WebPros WP Squared
- CVE-2026-44478hoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Tokenhoppscotch
- CVE-2026-44471gitoxide: Symlink prefix-reuse allows worktree escape during checkoutGitoxideLabs gitoxide · gix-fs
- CVE-2026-44369CVAT: Stored XSS via annotation guidescvat-ai cvat
- CVE-2026-42463SQLBot: Unauthorized Access Vulnerabilitydataease SQLBot
- CVE-2026-44447ERPNext: Possibility of SQL Injection due to missing validationfrappe erpnext
- CVE-2026-44446ERPNext: Possibility of SQL Injection due to missing validationfrappe erpnext
- CVE-2026-44418Incomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrmphili67 ecclesiacrm
- CVE-2026-42561Python-Multipart: Denial of Service via unbounded multipart part headersKludex python-multipart · python-multipart
- CVE-2026-44380MISP: Improper access control in auth key reset allows privilege escalation to site administratorMISP
- CVE-2026-45708CubeCart: Authenticated RCE via Invoice Template → Order Printcubecart
- CVE-2026-45055CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Headercubecart
- CVE-2026-39358CubeCart: Time-based Blind SQL Injectioncubecart
- CVE-2026-42304Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chainstwisted
- CVE-2026-42602azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayopen-telemetry opentelemetry-collector-contrib · github.com…
- CVE-2026-45229Quark Drive (quark-auto-save) < 0.8.5 Mass Assignment via POST /updateCp0204 quark-auto-save
- CVE-2026-21821HCL BigFix SCM Reporting is affected by vulnerabilities in jQueryHCLSoftware BigFix SCM Reporting
- CVE-2026-33376Auth Proxy IPv6 whitelist bypassGrafana OSS
- CVE-2026-33377Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard AdminGrafana OSS
- CVE-2026-42552Flight: Sensitive information disclosure via default error handler in flightphp/coreflightphp core · flightphp/core
- CVE-2026-42551Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/coreflightphp core · flightphp/core
- CVE-2026-42550Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / deleteflightphp core · flightphp/core
- CVE-2026-42548Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()flightphp core · flightphp/core
- CVE-2026-42031CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`ckan
- CVE-2026-43970Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frameninenines cowlib
- CVE-2026-8466Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboyninenines cowboy
- CVE-2026-42587Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSnetty · io.netty netty-codec-http +3
- CVE-2026-33583Arqit SKA-Platform Vulnerable to Key ExposureArqit Symmetric Key Agreement Platform
- CVE-2026-0257PAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-42584Netty: HttpClientCodec response desynchronizationnetty · io.netty netty-codec-http +1
- CVE-2026-42583Netty: Lz4FrameDecoder resource exhaustionnetty · io.netty netty-codec +3
- CVE-2026-42582Netty: HTTP/3 QPACK literal unbounded allocationnetty · io.netty netty-codec-http3 +1
- CVE-2026-30906Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalatiZoom Communications Zoom Rooms
- CVE-2026-42579Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)netty · io.netty:netty-codec-dns
- CVE-2026-42577Netty: epoll transport denial of service via RST on half-closed TCP connectionnetty · io.netty:netty-transport-classes-epoll
- CVE-2026-30905External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenZoom Communications Zoom Workplace VDI Plugin
- CVE-2026-0236Prisma Browser: Code Injection Enables Security Controls BypassPalo Alto Networks Prisma Browser
- CVE-2026-0237Prisma Browser: Improperly Restricted Automation Bridge Allows Security BypassPalo Alto Networks Prisma Browser
- CVE-2026-0263PAN-OS: Remote Code Execution (RCE) in IKEv2 ProcessingPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0264PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code ExecutionPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0265PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabledPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-44004vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)patriksimek vm2 · vm2
