CVEs published May 14, 2026
304 CVEs were published on May 14, 2026: 29 critical, 126 high. 2 are now in CISA KEV.
- Published
- 304
- Critical
- 29
- High
- 126
- Medium
- 121
- Low
- 28
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 237
Most affected products
- Google Chrome
- 78
- GitLab
- 24
- PostgreSQL
- 11
- HCL AION
- 9
- AcademySoftwareFoundation OpenImageIO
- 8
- gotenberg · github.com/gotenberg/gotenberg/v8 +1
- 7
- fleetdm fleet · github.com/fleetdm/fleet/v4
- 6
- siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- 6
- modelcontextprotocol registry · github.com/modelcontextprot…
- 5
- givanz Vvveb
- 4
Critical 29
- CVE-2026-44212PrestaShop: Stored XSS executable in customer service viewPrestaShop · prestashop/prestashop
- CVE-2026-44666HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Executionzelon88 HRConvert2
- CVE-2026-8580Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafGoogle Chrome
- CVE-2026-8511Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafteGoogle Chrome
- CVE-2026-8634Crabbox < v0.12.0 Environment Variable Information Disclosureopenclaw crabbox · github.com/openclaw/crabbox
- CVE-2026-27886Strapi may leak sensitive data via relational filtering due to lack of query sanitizationstrapi · @strapi/strapi
- CVE-2026-44523Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgeryenchant97 note-mark · github.com/enchant97/note-mark/backend
- CVE-2026-44592Gradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoningwavelens gradient
- CVE-2026-22599Strapi Vulnerable to SQL Injection in Content Type Builderstrapi · @strapi/content-type-builder +1
- CVE-2026-41315mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')midoks mdserver-web
- CVE-2026-44670SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuansiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-44588SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSSsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-45375SiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code executionsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-44542FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletiongtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…
- CVE-2026-41615Microsoft Authenticator Information Disclosure VulnerabilityMicrosoft Authenticator for Android · Microsoft Authenticat…
- CVE-2026-42555Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin usersvaltimo-platform valtimo · com.ritense.valtimo case +5
- CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…
- CVE-2026-42281MagicMirror²: Unauthenticated SSRF via /cors endpointMagicMirrorOrg MagicMirror · magicmirror
- CVE-2026-42596Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookgotenberg · github.com/gotenberg/gotenberg/v7 +1
- CVE-2026-42589Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injectiongotenberg · github.com/gotenberg/gotenberg/v8 +1
- CVE-2026-44484Compromise of PyTorch Lightning PyPi Package VersionsLightning-AI pytorch-lightning · pytorch-lightning +1
- CVE-2026-44482soundcloud-rpc: Remote Code Execution via XSS in Track Titlerichardhbtz soundcloud-rpc
- CVE-2026-42457vCluster Platform: Stored XSS can lead to privilege escalationloft-sh loft
- CVE-2026-2347IDOR in Akıllı Ticaret's E-Commerce PackAkilli Commerce Software Technologies Ltd. E-Commerce Websi…
- CVE-2025-11024SQLi in Akıllı Ticaret's E-Commerce PackAkilli Commerce Software Technologies Ltd. E-Commerce Websi…
- CVE-2026-6512InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple ParametersInfused Addons InfusedWoo Pro
- CVE-2026-6510InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'Infused Addons InfusedWoo Pro
- CVE-2026-6271Career Section <= 1.7 - Unauthenticated Arbitrary File Uploadshahinurislam Career Section
- CVE-2026-8181Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeoverburstbv Burst Statistics – Privacy-Friendly WordPress Analy…
High 126
- CVE-2026-44671ZITADEL: LDAP Filter Injection in Login Flowzitadel · github.com/zitadel/zitadel
- CVE-2026-44700Elixir WebRTC: Missing DTLS peer fingerprint validation in ex_webrtc client-role handshakeelixir-webrtc ex_webrtc
- CVE-2026-42847ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')MacWarrior clipbucket-v5
- CVE-2026-44678Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUIDtuist
- CVE-2026-44673libyang: lyb_read_string() integer overflow → heap buffer overflowCESNET libyang
- CVE-2026-42327rust-openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLsrust-openssl · openssl
- CVE-2026-45369python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocoluniversal-tool-calling-protocol python-utcp · utcp-cli
- CVE-2026-45370python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injectionuniversal-tool-calling-protocol python-utcp · utcp-cli
- CVE-2026-44647OneDev: Path Traversal (read capability via Git LFS pointer resolution)theonedev onedev
- CVE-2026-44637libsixel: integer overflow in parsersaitoha libsixel
- CVE-2026-44636libsixel: integer overflow in encodersaitoha libsixel
- CVE-2026-8587Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a maliciousGoogle Chrome
