# CVEs published 2026-05-15

211 CVEs were published on May 15, 2026: 16 critical, 84 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-8704](https://cve.now/CVE-2026-8704.md): Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified (CVSS 6.5, TIMLEGGE Crypt::DSA)
- [CVE-2026-8700](https://cve.now/CVE-2026-8700.md): Crypt::DSA versions before 1.20 for Perl generate seeds using rand (CVSS 7.3, TIMLEGGE Crypt::DSA)
- [CVE-2026-45338](https://cve.now/CVE-2026-45338.md): Open WebUI: SSRF via OAuth Profile Picture URL in \_process\_picture\_url (oauth.py) (CVSS 7.7, open-webui)
- [CVE-2026-44549](https://cve.now/CVE-2026-44549.md): Open WebUI: Stored XSS in excel file preview (CVSS 7.3, open-webui)
- [CVE-2026-45299](https://cve.now/CVE-2026-45299.md): Open WebUI: Stored Cross-Site Scripting In Profile Picture (CVSS 5.4, open-webui)
- [CVE-2026-45665](https://cve.now/CVE-2026-45665.md): Open WebUI: Stored XSS in Banner Component via Improper Sanitization Order (CVSS 8.1, open-webui)
- [CVE-2026-45667](https://cve.now/CVE-2026-45667.md): Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS) (CVSS 6.5, open-webui)
- [CVE-2026-44565](https://cve.now/CVE-2026-44565.md): Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal (CVSS 8.1, open-webui)
- [CVE-2026-45314](https://cve.now/CVE-2026-45314.md): Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook\_id}/profile/image (CVSS 7.4, open-webui)
- [CVE-2026-45316](https://cve.now/CVE-2026-45316.md): Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access) (CVSS 3.5, open-webui)
- [CVE-2026-45317](https://cve.now/CVE-2026-45317.md): Open WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation (CVSS 4.6, open-webui)
- [CVE-2026-45318](https://cve.now/CVE-2026-45318.md): Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify) (CVSS 5.4, open-webui)
- [CVE-2026-45315](https://cve.now/CVE-2026-45315.md): Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions (CVSS 8.7, open-webui)
- [CVE-2026-44571](https://cve.now/CVE-2026-44571.md): Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission (CVSS 6.5, open-webui)
- [CVE-2026-45350](https://cve.now/CVE-2026-45350.md): Open WebUI: Chat completion API allows tool restrictions to be bypassed (CVSS 7.1, open-webui)
- [CVE-2026-45303](https://cve.now/CVE-2026-45303.md): Open WebUI: Stored XSS via the HTML renedering view (CVSS 7.7, open-webui)
- [CVE-2026-45301](https://cve.now/CVE-2026-45301.md): Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file (CVSS 8.1, open-webui)
- [CVE-2026-45345](https://cve.now/CVE-2026-45345.md): Open WebUI: Missing authorization check at the model update function - models from other users can be updated (CVSS 6.5, open-webui)
- [CVE-2026-45346](https://cve.now/CVE-2026-45346.md): Open WebUI: Stored Cross-Site Scripting in SVG Renderer (CVSS 5.1, open-webui)
- [CVE-2026-45347](https://cve.now/CVE-2026-45347.md): Open WebUI: Blind server side request forgery (SSRF) via the PDF generate function (CVSS 4.3, open-webui)
- [CVE-2026-45351](https://cve.now/CVE-2026-45351.md): Open WebUI: Exposure of System Prompt to Regular User \[Non-Admin\] (CVSS 6.5, open-webui)
- [CVE-2026-45666](https://cve.now/CVE-2026-45666.md): Open WebUI: Indirect Object Reference (IDOR) in user notes (CVSS 6.5, open-webui)
- [CVE-2026-45365](https://cve.now/CVE-2026-45365.md): Open WebUI: Authenticated users can bypass model access control via exposed query parameter (CVSS 5.4, open-webui)
- [CVE-2026-44570](https://cve.now/CVE-2026-44570.md): Open WebUI: Inconsistent authorization controls within memories API (CVSS 8.3, open-webui)
- [CVE-2026-44569](https://cve.now/CVE-2026-44569.md): Open WebUI: Insecure Message Access Breaks Authorization (CVSS 7.1, open-webui)
- [CVE-2026-44566](https://cve.now/CVE-2026-44566.md): Open WebUI: Arbitrary File Upload and Path Traversal (CVSS 7.3, open-webui)
- [CVE-2026-44567](https://cve.now/CVE-2026-44567.md): Open WebUI: Open WebUI Improper Authorization Control (CVSS 7.3, open-webui)
- [CVE-2026-45672](https://cve.now/CVE-2026-45672.md): Open WebUI: Jupyter code execution works despite \`ENABLE\_CODE\_EXECUTION=false\` — feature gate bypassed (CVSS 8.8, open-webui)
