# CVEs published 2026-05-14

304 CVEs were published on May 14, 2026: 29 critical, 126 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-45248](https://cve.now/CVE-2026-45248.md): Hedera Guardian Authentication Bypass Information Disclosure (CVSS 6.9, hashgraph guardian)
- [CVE-2026-6811](https://cve.now/CVE-2026-6811.md): PHP Stack Exhaustion (CVSS 6.0, MongoDB PHP Driver)
- [CVE-2026-44671](https://cve.now/CVE-2026-44671.md): ZITADEL: LDAP Filter Injection in Login Flow (CVSS 7.5, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-44428](https://cve.now/CVE-2026-44428.md): MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience (CVSS 2.1, modelcontextprotocol registry · github.com/modelcontextprot…)
- [CVE-2026-44427](https://cve.now/CVE-2026-44427.md): MCP Registry: Open Redirect (CVSS 0.0, modelcontextprotocol registry · github.com/modelcontextprot…)
- [CVE-2026-44429](https://cve.now/CVE-2026-44429.md): MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled \`websiteUrl\` (CVSS 5.1, modelcontextprotocol registry · github.com/modelcontextprot…)
- [CVE-2026-44430](https://cve.now/CVE-2026-44430.md): MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist (CVSS 6.3, modelcontextprotocol registry · github.com/modelcontextprot…)
- [CVE-2026-45781](https://cve.now/CVE-2026-45781.md): MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims (CVSS 3.5, modelcontextprotocol registry · github.com/modelcontextprot…)
- [CVE-2026-44700](https://cve.now/CVE-2026-44700.md): Elixir WebRTC: Missing DTLS peer fingerprint validation in ex\_webrtc client-role handshake (CVSS 8.7, elixir-webrtc ex\_webrtc)
- [CVE-2026-42847](https://cve.now/CVE-2026-42847.md): ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVSS 7.1, MacWarrior clipbucket-v5)
- [CVE-2026-44212](https://cve.now/CVE-2026-44212.md): PrestaShop: Stored XSS executable in customer service view (CVSS 9.3, PrestaShop · prestashop/prestashop)
- [CVE-2026-44678](https://cve.now/CVE-2026-44678.md): Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID (CVSS 7.1, tuist)
- [CVE-2026-44679](https://cve.now/CVE-2026-44679.md): Tuist: Forgot password flow lacks throttling for reset email delivery (CVSS 6.9, tuist)
- [CVE-2026-44673](https://cve.now/CVE-2026-44673.md): libyang: lyb\_read\_string() integer overflow → heap buffer overflow (CVSS 7.5, CESNET libyang)
- [CVE-2026-44666](https://cve.now/CVE-2026-44666.md): HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution (CVSS 9.3, zelon88 HRConvert2)
- [CVE-2026-44662](https://cve.now/CVE-2026-44662.md): rust-openssl: Heap buffer overflow when encrypting with AES key-wrap-with-padding (CVSS 5.1, rust-openssl · openssl)
- [CVE-2026-42327](https://cve.now/CVE-2026-42327.md): rust-openssl: undefined behavior in X509Ref::ocsp\_responders for certificates with non-UTF-8 OCSP URLs (CVSS 8.7, rust-openssl · openssl)
- [CVE-2026-45369](https://cve.now/CVE-2026-45369.md): python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol (CVSS 8.3, universal-tool-calling-protocol python-utcp · utcp-cli)
- [CVE-2026-45370](https://cve.now/CVE-2026-45370.md): python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection (CVSS 7.7, universal-tool-calling-protocol python-utcp · utcp-cli)
- [CVE-2026-44661](https://cve.now/CVE-2026-44661.md): python-utcp: SSRF via attacker-controlled OpenAPI servers\[0\].url in HTTP communication protocol (CVSS 4.7, universal-tool-calling-protocol python-utcp · utcp-http)
- [CVE-2026-44647](https://cve.now/CVE-2026-44647.md): OneDev: Path Traversal (read capability via Git LFS pointer resolution) (CVSS 7.1, theonedev onedev)
- [CVE-2026-44637](https://cve.now/CVE-2026-44637.md): libsixel: integer overflow in parser (CVSS 7.1, saitoha libsixel)
- [CVE-2026-44636](https://cve.now/CVE-2026-44636.md): libsixel: integer overflow in encoder (CVSS 7.4, saitoha libsixel)
- [CVE-2026-44638](https://cve.now/CVE-2026-44638.md): libsixel: NULL pointer dereference (CVSS 2.5, saitoha libsixel)
- [CVE-2026-8587](https://cve.now/CVE-2026-8587.md): Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious (CVSS 8.8, Google Chrome)
- [CVE-2026-8586](https://cve.now/CVE-2026-8586.md): Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access (CVSS 5.5, Google Chrome)
- [CVE-2026-8585](https://cve.now/CVE-2026-8585.md): Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the rend (CVSS 7.5, Google Chrome)
- [CVE-2026-8584](https://cve.now/CVE-2026-8584.md): Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the rend (CVSS 4.2, Google Chrome)
- [CVE-2026-8583](https://cve.now/CVE-2026-8583.md): Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised t (CVSS 5.3, Google Chrome)
- [CVE-2026-8582](https://cve.now/CVE-2026-8582.md): Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive informatio (CVSS 5.3, Google Chrome)
- [CVE-2026-8581](https://cve.now/CVE-2026-8581.md): Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-8580](https://cve.now/CVE-2026-8580.md): Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-8579](https://cve.now/CVE-2026-8579.md): Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised th (CVSS 3.1, Google Chrome)
- [CVE-2026-8578](https://cve.now/CVE-2026-8578.md): Out of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proce (CVSS 3.1, Google Chrome)
- [CVE-2026-8577](https://cve.now/CVE-2026-8577.md): Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-8576](https://cve.now/CVE-2026-8576.md): Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross- (CVSS 4.3, Google Chrome)
- [CVE-2026-8575](https://cve.now/CVE-2026-8575.md): Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentia (CVSS 8.3, Google Chrome)
- [CVE-2026-8574](https://cve.now/CVE-2026-8574.md): Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-8573](https://cve.now/CVE-2026-8573.md): Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox es (CVSS 8.3, Google Chrome)