- CVE-2026-8585Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-8581Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-8577Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-8575Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentiaGoogle Chrome
- CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-8573Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox esGoogle Chrome
- CVE-2026-8571Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2026-8569Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escGoogle Chrome
- CVE-2026-8557Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-8555Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted Google Chrome
- CVE-2026-8551Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UIGoogle Chrome
- CVE-2026-8549Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-8548Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-8547Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-8544Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-8542Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-8540Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2026-8534Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2026-8533Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-8532Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-8531Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corrGoogle Chrome
- CVE-2026-8530Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-8529Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandboxGoogle Chrome
- CVE-2026-8527Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrGoogle Chrome
- CVE-2026-8526Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox Google Chrome
- CVE-2026-8525Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escGoogle Chrome
- CVE-2026-8524Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandboGoogle Chrome
- CVE-2026-8558Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox vGoogle Chrome
- CVE-2026-8523Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-8522Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafteGoogle Chrome
- CVE-2026-8521Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious netwGoogle Chrome
- CVE-2026-8520Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTGoogle Chrome
- CVE-2026-8519Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory wGoogle Chrome
- CVE-2026-8518Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-8517Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2026-8515Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestuGoogle Chrome
- CVE-2026-8514Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-8513Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-8512Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UGoogle Chrome
- CVE-2026-8510Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-8509Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox Google Chrome
- CVE-2026-8597Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDKAWS Amazon SageMaker Python SDK · sagemaker
- CVE-2026-8596Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve pathAWS Amazon SageMaker Python SDK · sagemaker
- CVE-2026-3290Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable valuesSilicon Labs RS9116 SDK
- CVE-2026-8629Crabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpointsopenclaw crabbox
- CVE-2026-43903OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release buildsAcademySoftwareFoundation OpenImageIO
- CVE-2026-43904OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image widthAcademySoftwareFoundation OpenImageIO
- CVE-2026-43905OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocationAcademySoftwareFoundation OpenImageIO
- CVE-2026-43907OpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR)AcademySoftwareFoundation OpenImageIO
- CVE-2026-43908OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoderAcademySoftwareFoundation OpenImageIO
- CVE-2026-26062Fleet server may terminate unexpectedly when handling certain gRPC requestsfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-43909OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoderAcademySoftwareFoundation OpenImageIO
- CVE-2026-24899Fleet Windows MDM Azure AD JWT Authentication Bypassfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-43906OpenImageIO: HEIF Heap overflowAcademySoftwareFoundation OpenImageIO
- CVE-2026-23998Fleet has a Windows MDM management endpoint authentication bypassfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-44633Live Helper Chat: REST API chat update accepts arbitrary chat fields across department boundarieslivehelperchat
- CVE-2026-8621Crabbox < v0.12.0 Authentication Bypass via Header Spoofingopenclaw crabbox · github.com/openclaw/crabbox
- CVE-2026-44522Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Executionenchant97 note-mark · github.com/enchant97/note-mark/backend
- CVE-2026-45371SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-44586SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code executionsiyuan-note siyuan
- CVE-2026-42334Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionAutomattic mongoose · mongoose
- CVE-2025-15024RCE in Yordam Informatics' Library Automation SystemYordam Information Technology Consulting, Training and Elec…