- [CVE-2026-8696](https://cve.now/CVE-2026-8696.md): radare2 6.1.5 Use-After-Free via gdbr\_pids\_list() (CVSS 8.7, radare2)
- [CVE-2026-45400](https://cve.now/CVE-2026-45400.md): Open WebUI: Server-Side Request Forgery (SSRF) bypass in \`validate\_url\` (CVSS 8.5, open-webui)
- [CVE-2026-45402](https://cve.now/CVE-2026-45402.md): Open WebUI: Cross-User File Access via Unchecked file\_id in Folder Knowledge and Knowledge-Base Attach Endpoints (CVSS 8.1, open-webui)
- [CVE-2026-45401](https://cve.now/CVE-2026-45401.md): Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (CVSS 8.5, open-webui)
- [CVE-2026-45386](https://cve.now/CVE-2026-45386.md): Open WebUI: An IDOR vulnerability exists in the pin\_channel\_message API endpoint (CVSS 4.3, open-webui)
- [CVE-2026-45398](https://cve.now/CVE-2026-45398.md): Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls (CVSS 7.5, open-webui)
- [CVE-2026-45397](https://cve.now/CVE-2026-45397.md): Open WebUI: Unauthenticated RAG Configuration Disclosure (CVSS 5.3, open-webui)
- [CVE-2026-45396](https://cve.now/CVE-2026-45396.md): Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation (CVSS 5.4, open-webui)
- [CVE-2026-45395](https://cve.now/CVE-2026-45395.md): Open WebUI: Missing \`workspace.tools\` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution (CVSS 7.2, open-webui)
- [CVE-2026-45387](https://cve.now/CVE-2026-45387.md): Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage) (CVSS 4.3, open-webui)
- [CVE-2026-45385](https://cve.now/CVE-2026-45385.md): Open WebUI: An IDOR vulnerability exists in the update\_message\_by\_id API endpoint (CVSS 4.3, open-webui)
- [CVE-2026-44721](https://cve.now/CVE-2026-44721.md): Open WebUI: Stored XSS via Model Description (CVSS 7.3, open-webui)
- [CVE-2026-44550](https://cve.now/CVE-2026-44550.md): Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts (CVSS 5.0, open-webui)
- [CVE-2026-44551](https://cve.now/CVE-2026-44551.md): Open WebUI: LDAP Empty Password Authentication Bypass (CVSS 9.1, open-webui)
- [CVE-2026-44552](https://cve.now/CVE-2026-44552.md): Open WebUI: Redis Cache Keys tool\_servers and terminal\_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning (CVSS 8.7, open-webui)
- [CVE-2026-44553](https://cve.now/CVE-2026-44553.md): Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access (CVSS 8.1, open-webui)
- [CVE-2026-44554](https://cve.now/CVE-2026-44554.md): Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite (CVSS 8.1, open-webui)
- [CVE-2026-44555](https://cve.now/CVE-2026-44555.md): Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining (CVSS 7.6, open-webui)
- [CVE-2026-44556](https://cve.now/CVE-2026-44556.md): Open WebUI: responses passthrough endpoint lacks access control authorization (CVSS 7.1, open-webui)
- [CVE-2026-44557](https://cve.now/CVE-2026-44557.md): Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection (CVSS 4.3, open-webui)
- [CVE-2026-44558](https://cve.now/CVE-2026-44558.md): Open WebUI: Channel Access Grants Bypass filter\_allowed\_access\_grants (CVSS 5.4, open-webui)
- [CVE-2026-44559](https://cve.now/CVE-2026-44559.md): Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels (CVSS 4.3, open-webui)
- [CVE-2026-44560](https://cve.now/CVE-2026-44560.md): Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search (CVSS 6.5, open-webui)
- [CVE-2026-44561](https://cve.now/CVE-2026-44561.md): Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels (CVSS 5.4, open-webui)
- [CVE-2026-44562](https://cve.now/CVE-2026-44562.md): Open WebUI: Model Import Overwrites Any Model Without Ownership Check (CVSS 6.5, open-webui)
- [CVE-2026-44563](https://cve.now/CVE-2026-44563.md): Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show (CVSS 5.4, open-webui)
- [CVE-2026-44564](https://cve.now/CVE-2026-44564.md): Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO (CVSS 5.4, open-webui)
- [CVE-2026-44568](https://cve.now/CVE-2026-44568.md): Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order (CVSS 4.8, open-webui)
- [CVE-2026-45331](https://cve.now/CVE-2026-45331.md): Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature (CVSS 8.5, open-webui)