- CVE-2026-44001vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)patriksimek vm2 · vm2
- CVE-2026-43998vm2: NodeVM require.root bypass via symlink traversal allows sandbox escapepatriksimek vm2 · vm2
- CVE-2026-45109Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesvercel next.js · next
- CVE-2026-44579Next.js: Denial of Service via connection exhaustion in applications using Cache Componentsvercel next.js · next
- CVE-2026-44578Next.js: Server-side request forgery in applications using WebSocket upgradesvercel next.js · next
- CVE-2026-44574Next.js: Middleware / Proxy bypass through dynamic route parameter injectionvercel next.js · next
- CVE-2026-44575Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesvercel next.js · next
- CVE-2026-44573Next.js: Middleware / Proxy bypass in Pages Router applications using i18nvercel next.js · next
- CVE-2026-45033GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitorgithub copilot-cli · @github/copilot
- CVE-2026-44470Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMServiceanthropics claude-code
- CVE-2026-44467Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessionsanthropics claude-code
- CVE-2026-44431urllib3: Sensitive headers forwarded across origins in proxied low-level redirectsurllib3
- CVE-2026-44432urllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIurllib3
- CVE-2026-42266JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.jupyterlab
- CVE-2026-43481net-shapers: don't free reply skb after genlmsg_reply()Linux
- CVE-2026-43476iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()Linux
- CVE-2026-42557jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted contentjupyterlab · jupyter notebook +1
- CVE-2026-44295protobufjs-cli: Code injection in pbjs static output from crafted schema namesprotobufjs protobuf.js · protobufjs-cli
- CVE-2026-42290protobufjs-cli: OS Command Injectionprotobufjs protobuf.js · protobufjs-cli
- CVE-2026-44293protobufjs: Code injection through bytes field defaults in generated toObject codeprotobufjs protobuf.js · protobufjs
- CVE-2026-44291protobufjs: Code generation gadget after prototype pollutionprotobufjs protobuf.js · protobufjs
- CVE-2026-44290protobufjs: Process-wide denial of service through unsafe option pathsprotobufjs protobuf.js · protobufjs
- CVE-2026-44289protobufjs: Denial of service through unbounded protobuf recursionprotobufjs protobuf.js · protobufjs
- CVE-2020-37226Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortbyJoomsky J2 JOBS
- CVE-2020-37224Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortbyJoomsky J2 JOBS
- CVE-2020-37223IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege EscalationIObit Uninstaller
- CVE-2020-37221Atomic Alarm Clock 6.3 Stack Overflow via SEH UnicodeDrive-software Atomic Alarm Clock
- CVE-2020-37220Huawei HG630 V2 Router Authentication Bypass via Serial Numberwww.huawei.com HG630 V2 Router
- CVE-2020-37219Joomla com_fabrik 3.9.11 Directory Traversal via image.phpFabrikar com_fabrik
- CVE-2020-37218Joomla com_hdwplayer 4.2 SQL Injection via search.phpcom_hdwplayer
- CVE-2026-6282A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remoteLenovo Personal Cloud T2s · Lenovo Personal Cloud T2Pro +8
- CVE-2026-6281A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the locLenovo Personal Cloud T2s · Lenovo Personal Cloud T2Pro +8
- CVE-2026-42945NGINX ngx_http_rewrite_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2026-40423BIG-IP SIP profile vulnerabilityF5 BIG-IP
- CVE-2026-42930Appliance mode iControl REST vulnerabilityF5 BIG-IP
- CVE-2026-39458BIG-IP DNS Cache vulnerabilityF5 BIG-IP
- CVE-2026-42406BIG-IP and BIG-IQ privilege escalation vulnerabilityF5 BIG-IP · F5 BIG-IQ
- CVE-2026-32643BIG-IP and BIG-IQ privilege escalation vulnerabilityF5 BIG-IP · F5 BIG-IQ
- CVE-2026-39455BIG-IP Configuration utility vulnerabilityF5 BIG-IP
- CVE-2026-34176Knowledge Appliance mode iControl REST vulnerabilityF5 BIG-IP