- [CVE-2026-8572](https://cve.now/CVE-2026-8572.md): Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised (CVSS 3.1, Google Chrome)
- [CVE-2026-8571](https://cve.now/CVE-2026-8571.md): Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the (CVSS 8.3, Google Chrome)
- [CVE-2026-8570](https://cve.now/CVE-2026-8570.md): Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from pro (CVSS 6.5, Google Chrome)
- [CVE-2026-8569](https://cve.now/CVE-2026-8569.md): Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox esc (CVSS 8.3, Google Chrome)
- [CVE-2026-8567](https://cve.now/CVE-2026-8567.md): Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory w (CVSS 4.3, Google Chrome)
- [CVE-2026-8566](https://cve.now/CVE-2026-8566.md): Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discreti (CVSS 4.3, Google Chrome)
- [CVE-2026-8565](https://cve.now/CVE-2026-8565.md): Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to instal (CVSS 4.7, Google Chrome)
- [CVE-2026-8564](https://cve.now/CVE-2026-8564.md): Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker to perform UI spoof (CVSS 4.2, Google Chrome)
- [CVE-2026-8563](https://cve.now/CVE-2026-8563.md): Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to bypass na (CVSS 4.3, Google Chrome)
- [CVE-2026-8562](https://cve.now/CVE-2026-8562.md): Side-channel information leakage in Navigation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data (CVSS 4.3, Google Chrome)
- [CVE-2026-8561](https://cve.now/CVE-2026-8561.md): Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted (CVSS 5.4, Google Chrome)
- [CVE-2026-8560](https://cve.now/CVE-2026-8560.md): Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168 allowed a remote attacker to perform an out of b (CVSS 4.3, Google Chrome)
- [CVE-2026-8559](https://cve.now/CVE-2026-8559.md): Integer overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of (CVSS 4.3, Google Chrome)
- [CVE-2026-8557](https://cve.now/CVE-2026-8557.md): Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process (CVSS 7.5, Google Chrome)
- [CVE-2026-8556](https://cve.now/CVE-2026-8556.md): Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the (CVSS 3.1, Google Chrome)
- [CVE-2026-8555](https://cve.now/CVE-2026-8555.md): Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-8554](https://cve.now/CVE-2026-8554.md): Type Confusion in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proce (CVSS 3.1, Google Chrome)
- [CVE-2026-8553](https://cve.now/CVE-2026-8553.md): Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform (CVSS 3.1, Google Chrome)
- [CVE-2026-8552](https://cve.now/CVE-2026-8552.md): Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory (CVSS 4.3, Google Chrome)
- [CVE-2026-8551](https://cve.now/CVE-2026-8551.md): Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI (CVSS 8.8, Google Chrome)
- [CVE-2026-8550](https://cve.now/CVE-2026-8550.md): Use after free in Google Lens in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to (CVSS 6.5, Google Chrome)
- [CVE-2026-8549](https://cve.now/CVE-2026-8549.md): Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-8548](https://cve.now/CVE-2026-8548.md): Out of bounds write in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-8547](https://cve.now/CVE-2026-8547.md): Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromis (CVSS 7.5, Google Chrome)
- [CVE-2026-8546](https://cve.now/CVE-2026-8546.md): Out of bounds read in GPU in Google Chrome on Mac and Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the rend (CVSS 5.3, Google Chrome)
- [CVE-2026-8545](https://cve.now/CVE-2026-8545.md): Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process (CVSS 3.1, Google Chrome)
- [CVE-2026-8544](https://cve.now/CVE-2026-8544.md): Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-8543](https://cve.now/CVE-2026-8543.md): Out of bounds read in FileSystem in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in (CVSS 5.3, Google Chrome)
- [CVE-2026-8542](https://cve.now/CVE-2026-8542.md): Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-8541](https://cve.now/CVE-2026-8541.md): Out of bounds read in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obta (CVSS 5.3, Google Chrome)
- [CVE-2026-8540](https://cve.now/CVE-2026-8540.md): Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-8539](https://cve.now/CVE-2026-8539.md): Script injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to inject arbitrary scripts o (CVSS 5.4, Google Chrome)
- [CVE-2026-8538](https://cve.now/CVE-2026-8538.md): Insufficient validation of untrusted input in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the (CVSS 5.3, Google Chrome)
- [CVE-2026-8537](https://cve.now/CVE-2026-8537.md): Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin d (CVSS 4.3, Google Chrome)
- [CVE-2026-8536](https://cve.now/CVE-2026-8536.md): Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had (CVSS 3.1, Google Chrome)
- [CVE-2026-8535](https://cve.now/CVE-2026-8535.md): Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the (CVSS 5.3, Google Chrome)
- [CVE-2026-8534](https://cve.now/CVE-2026-8534.md): Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the ren (CVSS 8.3, Google Chrome)
- [CVE-2026-8533](https://cve.now/CVE-2026-8533.md): Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process (CVSS 8.3, Google Chrome)
- [CVE-2026-8532](https://cve.now/CVE-2026-8532.md): Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-8531](https://cve.now/CVE-2026-8531.md): Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially exploit heap corr (CVSS 8.8, Google Chrome)
- [CVE-2026-8530](https://cve.now/CVE-2026-8530.md): Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer pro (CVSS 8.3, Google Chrome)