- [CVE-2026-45339](https://cve.now/CVE-2026-45339.md): Open WebUI: API key endpoint restrictions bypassed via \`x-api-key\` header — full message processing on restricted endpoints (CVSS 6.5, open-webui · open-webu)
- [CVE-2026-45349](https://cve.now/CVE-2026-45349.md): Open WebUI: Broken Access Control for Completions API (CVSS 7.1, open-webui)
- [CVE-2026-45399](https://cve.now/CVE-2026-45399.md): Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption (CVSS 7.1, open-webui)
- [CVE-2026-45671](https://cve.now/CVE-2026-45671.md): Open WebUI: shared-chat branch ignores access\_type, allowing unauthorized file deletion (CVSS 8.0, open-webui)
- [CVE-2026-45675](https://cve.now/CVE-2026-45675.md): Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts (CVSS 8.1, open-webui)
- [CVE-2026-46408](https://cve.now/CVE-2026-46408.md): Vvveb: checkout IDOR allows unauthorized reuse of another user's cart (CVSS 7.6, givanz Vvveb)
- [CVE-2026-46407](https://cve.now/CVE-2026-46407.md): Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens (CVSS 8.1, givanz Vvveb)
- [CVE-2026-45800](https://cve.now/CVE-2026-45800.md): Vvveb: Authenticated SQL injection in /user/orders via order\_by and direction (CVSS 8.7, givanz Vvveb)
- [CVE-2026-4053](https://cve.now/CVE-2026-4053.md): post edit time limit is not enforced on some post update operations (CVSS 3.1, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-45622](https://cve.now/CVE-2026-45622.md): Vvveb: Unauthenticated reflected XSS in public product return form via customer\_order\_id (CVSS 5.3, givanz Vvveb)
- [CVE-2026-45616](https://cve.now/CVE-2026-45616.md): Vvveb: Stored XSS in Posts allows privilege escalation via post editor (CVSS 5.1, givanz Vvveb)
- [CVE-2026-8686](https://cve.now/CVE-2026-8686.md): DoS from MQTT v5.0 Deserialization Fault in core MQTT (CVSS 7.5, FreeRTOS coreMQTT)
- [CVE-2026-44826](https://cve.now/CVE-2026-44826.md): Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals (CVSS 7.5, givanz Vvveb)
- [CVE-2026-46367](https://cve.now/CVE-2026-46367.md): phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering (CVSS 7.6, thorsten phpmyfaq · thorsten/phpmyfaq +1)
- [CVE-2026-46366](https://cve.now/CVE-2026-46366.md): phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass (CVSS 7.5, thorsten phpmyfaq · thorsten/phpmyfaq +1)
- [CVE-2026-46365](https://cve.now/CVE-2026-46365.md): phpMyFAQ - Missing Authorization in Tag Deletion Endpoint (CVSS 5.4, thorsten phpmyfaq · phpmyfaq/phpmyfaq +1)
- [CVE-2026-46364](https://cve.now/CVE-2026-46364.md): phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha (CVSS 9.8, thorsten phpmyfaq · thorsten/phpmyfaq +1)
- [CVE-2026-46363](https://cve.now/CVE-2026-46363.md): phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass (CVSS 5.4, thorsten phpmyfaq · phpmyfaq/phpmyfaq +1)
- [CVE-2026-46362](https://cve.now/CVE-2026-46362.md): phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check (CVSS 6.5, thorsten phpmyfaq · phpmyfaq/phpmyfaq +1)
- [CVE-2026-46361](https://cve.now/CVE-2026-46361.md): phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig (CVSS 6.9, thorsten phpmyfaq · phpmyfaq/phpmyfaq +1)
- [CVE-2026-46360](https://cve.now/CVE-2026-46360.md): phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer (CVSS 5.4, thorsten phpmyfaq · phpmyfaq/phpmyfaq +1)
- [CVE-2026-46359](https://cve.now/CVE-2026-46359.md): phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields (CVSS 7.5, thorsten phpmyfaq · thorsten/phpmyfaq +1)
- [CVE-2026-45010](https://cve.now/CVE-2026-45010.md): phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint (CVSS 9.1, thorsten phpmyfaq · thorsten/phpmyfaq +1)
- [CVE-2026-45009](https://cve.now/CVE-2026-45009.md): phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints (CVSS 4.3, thorsten phpmyfaq · thorsten/phpmyfaq +1)
- [CVE-2026-45008](https://cve.now/CVE-2026-45008.md): phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter (CVSS 6.5, thorsten phpmyfaq · thorsten/phpmyfaq +1)
- [CVE-2026-45007](https://cve.now/CVE-2026-45007.md): phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure (CVSS 4.3, thorsten phpmyfaq · thorsten/phpmyfaq +1)