- CVE-2026-41225iControl REST vulnerabilityF5 BIG-IP
- CVE-2026-39459iControl REST and tmsh vulnerabilityF5 BIG-IP
- CVE-2026-41953BIG-IP Privilege Escalation vulnerabilityF5 BIG-IP
- CVE-2026-40631BIG-IP iControl SOAP vulnerabilityF5 BIG-IP
- CVE-2026-40698iControl REST and TMSH vulnerabilityF5 BIG-IP · F5 BIG-IQ
- CVE-2026-42924BIG-IP iControl SOAP vulnerabilityF5 BIG-IP
- CVE-2026-40060BIG-IP Advanced WAF and ASM vulnerabilityF5 BIG-IP
- CVE-2026-42409BIG-IP HTTP/2 vulnerabilityF5 BIG-IP
- CVE-2026-41227BIG-IP HTTP/2 Layer 7 Dos Protection vulnerabilityF5 BIG-IP
- CVE-2026-40618BIG-IP SSL/TLS vulnerabilityF5 BIG-IP
- CVE-2026-41956BIG-IP TMM VulnerabilityF5 BIG-IP
- CVE-2026-42920BIG-IP DTLS VulnerabilityF5 BIG-IP
- CVE-2026-40629BIG-IP SSL/TLS vulnerabilityF5 BIG-IP
- CVE-2026-41218BIG-IP PEM iRules vulnerabilityF5 BIG-IP
- CVE-2026-20916BIG-IQ iControl REST vulnerabilityF5 BIG-IQ
- CVE-2026-41957BIG-IP and BIG-IQ Configuration utility vulnerabilityF5 BIG-IP · F5 BIG-IQ
- CVE-2026-40067BIG-IP APM VulnerabilityF5 BIG-IP
- CVE-2026-39806HTTP/1 chunked decoder infinite loop on requests with trailer fields in banditmtrudel bandit
- CVE-2026-39803HTTP/1 chunked body reader ignores length cap in banditmtrudel bandit
- CVE-2026-4609ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joiningmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2026-6177Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Textsmub Custom Twitter Feeds – A Tweets Widget or X Feed Widget
- CVE-2026-3425RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'rometheme RTMKit
- CVE-2026-35506ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter.ELECOM CO. WRC-BE72XSD-B · ELECOM CO. WRC-BE72XSD-BA +2
- CVE-2026-4798Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameterthemefusion Avada (Fusion) Builder
- CVE-2026-25710The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmaKDE plasma-login-manager
- CVE-2026-6276stale custom cookie host causes cookie leakcurl
- CVE-2026-5773wrong reuse of SMB connectioncurl
- CVE-2026-25705Rancher Extensions have arbitrary file access via path traversalSUSE rancher · github.com/rancher/rancher
- CVE-2026-44612Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries.Bytello Share (Windows Edition) installer executable
- CVE-2026-6929JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameterbeardev JoomSport – for Sports: Team & League, Football, Ho…
- CVE-2026-21019Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code wSamsung Mobile Devices
- CVE-2026-7635coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Fieldgdragon coreActivity: Activity Logging for WordPress
- CVE-2026-6888SQL Injection VulnerabilityAdvantech SaaS Composer · Advantech IoTSuite Growth Linu… +6
- CVE-2025-61972Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Management Network (SMAMD EPYC™ 9004 Series Processors · AMD EPYC™ 9005 Series… +5
- CVE-2025-62627An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel meESXi 8.x and ESXi 9.x hosts using AMD-Pensando DPU products
- CVE-2025-62624A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially ESXi 8.x and ESXi 9.x hosts using AMD-Pensando DPU products
- CVE-2025-62623A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially ESXi 8.x and ESXi 9.x hosts using AMD-Pensando DPU products
- CVE-2026-8336Post-authentication use-after-free error in $_internalJsEmit and mapreduce commandsMongoDB Server
- CVE-2026-8199Post-auth memory exhaustion via bitwise match expressionsMongoDB Server
- CVE-2024-55045Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the task_mavobc_entry function at /comm/task_
- CVE-2025-27850The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack.
- CVE-2025-27853The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed.
- CVE-2025-28343striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function ThreadReadButtons.
- CVE-2025-28344striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function AuxJack.
- CVE-2026-36741U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection.