- [CVE-2026-8529](https://cve.now/CVE-2026-8529.md): Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-8528](https://cve.now/CVE-2026-8528.md): Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compr (CVSS 4.3, Google Chrome)
- [CVE-2026-8527](https://cve.now/CVE-2026-8527.md): Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitr (CVSS 8.8, Google Chrome)
- [CVE-2026-8526](https://cve.now/CVE-2026-8526.md): Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-8525](https://cve.now/CVE-2026-8525.md): Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox esc (CVSS 8.3, Google Chrome)
- [CVE-2026-8524](https://cve.now/CVE-2026-8524.md): Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbo (CVSS 8.8, Google Chrome)
- [CVE-2026-8558](https://cve.now/CVE-2026-8558.md): Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox v (CVSS 8.8, Google Chrome)
- [CVE-2026-8523](https://cve.now/CVE-2026-8523.md): Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome)
- [CVE-2026-8522](https://cve.now/CVE-2026-8522.md): Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2026-8521](https://cve.now/CVE-2026-8521.md): Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via malicious netw (CVSS 7.5, Google Chrome)
- [CVE-2026-8520](https://cve.now/CVE-2026-8520.md): Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HT (CVSS 8.3, Google Chrome)
- [CVE-2026-8519](https://cve.now/CVE-2026-8519.md): Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory w (CVSS 8.8, Google Chrome)
- [CVE-2026-8518](https://cve.now/CVE-2026-8518.md): Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-8517](https://cve.now/CVE-2026-8517.md): Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage (CVSS 8.8, Google Chrome)
- [CVE-2026-8516](https://cve.now/CVE-2026-8516.md): Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced (CVSS 5.3, Google Chrome)
- [CVE-2026-8515](https://cve.now/CVE-2026-8515.md): Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestu (CVSS 8.3, Google Chrome)
- [CVE-2026-8514](https://cve.now/CVE-2026-8514.md): Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome)
- [CVE-2026-8513](https://cve.now/CVE-2026-8513.md): Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-8512](https://cve.now/CVE-2026-8512.md): Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific U (CVSS 8.3, Google Chrome)
- [CVE-2026-8511](https://cve.now/CVE-2026-8511.md): Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafte (CVSS 9.6, Google Chrome)
- [CVE-2026-8510](https://cve.now/CVE-2026-8510.md): Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proc (CVSS 7.5, Google Chrome)
- [CVE-2026-8509](https://cve.now/CVE-2026-8509.md): Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-8597](https://cve.now/CVE-2026-8597.md): Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDK (CVSS 7.2, AWS Amazon SageMaker Python SDK · sagemaker)
- [CVE-2026-8596](https://cve.now/CVE-2026-8596.md): Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path (CVSS 7.2, AWS Amazon SageMaker Python SDK · sagemaker)
- [CVE-2026-3290](https://cve.now/CVE-2026-3290.md): Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values (CVSS 7.4, Silicon Labs RS9116 SDK)
- [CVE-2026-8634](https://cve.now/CVE-2026-8634.md): Crabbox \< v0.12.0 Environment Variable Information Disclosure (CVSS 9.3, openclaw crabbox · github.com/openclaw/crabbox)
- [CVE-2026-8629](https://cve.now/CVE-2026-8629.md): Crabbox \< v0.12.0 Privilege Escalation via Agent Ticket Endpoints (CVSS 8.6, openclaw crabbox)
- [CVE-2026-43903](https://cve.now/CVE-2026-43903.md): OpenImageIO: SGI RLE decoder heap buffer overflow OIIO\_DASSERT bounds checks are no-ops in release builds (CVSS 8.4, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-43904](https://cve.now/CVE-2026-43904.md): OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width (CVSS 8.4, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-43905](https://cve.now/CVE-2026-43905.md): OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation (CVSS 7.1, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-43996](https://cve.now/CVE-2026-43996.md): OpenImageIO: Integer wraparound in bounds check of decode\_pixel leads to out-of-bounds read in TGA paletted image decoder (CVSS 5.5, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-43907](https://cve.now/CVE-2026-43907.md): OpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR) (CVSS 8.3, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-46356](https://cve.now/CVE-2026-46356.md): Fleet: IP spoofing allows bypassing API rate limiting (CVSS 6.9, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-26191](https://cve.now/CVE-2026-26191.md): Fleet vulnerable to OS command injection in software packages (CVSS 6.0, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-43908](https://cve.now/CVE-2026-43908.md): OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder (CVSS 8.8, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-26062](https://cve.now/CVE-2026-26062.md): Fleet server may terminate unexpectedly when handling certain gRPC requests (CVSS 8.7, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-43909](https://cve.now/CVE-2026-43909.md): OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder (CVSS 8.8, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-24899](https://cve.now/CVE-2026-24899.md): Fleet Windows MDM Azure AD JWT Authentication Bypass (CVSS 8.2, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-24000](https://cve.now/CVE-2026-24000.md): Fleet has a rate limiting bypass via untrusted client IP headers (CVSS 6.9, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-43906](https://cve.now/CVE-2026-43906.md): OpenImageIO: HEIF Heap overflow (CVSS 8.5, AcademySoftwareFoundation OpenImageIO)