- CVE-2025-15023Improper Access Control in Yordam Informatics' Library Automation SystemYordam Information Technology Consulting, Training and Elec…
- CVE-2026-42897Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-44516Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizervaltimo-platform valtimo · com.ritense.valtimo web +1
- CVE-2026-44827Diffusers: None.py Trust Remote Code Bypasshuggingface diffusers · diffusers
- CVE-2026-44513Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom componentshuggingface diffusers · diffusers
- CVE-2026-44511Katalyst Koi: Session cookies can be replayed after user logoutkatalyst koi · katalyst-koi
- CVE-2026-20224Cisco Catalyst SD-WAN Manager XML External Entity Injection VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2026-44503Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirectmicrosoft kiota-java · Microsoft.Kiota.Abstractions +6
- CVE-2026-44504Aegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR)aegra · aegra-api
- CVE-2026-42283DevSpace UI Server WebSocket CheckOrigin does not validate sourcedevspace-sh devspace · github.com/loft-sh/devspace
- CVE-2026-42590Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklistgotenberg · github.com/gotenberg/gotenberg/v8 +1
- CVE-2026-42595Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypassgotenberg · github.com/gotenberg/gotenberg/v8 +1
- CVE-2026-42594Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutinegotenberg · github.com/gotenberg/gotenberg/v8 +1
- CVE-2026-42591Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8gotenberg · github.com/gotenberg/gotenberg/v8 +1
- CVE-2026-40893Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Movegotenberg · github.com/gotenberg/gotenberg/v8 +1
- CVE-2026-42881STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTMLsquinky86 STIGQter
- CVE-2026-44375Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowExceptionAArnott Nerdbank.MessagePack · Nerdbank.MessagePack
- CVE-2026-41937Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Uploadgivanz Vvveb
- CVE-2025-62628Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potentialAMD AIM-T Manageability Service · AMD Cloud Manageabilit… +4
- CVE-2026-41935Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Servicegivanz Vvveb
- CVE-2026-42559RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportmodelcontextprotocol rust-sdk · dynoxide-rs +2
- CVE-2026-6637PostgreSQL refint allows stack buffer overflow and SQL injectionPostgreSQL
- CVE-2026-6479PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursionPostgreSQL
- CVE-2026-6477PostgreSQL libpq lo_* functions let server superuser overwrite client stack memoryPostgreSQL
- CVE-2026-6476PostgreSQL pg_createsubscriber allows SQL injection via subscription namePostgreSQL
- CVE-2026-6475PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choicePostgreSQL
- CVE-2026-6473PostgreSQL server undersizes allocations, via integer wraparoundPostgreSQL
- CVE-2025-15025IDOR in Yordam Informatics' Library Automation SystemYordam Information Technology Consulting, Training and Elec…
- CVE-2026-4029Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Exportwpengine Database Backup for WordPress
- CVE-2026-4030Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletionwpengine Database Backup for WordPress
- CVE-2026-4031Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interceptionwpengine Database Backup for WordPress
- CVE-2025-12008IDOR in APPYAP's Yaay Social Media AppAPPYAP Technology and Information Yaay Social Media App
- CVE-2026-5798Unsafe Object Reference (IDOR) vulnerability in Stel OrderStel Order
- CVE-2025-68420Privilege Escalation in Comarch ERP OptimaComarch ERP Optima
- CVE-2025-68421Hardcoded credentials in Comarch ERP OptimaComarch ERP Optima
- CVE-2026-8468Unbounded buffer accumulation in multipart header parsing causes denial of service in plugelixir-plug plug
- CVE-2026-6514InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' ParameterInfused Addons InfusedWoo Pro
- CVE-2026-3718ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' HeaderManageWP Worker
- CVE-2026-5395Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parametertechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2026-6506InfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta UpdateInfused Addons InfusedWoo Pro
- CVE-2026-3892Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameterstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2025-14869Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2025-14870Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-1659Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-6073Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-7377Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-7481Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-5396Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parametertechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2026-46446SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection.Alinto SOGo
- CVE-2026-46445SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.Alinto SOGo
- CVE-2026-24712Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.