- [CVE-2021-47968](https://cve.now/CVE-2021-47968.md): Podcast Generator 3.1 Persistent Cross-Site Scripting via long\_description (CVSS 5.1, Podcastgenerator Podcast Generator)
- [CVE-2021-47967](https://cve.now/CVE-2021-47967.md): PHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters (CVSS 5.1, PHP Timeclock)
- [CVE-2021-47966](https://cve.now/CVE-2021-47966.md): PHP Timeclock 1.04 SQL Injection via login.php (CVSS 8.8, PHP Timeclock)
- [CVE-2021-47965](https://cve.now/CVE-2021-47965.md): WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload (CVSS 9.3, wp-super-edit WP Super Edit)
- [CVE-2021-47964](https://cve.now/CVE-2021-47964.md): Schlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager (CVSS 8.7, Schlix CMS)
- [CVE-2021-47963](https://cve.now/CVE-2021-47963.md): Anote 1.0 Persistent Cross-Site Scripting Leading to Code Execution (CVSS 5.1, AnotherNote Anote)
- [CVE-2021-47962](https://cve.now/CVE-2021-47962.md): Savsoft Quiz 5.0 Persistent Cross-Site Scripting via User Settings (CVSS 5.1, savsofts Savsoft Quiz)
- [CVE-2021-47959](https://cve.now/CVE-2021-47959.md): WordPress Plugin WPGraphQL 1.3.5 Denial of Service (CVSS 8.7, WPGraphQL)
- [CVE-2021-47958](https://cve.now/CVE-2021-47958.md): CouchCMS 2.2.1 Server-Side Request Forgery via SVG upload (CVSS 5.3, CouchCMS)
- [CVE-2026-44366](https://cve.now/CVE-2026-44366.md): Vvveb: Stored XSS via Comment Author Field (CVSS 6.1, givanz Vvveb)
- [CVE-2026-4054](https://cve.now/CVE-2026-4054.md): SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-44719](https://cve.now/CVE-2026-44719.md): Mathesar: Missing collaborator checks allowed access to database-scoped Mathesar metadata (CVSS 5.3, mathesar-foundation mathesar)
- [CVE-2026-44718](https://cve.now/CVE-2026-44718.md): Mathesar: Missing collaborator checks allowed access to saved explorations in other databases (CVSS 5.3, mathesar-foundation mathesar)
- [CVE-2026-46474](https://cve.now/CVE-2026-46474.md): Trog::TOTP versions before 1.006 for Perl generate secrets using rand (CVSS 7.5, TEODESIAN Trog::TOTP)
- [CVE-2026-42207](https://cve.now/CVE-2026-42207.md): Magento LTS: Open Redirect via Unvalidated \`uenc\` Parameter in \`stockAction()\` - magento-lts (CVSS 6.1, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2026-42155](https://cve.now/CVE-2026-42155.md): Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs (CVSS 9.3, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2026-42458](https://cve.now/CVE-2026-42458.md): Magento LTS: Reflected XSS - Import -\> Data Flow (profiles) (CVSS 5.3, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2026-8695](https://cve.now/CVE-2026-8695.md): radare2 6.1.5 Use-After-Free via gdbr\_threads\_list() (CVSS 8.7, radare2)
- [CVE-2026-44717](https://cve.now/CVE-2026-44717.md): MCP Calculate Server: Prompt Injection to RCE (CVSS 9.8, 611711Dark mcp\_calculate\_server)
- [CVE-2026-44714](https://cve.now/CVE-2026-44714.md): bitcoinj: ScriptExecution P2PKH/P2WPKH Verification Bypass (CVSS 7.5, bitcoinj · org.bitcoinj:bitcoinj-core)
- [CVE-2026-45038](https://cve.now/CVE-2026-45038.md): Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution (CVSS 8.4, Eugeny tabby)
- [CVE-2026-45036](https://cve.now/CVE-2026-45036.md): Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh (CVSS 7.0, Eugeny tabby)
- [CVE-2026-45035](https://cve.now/CVE-2026-45035.md): Tabby: RCE via \`tabby://run\` URL Scheme (CVSS 9.4, Eugeny tabby)
- [CVE-2026-45037](https://cve.now/CVE-2026-45037.md): Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation (CVSS 7.1, Eugeny tabby)
- [CVE-2026-23695](https://cve.now/CVE-2026-23695.md): Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template (CVSS 5.1, Cockpit-HQ Cockpit · cockpit-hq/cockpit)
- [CVE-2026-44774](https://cve.now/CVE-2026-44774.md): Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false (CVSS 6.4, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-41181](https://cve.now/CVE-2026-41181.md): Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service (CVSS 6.9, traefik · github.com/traefik/traefik/v2 +2)
- [CVE-2026-44309](https://cve.now/CVE-2026-44309.md): gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits (CVSS 5.3, sigstore gitsign · github.com/sigstore/gitsign)