- [CVE-2026-23998](https://cve.now/CVE-2026-23998.md): Fleet has a Windows MDM management endpoint authentication bypass (CVSS 8.2, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-44633](https://cve.now/CVE-2026-44633.md): Live Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries (CVSS 8.1, livehelperchat)
- [CVE-2026-8621](https://cve.now/CVE-2026-8621.md): Crabbox \< v0.12.0 Authentication Bypass via Header Spoofing (CVSS 8.7, openclaw crabbox · github.com/openclaw/crabbox)
- [CVE-2026-44522](https://cve.now/CVE-2026-44522.md): Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution (CVSS 8.6, enchant97 note-mark · github.com/enchant97/note-mark/backend)
- [CVE-2026-27886](https://cve.now/CVE-2026-27886.md): Strapi may leak sensitive data via relational filtering due to lack of query sanitization (CVSS 9.2, strapi · @strapi/strapi)
- [CVE-2026-44523](https://cve.now/CVE-2026-44523.md): Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery (CVSS 10.0, enchant97 note-mark · github.com/enchant97/note-mark/backend)
- [CVE-2026-22707](https://cve.now/CVE-2026-22707.md): Strapi Upload Plugin MIME Validation Bypass via Content API (CVSS 5.3, strapi · @strapi/upload)
- [CVE-2026-44592](https://cve.now/CVE-2026-44592.md): Gradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning (CVSS 9.4, wavelens gradient)
- [CVE-2026-22706](https://cve.now/CVE-2026-22706.md): Strapi: Password Reset Does Not Revoke Existing Refresh Sessions (CVSS 2.1, strapi · @strapi/admin +1)
- [CVE-2026-22599](https://cve.now/CVE-2026-22599.md): Strapi Vulnerable to SQL Injection in Content Type Builder (CVSS 9.3, strapi · @strapi/content-type-builder +1)
- [CVE-2026-44589](https://cve.now/CVE-2026-44589.md): nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) (CVSS 3.7, nuxt-modules og-image · nuxt-og-image)
- [CVE-2026-27680](https://cve.now/CVE-2026-27680.md): CSS Injection vulnerability in SAP NetWeaver Application Server ABAP (CVSS 3.1, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2025-64526](https://cve.now/CVE-2025-64526.md): Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying (CVSS 6.9, strapi · @strapi/plugin-users-permissions)
- [CVE-2026-41315](https://cve.now/CVE-2026-41315.md): mdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVSS 9.3, midoks mdserver-web)
- [CVE-2026-44670](https://cve.now/CVE-2026-44670.md): SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan (CVSS 9.4, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-44588](https://cve.now/CVE-2026-44588.md): SiYuan: URL-encoded title bypasses \`escapeAriaLabel\`, decoded by \`decodeURIComponent\` into a tooltip-XSS (CVSS 9.4, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-45147](https://cve.now/CVE-2026-45147.md): SiYuan: Broken access control in SiYuan \`/api/tag/getTag\` — Reader role can mutate \`Conf.Tag.Sort\` and persist to disk (CVSS 4.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-45148](https://cve.now/CVE-2026-45148.md): SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata (CVSS 4.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-45371](https://cve.now/CVE-2026-45371.md): SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs (CVSS 7.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-45375](https://cve.now/CVE-2026-45375.md): SiYuan: Bazaar marketplace renders unescaped package \`name\` and \`version\` metadata, allowing stored XSS and Electron code execution (CVSS 9.0, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-44586](https://cve.now/CVE-2026-44586.md): SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution (CVSS 8.3, siyuan-note siyuan)
- [CVE-2026-42598](https://cve.now/CVE-2026-42598.md): Pode: Directory Traversal is possible on Static Routes (CVSS 6.9, Badgerati Pode)
- [CVE-2026-42334](https://cve.now/CVE-2026-42334.md): Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection (CVSS 7.5, Automattic mongoose · mongoose)
- [CVE-2025-15024](https://cve.now/CVE-2025-15024.md): RCE in Yordam Informatics' Library Automation System (CVSS 8.8, Yordam Information Technology Consulting, Training and Elec…)
- [CVE-2026-46470](https://cve.now/CVE-2026-46470.md): An issue was discovered in GStreamer gst-plugins-good before 1.28.2. (CVSS 4.0, GStreamer Good Plug-ins)
- [CVE-2026-46469](https://cve.now/CVE-2026-46469.md): An issue was discovered in GStreamer gst-plugins-good before 1.28.2. (CVSS 4.0, GStreamer Good Plug-ins)
- [CVE-2025-15023](https://cve.now/CVE-2025-15023.md): Improper Access Control in Yordam Informatics' Library Automation System (CVSS 8.8, Yordam Information Technology Consulting, Training and Elec…)
- [CVE-2026-44544](https://cve.now/CVE-2026-44544.md): gittuf: Policy can be rolled back to prior valid version (CVSS 4.9, gittuf · github.com/gittuf/gittuf)
- [CVE-2026-44542](https://cve.now/CVE-2026-44542.md): FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion (CVSS 9.1, gtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…)
- [CVE-2026-44283](https://cve.now/CVE-2026-44283.md): etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks (CVSS 0.0, etcd-io etcd · go.etcd.io/etcd/v3 +2)
- [CVE-2026-41615](https://cve.now/CVE-2026-41615.md): Microsoft Authenticator Information Disclosure Vulnerability (CVSS 9.6, Microsoft Authenticator for Android · Microsoft Authenticat…)
- [CVE-2026-42897](https://cve.now/CVE-2026-42897.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 8.1, KEV, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-42572](https://cve.now/CVE-2026-42572.md): Hatchet: Cross-tenant information disclosure in \`listTasksByDAGIds\` (CVSS 5.3, hatchet-dev hatchet · github.com/hatchet-dev/hatchet)
- [CVE-2026-44520](https://cve.now/CVE-2026-44520.md): Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler (CVSS 5.7, docling-project docling-graph · docling-graph)