- CVE-2026-46419Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor Yubico webauthn-server-core
Medium, low and unrated 149
- CVE-2026-45248Hedera Guardian Authentication Bypass Information Disclosurehashgraph guardian
- CVE-2026-6811PHP Stack ExhaustionMongoDB PHP Driver
- CVE-2026-44428MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audiencemodelcontextprotocol registry · github.com/modelcontextprot…
- CVE-2026-44427MCP Registry: Open Redirectmodelcontextprotocol registry · github.com/modelcontextprot…
- CVE-2026-44429MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`modelcontextprotocol registry · github.com/modelcontextprot…
- CVE-2026-44430MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlistmodelcontextprotocol registry · github.com/modelcontextprot…
- CVE-2026-45781MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claimsmodelcontextprotocol registry · github.com/modelcontextprot…
- CVE-2026-44679Tuist: Forgot password flow lacks throttling for reset email deliverytuist
- CVE-2026-44662rust-openssl: Heap buffer overflow when encrypting with AES key-wrap-with-paddingrust-openssl · openssl
- CVE-2026-44661python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocoluniversal-tool-calling-protocol python-utcp · utcp-http
- CVE-2026-44638libsixel: NULL pointer dereferencesaitoha libsixel
- CVE-2026-8586Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access Google Chrome
- CVE-2026-8584Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-8583Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-8582Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive informatioGoogle Chrome
- CVE-2026-8579Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-8578Out of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-8576Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross-Google Chrome
- CVE-2026-8572Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-8570Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from proGoogle Chrome
- CVE-2026-8567Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory wGoogle Chrome
- CVE-2026-8566Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretiGoogle Chrome
- CVE-2026-8565Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to instalGoogle Chrome
- CVE-2026-8564Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofGoogle Chrome
- CVE-2026-8563Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to bypass naGoogle Chrome
- CVE-2026-8562Side-channel information leakage in Navigation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data Google Chrome
- CVE-2026-8561Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted Google Chrome
- CVE-2026-8560Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168 allowed a remote attacker to perform an out of bGoogle Chrome
- CVE-2026-8559Integer overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of Google Chrome
- CVE-2026-8556Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the Google Chrome
- CVE-2026-8554Type Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-8553Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to performGoogle Chrome
- CVE-2026-8552Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memoryGoogle Chrome
- CVE-2026-8550Use after free in Google Lens in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-8546Out of bounds read in GPU in Google Chrome on Mac and Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-8545Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2026-8543Out of bounds read in FileSystem in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2026-8541Out of bounds read in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtaGoogle Chrome
- CVE-2026-8539Script injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to inject arbitrary scripts oGoogle Chrome
- CVE-2026-8538Insufficient validation of untrusted input in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2026-8537Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2026-8536Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had Google Chrome
- CVE-2026-8535Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2026-8528Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had comprGoogle Chrome
- CVE-2026-8516Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced Google Chrome
- CVE-2026-43996OpenImageIO: Integer wraparound in bounds check of decode_pixel leads to out-of-bounds read in TGA paletted image decoderAcademySoftwareFoundation OpenImageIO
- CVE-2026-46356Fleet: IP spoofing allows bypassing API rate limitingfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-26191Fleet vulnerable to OS command injection in software packagesfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-24000Fleet has a rate limiting bypass via untrusted client IP headersfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-22707Strapi Upload Plugin MIME Validation Bypass via Content APIstrapi · @strapi/upload