- CVE-2026-37430An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execu
Medium, low and unrated 188
- CVE-2026-41281Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerabilityKDDI あんしんフィルター for au
- CVE-2026-44195OPNsense: Authentication lockout bypassopnsense core
- CVE-2026-44439LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page captureLookyloo PlaywrightCapture · playwrightcapture
- CVE-2026-44437Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefixangular-cli · @angular/ssr
- CVE-2026-44448ERPNext: Unauthorised Document modification due to missing validationfrappe erpnext
- CVE-2026-44445ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Modulefrappe erpnext
- CVE-2026-44441ERPNext: Possible SSRF by any authenticated userfrappe erpnext
- CVE-2026-44440ERPNext: Path Traversal Leading to Sensitive File Exposurefrappe erpnext
- CVE-2026-44423ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session datashellhub-io shellhub · github.com/shellhub-io/shellhub
- CVE-2026-44424ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespaceshellhub-io shellhub · github.com/shellhub-io/shellhub
- CVE-2026-44426ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership checkshellhub-io shellhub · github.com/shellhub-io/shellhub
- CVE-2026-44425ShellHub: Crash-DoS via field injection in filter and sort-by parametersshellhub-io shellhub · github.com/shellhub-io/shellhub
- CVE-2026-44379MISP: Improper UUID validation in MISP CollectionsMISP
- CVE-2026-45054CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listingcubecart
- CVE-2026-44376CubeCart: Reflected XSS in Store Search Barcubecart
- CVE-2026-39428CubeCart: Stored Cross-Site Scripting (XSS)cubecart
- CVE-2026-44372Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rulesnitrojs nitro · nitrojs nitropack +2
- CVE-2026-44373Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules`nitrojs nitro · nitrojs nitropack +2
- CVE-2026-44368PyQuorum: Timing side‑channel in mul_modsvvqt pyquorum · pyquorum
- CVE-2026-8328FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host addressPython Software Foundation CPython
- CVE-2026-45228Quark Drive (quark-auto-save) < 0.8.5 Stored XSS via System ConfigurationCp0204 quark-auto-save
- CVE-2026-28374IDOR in Annotations API allows unprivileged users to DELETE annotationGrafana OSS
- CVE-2026-33378Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup MacroGrafana OSS
- CVE-2026-28383Grafana plugin resources can lead to unbounded memory allocationGrafana OSS
- CVE-2026-33380SQL Expressions Read File From DiskGrafana OSS · github.com/grafana/grafana
- CVE-2026-28380BAC in Snapshot API allows deletion of unauthorized dashboard snapshotsGrafana OSS
- CVE-2026-33381Users can generate Service Account tokens after permissions removalGrafana OSS · github.com/grafana/grafana
- CVE-2026-28376Grafana Live push endpoint allows unbounded memory allocation leading to OOMGrafana OSS
- CVE-2026-28379Viewer-triggered race condition in Grafana Live leads to complete server crashGrafana OSS
- CVE-2026-42549Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project rootflightphp core · flightphp/core
- CVE-2026-44363Unsafe remote resource fetching in expansion misp-modulesmisp-modules
- CVE-2026-0243Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through IPv6 Crafted PacketPalo Alto Networks Prisma SD-WAN ION
- CVE-2026-22677Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpointnesquena hermes-webui
- CVE-2026-0248Prisma Access Agent: Improper Certificate Validation VulnerabilityPalo Alto Networks Prisma Access Agent
- CVE-2026-0242Trust Protection Foundation: SQL Injection VulnerabilityPalo Alto Networks Trust Protection Foundation
- CVE-2026-0244Prisma SD-WAN: Improper Certificate Validation VulnerabilityPalo Alto Networks Prisma SD-WAN ION
- CVE-2026-0241Trust Protection Foundation: Multiple Authorization Bypass VulnerabilitiesPalo Alto Networks Trust Protection Foundation
- CVE-2026-42032CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`ckan
- CVE-2026-41255CKAN: CSRF exemption primed by anonymous requestsckan
- CVE-2026-0245Prisma Access Agent: Information Disclosure VulnerabilitiesPalo Alto Networks Prisma Access Agent
- CVE-2026-0240Trust Protection Foundation: Sensitive Information Disclosure VulnerabilityPalo Alto Networks Trust Protection Foundation
- CVE-2026-41132CKAN: No certificate validation on STMP connectionckan
- CVE-2026-0246Prisma Access Agent: Local Privilege Escalation VulnerabilityPalo Alto Networks Prisma Access Agent
- CVE-2026-0247Prisma Access Agent Endpoint DLP: Authorization Bypass VulnerabilitiesPalo Alto Networks Prisma Access Agent