- [CVE-2026-44310](https://cve.now/CVE-2026-44310.md): gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers (CVSS 5.4, sigstore gitsign · github.com/sigstore/gitsign)
- [CVE-2026-41258](https://cve.now/CVE-2026-41258.md): OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange (CVSS 9.1, openmrs-core · org.openmrs.api:openmrs-api)
- [CVE-2026-44699](https://cve.now/CVE-2026-44699.md): LibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC (CVSS 9.1, benmcollins libjwt)
- [CVE-2026-46383](https://cve.now/CVE-2026-46383.md): Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in \`apm install\` (CVSS 5.5, microsoft apm · apm-cli)
- [CVE-2026-45539](https://cve.now/CVE-2026-45539.md): Microsoft APM: Symlinks under \`.apm/prompts/\` and \`.apm/agents/\` are dereferenced during \`apm install\`, copying host-local file contents into the project tree (CVSS 7.4, microsoft apm · apm)
- [CVE-2026-44641](https://cve.now/CVE-2026-44641.md): Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install (CVSS 7.1, microsoft apm · apm-cli)
- [CVE-2026-45773](https://cve.now/CVE-2026-45773.md): Turborepo: Login callback CSRF/session fixation (CVSS 5.1, vercel turborepo · turbo)
- [CVE-2026-46508](https://cve.now/CVE-2026-46508.md): Turborepo: VSCode Extension command injection (CVSS 8.4, vercel turborepo)
- [CVE-2026-45772](https://cve.now/CVE-2026-45772.md): Turborepo: Unexpected local code execution during Yarn Berry detection (CVSS 0.0, vercel turborepo · @turbo codemod +4)
- [CVE-2026-2031](https://cve.now/CVE-2026-2031.md): Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution. (CVSS 10.0, Google Cloud Internal Integration Platform APIs)
- [CVE-2026-35194](https://cve.now/CVE-2026-35194.md): Apache Flink: Remote code execution via SQL injection in code generation (CVSS 8.1, Apache Software Foundation Apache Flink · org.apache.fli… +2)
- [CVE-2026-45803](https://cve.now/CVE-2026-45803.md): gh: GitHub Actions log output in \`gh run view\` allows terminal escape sequence injection (CVSS 3.5, cli · github.com/cli/cli/v2 +1)
- [CVE-2026-46483](https://cve.now/CVE-2026-46483.md): Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag (CVSS 3.6, vim)
- [CVE-2026-45736](https://cve.now/CVE-2026-45736.md): ws: Uninitialized memory disclosure (CVSS 4.4, websockets ws · ws)
- [CVE-2025-14972](https://cve.now/CVE-2025-14972.md): Insufficient DPA countermeasure reseeding (CVSS 4.1, silabs.com Simplicity SDK)
- [CVE-2026-8669](https://cve.now/CVE-2026-8669.md): Imager versions through 1.030 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files (CVSS 6.5, TONYC Imager)
- [CVE-2026-46333](https://cve.now/CVE-2026-46333.md): ptrace: slightly saner 'get\_dumpable()' logic (CVSS 7.1, Linux)
- [CVE-2026-41553](https://cve.now/CVE-2026-41553.md): Remote Code Execution in PDF Export Module (CVSS 10.0, DHTMLX PDF Export Module)
- [CVE-2026-41552](https://cve.now/CVE-2026-41552.md): Path Traversal in PDF Export Module (CVSS 9.2, DHTMLX PDF Export Module)
- [CVE-2026-7182](https://cve.now/CVE-2026-7182.md): Path Traversal in Diagram (CVSS 9.2, DHTMLX Diagram)
- [CVE-2026-8503](https://cve.now/CVE-2026-8503.md): Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids (CVSS 6.5, GUIMARD Apache::Session::Generate::SHA256)
- [CVE-2026-8454](https://cve.now/CVE-2026-8454.md): Imager::File::GIF versions through 1.002 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files (CVSS 5.3, TONYC Imager::File::GIF)
- [CVE-2026-41970](https://cve.now/CVE-2026-41970.md): Out-of-bounds write vulnerability in the distributed file system module. (CVSS 6.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2026-41969](https://cve.now/CVE-2026-41969.md): Permission control vulnerability in the projection module. (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2026-41968](https://cve.now/CVE-2026-41968.md): Permission control vulnerability in the manufacturability design module. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2026-41967](https://cve.now/CVE-2026-41967.md): Permission control vulnerability in the manufacturability design module. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2026-41966](https://cve.now/CVE-2026-41966.md): Permission control vulnerability in the smart sensing service. (CVSS 5.6, Huawei HarmonyOS)