- [CVE-2026-6332](https://cve.now/CVE-2026-6332.md): Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC (CVSS 6.8, Schneider Electric Ecostruxure™ Machine Expert HVAC)
- [CVE-2026-41888](https://cve.now/CVE-2026-41888.md): Distribution: Tag deletion bypasses \`storage.delete.enabled\` configuration (CVSS 6.3, distribution · github.com/distribution/distribution +1)
- [CVE-2026-45448](https://cve.now/CVE-2026-45448.md): ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (CVSS 4.3, ntopng)
- [CVE-2026-44516](https://cve.now/CVE-2026-44516.md): Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer (CVSS 7.6, valtimo-platform valtimo · com.ritense.valtimo web +1)
- [CVE-2026-42555](https://cve.now/CVE-2026-42555.md): Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users (CVSS 9.1, valtimo-platform valtimo · com.ritense.valtimo case +5)
- [CVE-2026-44348](https://cve.now/CVE-2026-44348.md): PoDoFo: Double-free vulnerability in compute\_hash\_to\_sign() (CVSS 2.5, podofo)
- [CVE-2026-44515](https://cve.now/CVE-2026-44515.md): Nextcloud News: Authenticated blind SSRF via feed URL (CVSS 2.3, nextcloud news)
- [CVE-2026-44827](https://cve.now/CVE-2026-44827.md): Diffusers: None.py Trust Remote Code Bypass (CVSS 8.8, huggingface diffusers · diffusers)
- [CVE-2026-44513](https://cve.now/CVE-2026-44513.md): Diffusers: \`trust\_remote\_code\` bypass via \`custom\_pipeline\` and local custom components (CVSS 8.8, huggingface diffusers · diffusers)
- [CVE-2026-44514](https://cve.now/CVE-2026-44514.md): Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users (CVSS 6.5, kubetail-org kubetail · github.com/kubetail-org/kubetail… +1)
- [CVE-2025-62305](https://cve.now/CVE-2025-62305.md): HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions (CVSS 5.1, HCL AION)
- [CVE-2026-44511](https://cve.now/CVE-2026-44511.md): Katalyst Koi: Session cookies can be replayed after user logout (CVSS 7.4, katalyst koi · katalyst-koi)
- [CVE-2026-44312](https://cve.now/CVE-2026-44312.md): css\_parser allows to MITM included https css urls (CVSS 5.8, premailer css\_parser · css\_parser)
- [CVE-2026-6923](https://cve.now/CVE-2026-6923.md): Nuvoton - CWE-1300: Improper Protection of Physical Side Channels (CVSS 3.8, Nuvoton NPCT7xx)
- [CVE-2025-62317](https://cve.now/CVE-2025-62317.md): HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. (CVSS 2.6, HCL AION)
- [CVE-2025-62308](https://cve.now/CVE-2025-62308.md): HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed (CVSS 5.1, HCL AION)
- [CVE-2025-62309](https://cve.now/CVE-2025-62309.md): HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. (CVSS 2.6, HCL AION)
- [CVE-2025-62312](https://cve.now/CVE-2025-62312.md): HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication (CVSS 3.0, HCL AION)
- [CVE-2025-62316](https://cve.now/CVE-2025-62316.md): HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured (CVSS 2.3, HCL AION)
- [CVE-2026-20224](https://cve.now/CVE-2026-20224.md): Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability (CVSS 8.6, Cisco Catalyst SD-WAN Manager)
- [CVE-2026-20210](https://cve.now/CVE-2026-20210.md): Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability (CVSS 5.4, Cisco Catalyst SD-WAN Manager)
- [CVE-2026-20209](https://cve.now/CVE-2026-20209.md): Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability (CVSS 5.4, Cisco Catalyst SD-WAN Manager)
- [CVE-2026-20182](https://cve.now/CVE-2026-20182.md): Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability (CVSS 10.0, KEV, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2025-62313](https://cve.now/CVE-2025-62313.md): HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. (CVSS 5.4, HCL AION)
- [CVE-2025-62311](https://cve.now/CVE-2025-62311.md): HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. (CVSS 4.3, HCL AION)
- [CVE-2025-62310](https://cve.now/CVE-2025-62310.md): HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations (CVSS 5.4, HCL AION)
- [CVE-2026-44503](https://cve.now/CVE-2026-44503.md): Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect (CVSS 7.0, microsoft kiota-java · Microsoft.Kiota.Abstractions +6)
- [CVE-2026-44504](https://cve.now/CVE-2026-44504.md): Aegra: Cross-user run injection in /threads/{thread\_id}/runs (IDOR) (CVSS 8.6, aegra · aegra-api)
- [CVE-2026-42281](https://cve.now/CVE-2026-42281.md): MagicMirror²: Unauthenticated SSRF via /cors endpoint (CVSS 9.2, MagicMirrorOrg MagicMirror · magicmirror)
- [CVE-2026-42283](https://cve.now/CVE-2026-42283.md): DevSpace UI Server WebSocket CheckOrigin does not validate source (CVSS 7.7, devspace-sh devspace · github.com/loft-sh/devspace)
- [CVE-2026-44501](https://cve.now/CVE-2026-44501.md): DataHub OIDC REDIRECT\_URL Cookie Deserialization Vulnerability (CVSS 4.3, datahub-project datahub)
- [CVE-2026-42159](https://cve.now/CVE-2026-42159.md): Flowsint: Stored XSS in description of node (CVSS 5.3, reconurge flowsint)
- [CVE-2026-42590](https://cve.now/CVE-2026-42590.md): Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist (CVSS 8.2, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-42597](https://cve.now/CVE-2026-42597.md): Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme (CVSS 5.9, gotenberg · github.com/gotenberg/gotenberg/v7 +1)
- [CVE-2026-42595](https://cve.now/CVE-2026-42595.md): Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass (CVSS 8.6, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-42594](https://cve.now/CVE-2026-42594.md): Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine (CVSS 7.5, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-42593](https://cve.now/CVE-2026-42593.md): Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes (CVSS 5.3, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-42592](https://cve.now/CVE-2026-42592.md): Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes (CVSS 5.3, gotenberg · github.com/gotenberg/gotenberg/v7 +1)