- CVE-2026-33585Arqit SKA-Platform Improper Handling of Parameters VulnerabilityArqit Symmetric Key Agreement Platform
- CVE-2026-0249GlobalProtect App: Certificate Validation Bypass VulnerabilitiesPalo Alto Networks GlobalProtect App
- CVE-2026-33584Arqit SKA-Platform Enables Access to Debug InformationArqit Symmetric Key Agreement Platform
- CVE-2026-0239Chronosphere Chronocollector Information Disclosure VulnerabilityPalo Alto Networks Chronosphere Chronocollector
- CVE-2026-0250GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or GatewayPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2026-44248Netty: Resource exhaustion in MqttDecodernetty · io.netty netty-codec-mqtt +1
- CVE-2026-0238Broker VM: Improper Input Validation in Broker VM Certificate and Key FieldsPalo Alto Networks Broker VM
- CVE-2026-42586Netty: CRLF Injection in Netty Redis Codec Encodernetty · io.netty netty-codec-redis +1
- CVE-2026-0251GlobalProtect App: Local Privilege Escalation VulnerabilitiesPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2026-0256PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web InterfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0235Prisma Browser: Access and Data Rule BypassPalo Alto Networks Prisma Browser
- CVE-2026-42585Netty: HTTP Request Smuggling due to malformed Transfer-Encodingnetty · io.netty netty-codec-http +1
- CVE-2026-0258PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL FetchingPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0259WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B)Palo Alto Networks WildFire WF-500 and WF-500-B
- CVE-2026-42580Netty: HTTP Request Smuggling due to incorrect chunk size parsingnetty · io.netty netty-codec-http +1
- CVE-2026-8496A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7Alinto SOGo SOGo
- CVE-2026-0261PAN-OS: Authenticated Admin Command Injection VulnerabilityPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-42578Netty: HTTP Header Injection via HttpProxyHandler Disabled Validationnetty · io.netty:netty-handler-proxy
- CVE-2026-42581Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitizationnetty · io.netty:netty-codec-http
- CVE-2026-30904Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of inforZoom Communications Zoom Workplace
- CVE-2026-0262PAN-OS: Denial of Service Vulnerabilities in Network Traffic ParsingPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-44003vm2: Transformer Fast-Path Bypass Exposes Internal State Variablepatriksimek vm2 · vm2
- CVE-2026-44002vm2: Host File Path Disclosure via Stack Trace Information Leakpatriksimek vm2 · vm2
- CVE-2026-44000vm2: sandbox boundary bypass via host Promise resolution preserving host object identitypatriksimek vm2 · vm2
- CVE-2026-44582Next.js: Cache poisoning via collisions in React Server Component cache-bustingvercel next.js · next
- CVE-2026-44581Next.js: Cross-site scripting in App Router applications using CSP noncesvercel next.js · next
- CVE-2026-44580Next.js: Cross-site scripting in beforeInteractive scripts with untrusted inputvercel next.js · next
- CVE-2026-44577Next.js: Denial of Service in the Image Optimization APIvercel next.js · next
- CVE-2026-44576Next.js: Cache poisoning in React Server Component responsesvercel next.js · next
- CVE-2026-2695Lack of Server-side validation in Instruction Input in TeamViewer DEX Platform (On-Premises)TeamViewer DEX
- CVE-2026-44572Next.js: Middleware / Proxy redirects can be cache-poisonedvercel next.js · next
- CVE-2025-32425AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoSSignificant-Gravitas AutoGPT
- CVE-2026-45028Astro: Server island encrypted parameters vulnerable to cross-component replaywithastro astro · astro
- CVE-2026-44479Vercel: Non-interactive mode includes CLI arguments in suggested command outputvercel
- CVE-2026-44664fast-xml-builder: Comment Value bypass regexNaturalIntelligence fast-xml-builder · fast-xml-builder
- CVE-2026-44665fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributesNaturalIntelligence fast-xml-builder · fast-xml-builder
- CVE-2026-43489liveupdate: luo_file: remember retrieve() statusLinux
- CVE-2026-43488usb: xhci: Prevent interrupt storm on host controller error (HCE)Linux
- CVE-2026-43487ata: libata-core: Disable LPM on ST1000DM010-2EP102Linux
- CVE-2026-43486arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faultsLinux
- CVE-2026-43485nouveau/gsp: drop WARN_ON in ACPI probesLinux
- CVE-2026-43484mmc: core: Avoid bitfield RMW for claim/retune flagsLinux