- [CVE-2026-41962](https://cve.now/CVE-2026-41962.md): Permission control vulnerability in the app management and control module. (CVSS 3.6, Huawei HarmonyOS)
- [CVE-2026-41961](https://cve.now/CVE-2026-41961.md): Permission control vulnerability in contacts. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2026-41960](https://cve.now/CVE-2026-41960.md): Permission control vulnerability in calls. (CVSS 5.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2026-41971](https://cve.now/CVE-2026-41971.md): Permission control vulnerability in the security control module. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2026-41965](https://cve.now/CVE-2026-41965.md): Use-After-Free (UAF) vulnerability in the web. (CVSS 5.6, Huawei HarmonyOS)
- [CVE-2026-41963](https://cve.now/CVE-2026-41963.md): Stack overflow vulnerability in the media platform. (CVSS 2.8, Huawei HarmonyOS)
- [CVE-2026-41964](https://cve.now/CVE-2026-41964.md): Permission control vulnerability in the web. (CVSS 8.4, Huawei HarmonyOS)
- [CVE-2026-44088](https://cve.now/CVE-2026-44088.md): Remote Code Execution in SzafirHost (CVSS 8.6, Krajowa Izba Rozliczeniowa SzafirHost)
- [CVE-2026-7563](https://cve.now/CVE-2026-7563.md): Classified Listing \<= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add\_order\_note and send\_email\_to\_user\_by\_moderator AJAX Actions (CVSS 4.3, techlabpro1 Classified Listing – AI-Powered Classified ads…)
- [CVE-2026-8425](https://cve.now/CVE-2026-8425.md): Notify Odoo \<= 1.0.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, pektsekye Notify Odoo)
- [CVE-2026-6415](https://cve.now/CVE-2026-6415.md): Advanced Custom Fields: Font Awesome Field \<= 5.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field (CVSS 6.4, justinkruit Advanced Custom Fields: Font Awesome Field)
- [CVE-2026-6403](https://cve.now/CVE-2026-6403.md): Quick Playground \<= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter (CVSS 7.5, davidfcarr Quick Playground)
- [CVE-2026-4683](https://cve.now/CVE-2026-4683.md): Smartcat Translator for WPML \<= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update (CVSS 6.5, smartcatai Smartcat Translator for WPML)
- [CVE-2026-7046](https://cve.now/CVE-2026-7046.md): NEX-Forms – Ultimate Forms Plugin for WordPress \<= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter (CVSS 4.9, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-5229](https://cve.now/CVE-2026-5229.md): Receive Notifications After Form Submitting – Form Notify for Any Forms \<= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback (CVSS 9.8, m615926 Receive Notifications After Form Submitting – Form…)
- [CVE-2026-6228](https://cve.now/CVE-2026-6228.md): Frontend Admin by DynamiApps \<= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form (CVSS 8.8, shabti Frontend Admin by DynamiApps)
- [CVE-2026-8398](https://cve.now/CVE-2026-8398.md): A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434) (CVSS 9.3, KEV, AVB Disc Soft DAEMON Tools Lite)
- [CVE-2026-4094](https://cve.now/CVE-2026-4094.md): FOX – Currency Switcher Professional for WooCommerce \<= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion (CVSS 8.1, realmag777 FOX – Currency Switcher Professional for WooComm…)
- [CVE-2026-6646](https://cve.now/CVE-2026-6646.md): The7 \<= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter (CVSS 6.4, Dream-Theme The7 — Website and eCommerce Builder for WordPr…)
- [CVE-2026-41702](https://cve.now/CVE-2026-41702.md): TOCTOU local privilege escalation vulnerability (CVSS 7.8, VMware Fusion)
- [CVE-2026-8654](https://cve.now/CVE-2026-8654.md): Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands (CVSS 8.7, Delphix Continuous data IBM Db2 Connector · Delphix Con… +10)
- [CVE-2026-28761](https://cve.now/CVE-2026-28761.md): Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. (CVSS 8.1, Fujitsu Japan Limited Musetheque V4 Information Disclosure…)
- [CVE-2026-24662](https://cve.now/CVE-2026-24662.md): Cross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. (CVSS 5.4, Fujitsu Japan Limited Musetheque V4 Information Disclosure…)