- [CVE-2026-42591](https://cve.now/CVE-2026-42591.md): Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8 (CVSS 8.2, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-42596](https://cve.now/CVE-2026-42596.md): Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook (CVSS 9.4, gotenberg · github.com/gotenberg/gotenberg/v7 +1)
- [CVE-2026-40893](https://cve.now/CVE-2026-40893.md): Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move (CVSS 8.2, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-42589](https://cve.now/CVE-2026-42589.md): Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection (CVSS 9.8, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-42881](https://cve.now/CVE-2026-42881.md): STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML (CVSS 8.4, squinky86 STIGQter)
- [CVE-2026-44371](https://cve.now/CVE-2026-44371.md): Open OnDemand: Specially crafted filenames can execute javascript in the file browser (CVSS 5.3, OSC ondemand)
- [CVE-2026-44484](https://cve.now/CVE-2026-44484.md): Compromise of PyTorch Lightning PyPi Package Versions (CVSS 9.3, Lightning-AI pytorch-lightning · pytorch-lightning +1)
- [CVE-2026-44216](https://cve.now/CVE-2026-44216.md): Wasmtime: Panic when allocating a table exceeding the size of the host's address space (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-44482](https://cve.now/CVE-2026-44482.md): soundcloud-rpc: Remote Code Execution via XSS in Track Title (CVSS 9.6, richardhbtz soundcloud-rpc)
- [CVE-2026-42457](https://cve.now/CVE-2026-42457.md): vCluster Platform: Stored XSS can lead to privilege escalation (CVSS 9.0, loft-sh loft)
- [CVE-2026-44308](https://cve.now/CVE-2026-44308.md): Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications (CVSS 6.3, awspring spring-cloud-aws · io.awspring.cloud spring-clo… +1)
- [CVE-2026-42186](https://cve.now/CVE-2026-42186.md): OpenBao's Namespace Deletion May Not Delete Data Properly (CVSS 2.3, openbao · github.com/openbao/openbao)
- [CVE-2025-62619](https://cve.now/CVE-2025-62619.md): Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retriev (CVSS 6.3, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +23)
- [CVE-2026-44375](https://cve.now/CVE-2026-44375.md): Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException (CVSS 7.5, AArnott Nerdbank.MessagePack · Nerdbank.MessagePack)
- [CVE-2025-62625](https://cve.now/CVE-2025-62625.md): Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentia (CVSS 6.0, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +27)
- [CVE-2026-41937](https://cve.now/CVE-2026-41937.md): Vvveb \< 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload (CVSS 8.6, givanz Vvveb)
- [CVE-2026-44374](https://cve.now/CVE-2026-44374.md): Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks (CVSS 4.3, @backstage plugin-catalog-backend-module-unprocessed · @… +4)
- [CVE-2025-62628](https://cve.now/CVE-2025-62628.md): Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potential (CVSS 7.0, AMD AIM-T Manageability Service · AMD Cloud Manageabilit… +4)
- [CVE-2026-41935](https://cve.now/CVE-2026-41935.md): Vvveb \< 1.0.8.3 Uncontrolled Recursion Denial of Service (CVSS 7.1, givanz Vvveb)
- [CVE-2026-42559](https://cve.now/CVE-2026-42559.md): RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport (CVSS 8.8, modelcontextprotocol rust-sdk · dynoxide-rs +2)
- [CVE-2026-41933](https://cve.now/CVE-2026-41933.md): Vvveb \< 1.0.8.3 Directory Listing Information Disclosure (CVSS 6.9, givanz Vvveb)
- [CVE-2026-41932](https://cve.now/CVE-2026-41932.md): Vvveb \< 1.0.8.3 Stored XSS via Signup Controller (CVSS 5.3, givanz Vvveb)
- [CVE-2026-21730](https://cve.now/CVE-2026-21730.md): Stored XSS in Verba (CVSS 5.3, Verint Verba)
- [CVE-2026-1630](https://cve.now/CVE-2026-1630.md): Reflected XSS in WEBCON BPS (CVSS 5.1, WEBCON BPS)
- [CVE-2026-6638](https://cve.now/CVE-2026-6638.md): PostgreSQL REFRESH PUBLICATION allows SQL injection via table name (CVSS 3.7, PostgreSQL)
- [CVE-2026-6637](https://cve.now/CVE-2026-6637.md): PostgreSQL refint allows stack buffer overflow and SQL injection (CVSS 8.8, PostgreSQL)
- [CVE-2026-6575](https://cve.now/CVE-2026-6575.md): PostgreSQL pg\_restore\_attribute\_stats accepts values that cause query planning to read past end of stats array (CVSS 4.3, PostgreSQL)
- [CVE-2026-6479](https://cve.now/CVE-2026-6479.md): PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion (CVSS 7.5, PostgreSQL)
- [CVE-2026-6478](https://cve.now/CVE-2026-6478.md): PostgreSQL discloses MD5-hashed passwords via covert timing channel (CVSS 6.5, PostgreSQL)
- [CVE-2026-6477](https://cve.now/CVE-2026-6477.md): PostgreSQL libpq lo\_\* functions let server superuser overwrite client stack memory (CVSS 8.8, PostgreSQL)
- [CVE-2026-6476](https://cve.now/CVE-2026-6476.md): PostgreSQL pg\_createsubscriber allows SQL injection via subscription name (CVSS 7.2, PostgreSQL)
- [CVE-2026-6475](https://cve.now/CVE-2026-6475.md): PostgreSQL pg\_basebackup and pg\_rewind can overwrite unrelated files of origin superuser choice (CVSS 8.8, PostgreSQL)
- [CVE-2026-6474](https://cve.now/CVE-2026-6474.md): PostgreSQL timeofday() can disclose portions of server memory (CVSS 4.3, PostgreSQL)
- [CVE-2026-6473](https://cve.now/CVE-2026-6473.md): PostgreSQL server undersizes allocations, via integer wraparound (CVSS 8.8, PostgreSQL)
- [CVE-2026-6472](https://cve.now/CVE-2026-6472.md): PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege (CVSS 5.4, PostgreSQL)
- [CVE-2025-15025](https://cve.now/CVE-2025-15025.md): IDOR in Yordam Informatics' Library Automation System (CVSS 8.8, Yordam Information Technology Consulting, Training and Elec…)
- [CVE-2026-43644](https://cve.now/CVE-2026-43644.md): podinfo 6.11.2 Reflected XSS via /echo Endpoint (CVSS 5.1, stefanprodan podinfo · github.com/stefanprodan/podinfo)