- CVE-2026-43483KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activatedLinux
- CVE-2026-43482sched_ext: Disable preemption between scx_claim_exit() and kicking helper workLinux
- CVE-2026-43480ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisitionLinux
- CVE-2026-43479net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnectLinux
- CVE-2026-43478ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_putLinux
- CVE-2026-43477drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTLLinux
- CVE-2026-44459Hono: Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()honojs hono · hono
- CVE-2026-44458Hono: CSS Declaration Injection via Style Object Values in JSX SSRhonojs hono · hono
- CVE-2026-44457Hono: Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakagehonojs hono · hono
- CVE-2026-44456Hono: bodyLimit() can be bypassed for chunked / unknown-length requestshonojs hono · hono
- CVE-2026-44455Hono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injectionhonojs hono · hono
- CVE-2026-8367aria2c Improper Certificate Validationaria2_project aria2c
- CVE-2026-45740protobufjs: Denial of Service via unbounded recursive JSON descriptor expansionprotobufjs protobuf.js · protobufjs
- CVE-2026-44294protobufjs: Denial of service from crafted field names in generated codeprotobufjs protobuf.js · protobufjs
- CVE-2026-44292protobufjs: Prototype injection in generated message constructorsprotobufjs protobuf.js · protobufjs
- CVE-2026-44288protobufjs: Overlong UTF-8 decodingprotobufjs protobuf.js · protobufjs +1
- CVE-2020-37225Powie's WHOIS Domain Check 0.9.31 Persistent Cross-Site ScriptingPowie WHOIS Domain Check
- CVE-2020-37222Kuicms Php EE 2.0 Persistent Cross-Site Scripting via bbs replyKuicms Php EE
- CVE-2020-37217Easy2Pilot 7 Cross-Site Request Forgery via admin.phpEasy2Pilot
- CVE-2020-37174WOOF / Products Filter Professional for WooCommerce 1.2.3 Persistent XSSHUSKY Products Filter Professional for WooCommerce
- CVE-2020-37169WordPress Plugin ultimate-member 2.1.3 Local File InclusionUltimate Member ultimate-member
- CVE-2026-42926NGINX ngx_http_proxy_v2_module vulnerabilityF5 NGINX Open Source
- CVE-2026-40460NGINX ngx_quic_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2026-42946NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2026-42934NGINX ngx_http_charset_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2026-40701NGINX ngx_http_ssl_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2026-24464Appliance mode iControl REST vulnerabilityF5 BIG-IP
- CVE-2026-41959iControl and tmsh REST vulnerabilityF5 BIG-IP · F5 BIG-IQ
- CVE-2026-42058BIG-IP iControl REST vulnerabilityF5 BIG-IP
- CVE-2026-42937iControl REST and tmsh vulnerabilityF5 BIG-IP · F5 BIG-IQ
- CVE-2026-32673BIG-IP scripted monitor vulnerabilityF5 BIG-IP
- CVE-2026-41217BIG-IP tmsh vulnerabilityF5 BIG-IP
- CVE-2026-42063iControl SOAP vulnerabilityF5 BIG-IP
- CVE-2026-40061iControl REST and tmsh vulnerabilityF5 BIG-IP
- CVE-2026-35062iControl SOAP vulnerabilityF5 BIG-IP
- CVE-2026-42919F5 BIG-IP Appliance Mode VulnerabilityF5 BIG-IP
- CVE-2026-42781BIG-IP FastL4 virtual server vulnerabilityF5 BIG-IP
- CVE-2026-42408BIG-IP DNS tmsh vulnerabilityF5 BIG-IP
- CVE-2026-40699BIG-IP Configuration utility vulnerabilityF5 BIG-IP
- CVE-2026-34019BIG-IP BFD vulnerabilityF5 BIG-IP
- CVE-2026-42780BIG-IP SSL Orchestrator vulnerabilityF5 BIG-IP · F5 SSL Orchestrator
- CVE-2026-41219BIG-IP QKView vulnerabilityF5 BIG-IP · F5 BIG-IQ
- CVE-2026-40462iControl REST and tmsh vulnerabilityF5 BIG-IP
- CVE-2026-28758BIG-IP iControl REST vulnerabilityF5 BIG-IP
- CVE-2026-41954iControl REST and tmsh vulnerabilityF5 BIG-IP · F5 BIG-IQ
- CVE-2026-40435BIG-IP httpd access control vulnerabilityF5 BIG-IP
- CVE-2026-40703BIG-IP Configuration utility CSRF vulnerabilityF5 BIG-IP
- CVE-2026-8369Improper Input Validation in OpenThread NAT64 TranslatorThe OpenThread Authors OpenThread
- CVE-2026-4607ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modificationmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2026-4608ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parametermetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2026-8463Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded inputLEONT Crypt::Argon2
- CVE-2026-3426RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modificationrometheme RTMKit
- CVE-2026-42961ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens.ELECOM CO. WAB-BE187-M · ELECOM CO. WAB-BE72-M +2
- CVE-2026-42950ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value.ELECOM CO. WAB-BE187-M · ELECOM CO. WAB-BE72-M +2