- [CVE-2026-43490](https://cve.now/CVE-2026-43490.md): ksmbd: validate inherited ACE SID length (CVSS 8.8, Linux)
- [CVE-2025-54518](https://cve.now/CVE-2025-54518.md): Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instruction (CVSS 7.3, AMD EPYC™ 7002 Series Processors · AMD Ryzen™ 4000 Seri… +10)
- [CVE-2026-0481](https://cve.now/CVE-2026-0481.md): Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized ch (CVSS 9.2, AMD Instinct™ MI210 · AMD Instinct™ MI250 +7)
- [CVE-2024-21950](https://cve.now/CVE-2024-21950.md): An out of bounds read in the remote management firmware could allow a privileged attacker read a limited section of memory outside of establ (CVSS 1.8, AMD Instinct™ MI300X · AMD Instinct™ MI300A +2)
- [CVE-2025-52532](https://cve.now/CVE-2025-52532.md): A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv\_cmd (CVSS 2.0, AMD Radeon™ PRO · AMD Instinct™ MI250 +5)
- [CVE-2024-36323](https://cve.now/CVE-2024-36323.md): Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized acc (CVSS 8.8, AMD Radeon™ RX 7000 Series Graphics Products · AMD Radeo… +4)
- [CVE-2024-36333](https://cve.now/CVE-2024-36333.md): A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in ar (CVSS 7.0, AMD Radeon™ RX 5000 Series Graphics Products · AMD Radeo… +9)
- [CVE-2024-36334](https://cve.now/CVE-2024-36334.md): Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the installation directory to (CVSS 7.0, AMD Radeon™ RX 7000 Series Graphics Products)
- [CVE-2026-0427](https://cve.now/CVE-2026-0427.md): Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to (CVSS 4.6, AMD Instinct™ MI210 · AMD Instinct™ MI300X +2)
- [CVE-2024-36332](https://cve.now/CVE-2024-36332.md): Improper isolation of GPU HW register space could allow a privileged attacker in malicious Guest Virtual Machine (VM) to perform unauthorize (CVSS 6.8, AMD Radeon™ PRO)
- [CVE-2025-0044](https://cve.now/CVE-2025-0044.md): An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial los (CVSS 4.8, AMD Ryzen™ Al Max+ · AMD Ryzen™ AI 300 Series Processors +6)
- [CVE-2023-31309](https://cve.now/CVE-2023-31309.md): Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when expo (CVSS 6.8, AMD Radeon™ RX 6000 Series Graphics Products · AMD Radeo… +1)
- [CVE-2023-31317](https://cve.now/CVE-2023-31317.md): Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read or (CVSS 8.8, AMD Radeon™ RX 6000 Series Graphics Products · AMD Radeo… +4)
- [CVE-2025-54511](https://cve.now/CVE-2025-54511.md): Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a functi (CVSS 5.3, AMD MI-25 · AMD Instinct™ MI250 +2)
- [CVE-2025-54517](https://cve.now/CVE-2025-54517.md): Out of bounds write in AMD AMDGV\_CMD\_GET\_DIAG\_DATA ioctl handler could allow a local user to escalate privileges via remote code execution. (CVSS 8.5, AMD Instinct™ MI250 · AMD Instinct™ MI308X +5)
- [CVE-2025-66660](https://cve.now/CVE-2025-66660.md): Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV\_SOC\_CMD\_ID\_SRIOV\_CHECK\_TA\_COMPAT to c (CVSS 1.8, AMD Radeon™ RX 6000 Series Graphics Products · AMD Radeo… +9)
- [CVE-2025-66664](https://cve.now/CVE-2025-66664.md): Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE SOC Driver could allow an attacker to issue a malformed DRV\_SOC\_CMD\_ID (CVSS 4.6, AMD Radeon™ RX 6000 Series Graphics Products · AMD Radeo… +9)
- [CVE-2026-0428](https://cve.now/CVE-2026-0428.md): Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV\_SOC\_CMD\_ID\_SRIOV\_COPY\_VF\_CHIPLET\_REGS (CVSS 1.8, AMD Instinct™ MI300A · AMD Instinct™ MI300X +2)
- [CVE-2025-48516](https://cve.now/CVE-2025-48516.md): Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to (CVSS 6.9, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +29)
- [CVE-2023-31316](https://cve.now/CVE-2023-31316.md): Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) could (CVSS 7.1, AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ G… +16)
- [CVE-2022-23826](https://cve.now/CVE-2022-23826.md): A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race conditi (CVSS 1.8, AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ G… +17)