- [CVE-2026-4029](https://cve.now/CVE-2026-4029.md): Database Backup for WordPress \<= 2.5.2 - Missing Authorization to Unauthenticated Database Export (CVSS 7.5, wpengine Database Backup for WordPress)
- [CVE-2026-4030](https://cve.now/CVE-2026-4030.md): Database Backup for WordPress \<= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion (CVSS 8.1, wpengine Database Backup for WordPress)
- [CVE-2026-4031](https://cve.now/CVE-2026-4031.md): Database Backup for WordPress \<= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception (CVSS 7.5, wpengine Database Backup for WordPress)
- [CVE-2025-12008](https://cve.now/CVE-2025-12008.md): IDOR in APPYAP's Yaay Social Media App (CVSS 8.8, APPYAP Technology and Information Yaay Social Media App)
- [CVE-2026-5790](https://cve.now/CVE-2026-5790.md): Stored Cross-Site Scripting (XSS) vulnerability in Stel Order (CVSS 5.1, Stel Order)
- [CVE-2026-5798](https://cve.now/CVE-2026-5798.md): Unsafe Object Reference (IDOR) vulnerability in Stel Order (CVSS 7.1, Stel Order)
- [CVE-2026-6008](https://cve.now/CVE-2026-6008.md): IDOR in Im Park's DijiDemi (CVSS 6.8, Im Park Information Technology, Electronics, Press, Publish…)
- [CVE-2026-45205](https://cve.now/CVE-2026-45205.md): Apache Commons Configuration: StackOverflowError for YAML input with cycles (CVSS 5.3, Apache Software Foundation Apache Commons Configuration · o…)
- [CVE-2025-68420](https://cve.now/CVE-2025-68420.md): Privilege Escalation in Comarch ERP Optima (CVSS 7.5, Comarch ERP Optima)
- [CVE-2025-68421](https://cve.now/CVE-2025-68421.md): Hardcoded credentials in Comarch ERP Optima (CVSS 8.7, Comarch ERP Optima)
- [CVE-2026-8468](https://cve.now/CVE-2026-8468.md): Unbounded buffer accumulation in multipart header parsing causes denial of service in plug (CVSS 8.2, elixir-plug plug)
- [CVE-2026-8295](https://cve.now/CVE-2026-8295.md): Integer overflow in simdjson (CVSS 6.9, simdjson)
- [CVE-2026-2347](https://cve.now/CVE-2026-2347.md): IDOR in Akıllı Ticaret's E-Commerce Pack (CVSS 9.8, Akilli Commerce Software Technologies Ltd. E-Commerce Websi…)
- [CVE-2025-11024](https://cve.now/CVE-2025-11024.md): SQLi in Akıllı Ticaret's E-Commerce Pack (CVSS 9.8, Akilli Commerce Software Technologies Ltd. E-Commerce Websi…)
- [CVE-2026-6512](https://cve.now/CVE-2026-6512.md): InfusedWoo Pro \<= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters (CVSS 9.1, Infused Addons InfusedWoo Pro)
- [CVE-2026-6504](https://cve.now/CVE-2026-6504.md): Royal Addons for Elementor \<= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title\_tag' Parameter (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-6145](https://cve.now/CVE-2026-6145.md): User Registration & Membership \<= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter (CVSS 5.3, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-6174](https://cve.now/CVE-2026-6174.md): CC Child Pages \<= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter (CVSS 6.4, caterhamcomputing CC Child Pages)
- [CVE-2026-6206](https://cve.now/CVE-2026-6206.md): MW WP Form \<= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post\_id' Query Parameter (CVSS 5.3, websoudan MW WP Form)
- [CVE-2026-6514](https://cve.now/CVE-2026-6514.md): InfusedWoo Pro \<= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter (CVSS 7.5, Infused Addons InfusedWoo Pro)
- [CVE-2026-6670](https://cve.now/CVE-2026-6670.md): Media Sync \<= 1.4.9 - Authenticated (Author+) Path Traversal via 'sub\_dir' and 'media\_items' Parameters (CVSS 6.5, erolsk8 Media Sync)
- [CVE-2026-6252](https://cve.now/CVE-2026-6252.md): Meta Field Block \<= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute (CVSS 6.4, mr2p Meta Field Block – Display custom fields in the Block…)
- [CVE-2026-3718](https://cve.now/CVE-2026-3718.md): ManageWP Worker \<= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header (CVSS 7.2, ManageWP Worker)
- [CVE-2026-3694](https://cve.now/CVE-2026-3694.md): Bold Page Builder \<= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_button Shortcode (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2026-5395](https://cve.now/CVE-2026-5395.md): Fluent Forms \<= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter (CVSS 8.2, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2026-5365](https://cve.now/CVE-2026-5365.md): LatePoint \<= 5.3.2 - Cross-Site Request Forgery via 'customer\_cabinet\_\_request\_cancellation' AJAX Route (CVSS 4.3, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-6506](https://cve.now/CVE-2026-6506.md): InfusedWoo Pro \<= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update (CVSS 8.8, Infused Addons InfusedWoo Pro)
- [CVE-2026-6225](https://cve.now/CVE-2026-6225.md): Taskbuilder – Project Management & Task Management Tool With Kanban Board \<= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project\_search' Parameter (CVSS 6.5, Taskbuilder – Project Management & Task Management Tool Wit…)
- [CVE-2026-3892](https://cve.now/CVE-2026-3892.md): Motors – Car Dealer, Classifieds & Listing \<= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm\_dealer\_logo\_path' Parameter (CVSS 8.1, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2026-5193](https://cve.now/CVE-2026-5193.md): Essential Addons for Elementor – Popular Elementor Templates & Widgets \<= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register\_user (CVSS 6.5, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2026-6510](https://cve.now/CVE-2026-6510.md): InfusedWoo Pro \<= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar\_save\_recipe' (CVSS 9.8, Infused Addons InfusedWoo Pro)
- [CVE-2026-6271](https://cve.now/CVE-2026-6271.md): Career Section \<= 1.7 - Unauthenticated Arbitrary File Upload (CVSS 9.8, shahinurislam Career Section)