- CVE-2026-42948Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices.ELECOM CO. WAB-BE187-M · ELECOM CO. WAB-BE72-M +2
- CVE-2026-25107ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files.ELECOM CO. WRC-X1800GS-B · ELECOM CO. WRC-X3000GS2-B +11
- CVE-2026-4782Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameterthemefusion Avada (Fusion) Builder
- CVE-2026-41051csync2 uses insecure temporary directories when compiled with C99 or lateropenSUSE Tumbleweed
- CVE-2024-47091Privilege escalation via mk_mysql agent plugin on WindowsCheckmk
- CVE-2026-44931malcontent: Disk Space Exhaustion via Globally Accessible D-Bus APIgnome malcontent
- CVE-2026-7168cross-proxy Digest auth state leakcurl
- CVE-2026-7009OCSP stapling bypass with Apple SecTrustcurl
- CVE-2026-6429netrc credential leak with reused proxy connectioncurl
- CVE-2026-6253proxy credentials leak over redirect-to proxycurl
- CVE-2026-5545wrong reuse of HTTP Negotiate connectioncurl
- CVE-2026-4873connection reuse ignores TLS requirementcurl
- CVE-2026-2515Hostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key UpdateHostinger Reach – AI-Powered Email Marketing for WordPress
- CVE-2026-3004Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attributeinc2734 Snow Monkey Blocks
- CVE-2025-14767WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attributewpclever WPC Badge Management for WooCommerce
- CVE-2026-2725Improper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"Gerrit
- CVE-2026-6965Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2025-14033ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposureghera74 ilGhera Support System for WooCommerce
- CVE-2026-21024Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functiSamsung Mobile Samsung System Support Service
- CVE-2026-21022Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive informaSamsung Mobile Devices
- CVE-2026-21021Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.Samsung Mobile Devices
- CVE-2026-21020Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged funcSamsung Mobile Devices
- CVE-2026-21018Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2026-21016Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.Samsung Mobile Devices
- CVE-2026-21015Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.Samsung Mobile Devices
- CVE-2025-9989Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scriptingbroadstreetads Broadstreet
- CVE-2026-7051Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameterpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2026-6828Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attributetechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2025-9987Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosurebroadstreetads Broadstreet
- CVE-2026-6962Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpcodefactory Cost of Goods: Product Cost & Profit Calculat…
- CVE-2026-7619Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parametersmub Charitable – Donation Plugin for WordPress – Fundraisi…
- CVE-2025-9988Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creationbroadstreetads Broadstreet
- CVE-2025-14755Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Referencestylemix Cost Calculator Builder
- CVE-2024-36315Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensAMD EPYC™ Series 9004 Processors · AMD EPYC™Series 4004… +12
- CVE-2025-61971Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing configurations, potentiaAMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +7
- CVE-2026-8202Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operatorsMongoDB Server
- CVE-2026-8201Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted FieldsMongoDB Server
- CVE-2026-8200Schema validation log messages may not redact user dataMongoDB Server
- CVE-2024-48519Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial
- CVE-2024-51394Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a d
- CVE-2024-51395Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a d
- CVE-2025-27852The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack.
- CVE-2025-29338NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buffer overflow via the
- CVE-2026-31156A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_gene
- CVE-2026-36738U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access Control.
- CVE-2026-36742Hiseeu C90 v5.7.15 is vulnerable to Insecure Permissions.
- CVE-2026-37428qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file.
- CVE-2026-37429qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file.