- CVE-2026-22706Strapi: Password Reset Does Not Revoke Existing Refresh Sessionsstrapi · @strapi/admin +1
- CVE-2026-44589nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)nuxt-modules og-image · nuxt-og-image
- CVE-2026-27680CSS Injection vulnerability in SAP NetWeaver Application Server ABAPSAP_SE SAP NetWeaver Application Server ABAP
- CVE-2025-64526Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingstrapi · @strapi/plugin-users-permissions
- CVE-2026-45147SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disksiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-45148SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadatasiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-42598Pode: Directory Traversal is possible on Static RoutesBadgerati Pode
- CVE-2026-46470An issue was discovered in GStreamer gst-plugins-good before 1.28.2.GStreamer Good Plug-ins
- CVE-2026-46469An issue was discovered in GStreamer gst-plugins-good before 1.28.2.GStreamer Good Plug-ins
- CVE-2026-44544gittuf: Policy can be rolled back to prior valid versiongittuf · github.com/gittuf/gittuf
- CVE-2026-44283etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checksetcd-io etcd · go.etcd.io/etcd/v3 +2
- CVE-2026-42572Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`hatchet-dev hatchet · github.com/hatchet-dev/hatchet
- CVE-2026-44520Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandlerdocling-project docling-graph · docling-graph
- CVE-2026-6332Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVACSchneider Electric Ecostruxure™ Machine Expert HVAC
- CVE-2026-41888Distribution: Tag deletion bypasses `storage.delete.enabled` configurationdistribution · github.com/distribution/distribution +1
- CVE-2026-45448ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')ntopng
- CVE-2026-44348PoDoFo: Double-free vulnerability in compute_hash_to_sign()podofo
- CVE-2026-44515Nextcloud News: Authenticated blind SSRF via feed URLnextcloud news
- CVE-2026-44514Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated userskubetail-org kubetail · github.com/kubetail-org/kubetail… +1
- CVE-2025-62305HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactionsHCL AION
- CVE-2026-44312css_parser allows to MITM included https css urlspremailer css_parser · css_parser
- CVE-2026-6923Nuvoton - CWE-1300: Improper Protection of Physical Side ChannelsNuvoton NPCT7xx
- CVE-2025-62317HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.HCL AION
- CVE-2025-62308HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposedHCL AION
- CVE-2025-62309HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields.HCL AION
- CVE-2025-62312HCL AION is affected by a vulnerability where basic authorization tokens are used for authenticationHCL AION
- CVE-2025-62316HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configuredHCL AION
- CVE-2026-20210Cisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2026-20209Cisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2025-62313HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced.HCL AION
- CVE-2025-62311HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels.HCL AION
- CVE-2025-62310HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operationsHCL AION
- CVE-2026-44501DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerabilitydatahub-project datahub
- CVE-2026-42159Flowsint: Stored XSS in description of nodereconurge flowsint
- CVE-2026-42597Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// schemegotenberg · github.com/gotenberg/gotenberg/v7 +1
- CVE-2026-42593Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routesgotenberg · github.com/gotenberg/gotenberg/v8 +1
- CVE-2026-42592Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routesgotenberg · github.com/gotenberg/gotenberg/v7 +1
- CVE-2026-44371Open OnDemand: Specially crafted filenames can execute javascript in the file browserOSC ondemand
- CVE-2026-44216Wasmtime: Panic when allocating a table exceeding the size of the host's address spacebytecodealliance wasmtime · wasmtime
- CVE-2026-44308Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notificationsawspring spring-cloud-aws · io.awspring.cloud spring-clo… +1
- CVE-2026-42186OpenBao's Namespace Deletion May Not Delete Data Properlyopenbao · github.com/openbao/openbao
- CVE-2025-62619Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrievAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +23
- CVE-2025-62625Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentiaAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +27
- CVE-2026-44374Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks@backstage plugin-catalog-backend-module-unprocessed · @… +4
- CVE-2026-41933Vvveb < 1.0.8.3 Directory Listing Information Disclosuregivanz Vvveb