- [CVE-2025-12669](https://cve.now/CVE-2025-12669.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 5.4, GitLab)
- [CVE-2025-13874](https://cve.now/CVE-2025-13874.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-14869](https://cve.now/CVE-2025-14869.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-14870](https://cve.now/CVE-2025-14870.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-1184](https://cve.now/CVE-2026-1184.md): Deserialization of Untrusted Data in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-1322](https://cve.now/CVE-2026-1322.md): Business Logic Errors in GitLab (CVSS 6.8, GitLab)
- [CVE-2026-1338](https://cve.now/CVE-2026-1338.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-1659](https://cve.now/CVE-2026-1659.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-2900](https://cve.now/CVE-2026-2900.md): Missing Authorization in GitLab (CVSS 2.7, GitLab)
- [CVE-2026-3073](https://cve.now/CVE-2026-3073.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-3074](https://cve.now/CVE-2026-3074.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-3160](https://cve.now/CVE-2026-3160.md): Unintended Proxy or Intermediary ('Confused Deputy') in GitLab (CVSS 5.8, GitLab)
- [CVE-2026-3607](https://cve.now/CVE-2026-3607.md): Access Control Check Implemented After Asset is Accessed in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-4524](https://cve.now/CVE-2026-4524.md): Authentication Bypass Using an Alternate Path or Channel in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-4527](https://cve.now/CVE-2026-4527.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-6063](https://cve.now/CVE-2026-6063.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-6073](https://cve.now/CVE-2026-6073.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2026-6335](https://cve.now/CVE-2026-6335.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 5.4, GitLab)
- [CVE-2026-6883](https://cve.now/CVE-2026-6883.md): Missing Authorization in GitLab (CVSS 2.6, GitLab)
- [CVE-2026-7377](https://cve.now/CVE-2026-7377.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2026-7471](https://cve.now/CVE-2026-7471.md): Server-Side Request Forgery (SSRF) in GitLab (CVSS 3.5, GitLab)
- [CVE-2026-7481](https://cve.now/CVE-2026-7481.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2026-8280](https://cve.now/CVE-2026-8280.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-8144](https://cve.now/CVE-2026-8144.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-15345](https://cve.now/CVE-2025-15345.md): MapGeo - Interactive Geo Maps \<= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter (CVSS 6.1, interactivegeomaps MapGeo – Interactive Geo Maps)
- [CVE-2026-3829](https://cve.now/CVE-2026-3829.md): WP Encryption - One Click SSL & Force HTTPS \<= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering (CVSS 5.4, gowebsmarty WP Encryption – One Click Free SSL Certificate…)
- [CVE-2026-8181](https://cve.now/CVE-2026-8181.md): Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover (CVSS 9.8, burstbv Burst Statistics – Privacy-Friendly WordPress Analy…)
- [CVE-2026-5396](https://cve.now/CVE-2026-5396.md): Fluent Forms \<= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form\_id' Parameter (CVSS 8.2, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2026-6417](https://cve.now/CVE-2026-6417.md): GLS Shipping for WooCommerce \<= 1.4.0 - Reflected Cross-Site Scripting via 'failed\_orders' (CVSS 6.1, bojansliskovicglscroatiacom GLS Shipping for WooCommerce)
- [CVE-2026-5243](https://cve.now/CVE-2026-5243.md): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2026-5361](https://cve.now/CVE-2026-5361.md): Envira Gallery \<= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter (CVSS 6.4, smub Envira Gallery – Image Photo Gallery, Albums, Video Ga…)
- [CVE-2026-7648](https://cve.now/CVE-2026-7648.md): LearnPress – WordPress LMS Plugin for Create and Sell Online Courses \<= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter (CVSS 4.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-7525](https://cve.now/CVE-2026-7525.md): My Calendar \<= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event\_approved' Parameter (CVSS 4.3, joedolson My Calendar – Accessible Event Manager)
- [CVE-2026-46446](https://cve.now/CVE-2026-46446.md): SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. (CVSS 7.1, Alinto SOGo)
- [CVE-2026-46445](https://cve.now/CVE-2026-46445.md): SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. (CVSS 7.1, Alinto SOGo)
- [CVE-2026-5486](https://cve.now/CVE-2026-5486.md): Unlimited Elements For Elementor \<= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter\_search' Parameter (CVSS 6.5, unitecms Unlimited Elements For Elementor)
- [CVE-2025-69443](https://cve.now/CVE-2025-69443.md): Remote Code Execution in coleam00 Archon 0.1.0. (CVSS 6.3)
- [CVE-2026-24710](https://cve.now/CVE-2026-24710.md): Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS. (CVSS 6.1)
- [CVE-2026-24711](https://cve.now/CVE-2026-24711.md): Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control. (CVSS 5.3)
- [CVE-2026-24712](https://cve.now/CVE-2026-24712.md): Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection. (CVSS 7.3)
- [CVE-2026-38740](https://cve.now/CVE-2026-38740.md): Foscam VD1 Video Doorbell before V5.3.13\_1072 is vulnerable to Cleartext Transmission of Sensitive Information. (CVSS 5.3)
- [CVE-2026-44919](https://cve.now/CVE-2026-44919.md): In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:/// (CVSS 4.3, OpenStack Ironic · ironic)
- [CVE-2026-46419](https://cve.now/CVE-2026-46419.md): Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor (CVSS 7.5, Yubico webauthn-server-core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.