- CVE-2026-41932Vvveb < 1.0.8.3 Stored XSS via Signup Controllergivanz Vvveb
- CVE-2026-21730Stored XSS in VerbaVerint Verba
- CVE-2026-1630Reflected XSS in WEBCON BPSWEBCON BPS
- CVE-2026-6638PostgreSQL REFRESH PUBLICATION allows SQL injection via table namePostgreSQL
- CVE-2026-6575PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats arrayPostgreSQL
- CVE-2026-6478PostgreSQL discloses MD5-hashed passwords via covert timing channelPostgreSQL
- CVE-2026-6474PostgreSQL timeofday() can disclose portions of server memoryPostgreSQL
- CVE-2026-6472PostgreSQL CREATE TYPE does not check multirange schema CREATE privilegePostgreSQL
- CVE-2026-43644podinfo 6.11.2 Reflected XSS via /echo Endpointstefanprodan podinfo · github.com/stefanprodan/podinfo
- CVE-2026-5790Stored Cross-Site Scripting (XSS) vulnerability in Stel OrderStel Order
- CVE-2026-6008IDOR in Im Park's DijiDemiIm Park Information Technology, Electronics, Press, Publish…
- CVE-2026-45205Apache Commons Configuration: StackOverflowError for YAML input with cyclesApache Software Foundation Apache Commons Configuration · o…
- CVE-2026-8295Integer overflow in simdjsonsimdjson
- CVE-2026-6504Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameterwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-6145User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameterwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-6174CC Child Pages <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parametercaterhamcomputing CC Child Pages
- CVE-2026-6206MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameterwebsoudan MW WP Form
- CVE-2026-6670Media Sync <= 1.4.9 - Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameterserolsk8 Media Sync
- CVE-2026-6252Meta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attributemr2p Meta Field Block – Display custom fields in the Block…
- CVE-2026-3694Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcodeboldthemes Bold Page Builder
- CVE-2026-5365LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX RouteLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2026-6225Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' ParameterTaskbuilder – Project Management & Task Management Tool Wit…
- CVE-2026-5193Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_userwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2025-12669Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2025-13874Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-1184Deserialization of Untrusted Data in GitLabGitLab
- CVE-2026-1322Business Logic Errors in GitLabGitLab
- CVE-2026-1338Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-2900Missing Authorization in GitLabGitLab
- CVE-2026-3073Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-3074Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-3160Unintended Proxy or Intermediary ('Confused Deputy') in GitLabGitLab
- CVE-2026-3607Access Control Check Implemented After Asset is Accessed in GitLabGitLab
- CVE-2026-4524Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2026-4527Cross-Site Request Forgery (CSRF) in GitLabGitLab
- CVE-2026-6063Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-6335Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-6883Missing Authorization in GitLabGitLab
- CVE-2026-7471Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2026-8280Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-8144Missing Authorization in GitLabGitLab
- CVE-2025-15345MapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameterinteractivegeomaps MapGeo – Interactive Geo Maps
- CVE-2026-3829WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tamperinggowebsmarty WP Encryption – One Click Free SSL Certificate…
- CVE-2026-6417GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'bojansliskovicglscroatiacom GLS Shipping for WooCommerce
- CVE-2026-5243The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widgetposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2026-5361Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parametersmub Envira Gallery – Image Photo Gallery, Albums, Video Ga…
- CVE-2026-7648LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameterthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-7525My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameterjoedolson My Calendar – Accessible Event Manager
- CVE-2026-5486Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameterunitecms Unlimited Elements For Elementor
- CVE-2025-69443Remote Code Execution in coleam00 Archon 0.1.0.
- CVE-2026-24710Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.
- CVE-2026-24711Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.
- CVE-2026-38740Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information.
- CVE-2026-44919In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///OpenStack Ironic · ironic