- [CVE-2021-26380](https://cve.now/CVE-2021-26380.md): A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range re (CVSS 1.8, AMD Ryzen™ 5000 Series Desktop Processors with Radeon™… +24)
- [CVE-2026-2652](https://cve.now/CVE-2026-2652.md): Authentication Bypass in mlflow/mlflow (CVSS 8.6, mlflow/mlflow · mlflow)
- [CVE-2025-0040](https://cve.now/CVE-2025-0040.md): Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with phys (CVSS 5.3, AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Gr… +2)
- [CVE-2026-7373](https://cve.now/CVE-2026-7373.md): Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading (CVSS 8.5, Rapid7 Metasploit Pro)
- [CVE-2024-21962](https://cve.now/CVE-2024-21962.md): Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in p (CVSS 8.6, AMD EPYC™ 4005 Series Processors · AMD EPYC™ 4004 Serie… +26)
- [CVE-2025-29935](https://cve.now/CVE-2025-29935.md): An out of bounds write within the AMD Platform Management Framework (PMF) could allow an attacker to execute arbitrary code at an elevated p (CVSS 8.4, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics… +3)
- [CVE-2025-29944](https://cve.now/CVE-2025-29944.md): A buffer overflow vulnerability within AMD Sensor Fusion Hub Driver can allow a local attacker to write out of bounds, potentially resulting (CVSS 6.8, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +12)
- [CVE-2025-29938](https://cve.now/CVE-2025-29938.md): An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory address (CVSS 7.1, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics… +2)
- [CVE-2025-29937](https://cve.now/CVE-2025-29937.md): An out of bounds read within the AMD Platform Management Framework (PMF) could allow an attacker to trigger a read of an arbitrary memory lo (CVSS 5.8, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics… +3)
- [CVE-2025-0028](https://cve.now/CVE-2025-0028.md): An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address (CVSS 8.3, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics… +3)
- [CVE-2025-29936](https://cve.now/CVE-2025-29936.md): Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary memory pages potenti (CVSS 8.4, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics… +5)
- [CVE-2025-48513](https://cve.now/CVE-2025-48513.md): Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memo (CVSS 6.9, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics… +4)
- [CVE-2025-52540](https://cve.now/CVE-2025-52540.md): An improper input validation vulnerability within the AMD Platform Management Framework (PMF) Driver can allow a local attacker to write Out (CVSS 8.5, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics… +3)
- [CVE-2025-48520](https://cve.now/CVE-2025-48520.md): An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read Out- (CVSS 6.9, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics… +3)
- [CVE-2025-48519](https://cve.now/CVE-2025-48519.md): An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or w (CVSS 8.5, AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics… +3)
- [CVE-2025-0045](https://cve.now/CVE-2025-0045.md): Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, pot (CVSS 6.9, AMD Athlon™ 3000 Series Mobile Processors with Radeon™… +38)
- [CVE-2026-0432](https://cve.now/CVE-2026-0432.md): Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalati (CVSS 8.5, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +43)
- [CVE-2025-48521](https://cve.now/CVE-2025-48521.md): Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) condit (CVSS 6.9, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +35)
- [CVE-2025-48512](https://cve.now/CVE-2025-48512.md): Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attack (CVSS 7.0, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +44)
- [CVE-2024-36345](https://cve.now/CVE-2024-36345.md): Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out (CVSS 4.6, AMD EPYC™ · AMD Ryzen™ 6000 Series Processors with Rade… +15)
- [CVE-2026-0438](https://cve.now/CVE-2026-0438.md): A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. (CVSS 5.4, AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ G… +19)
- [CVE-2026-8612](https://cve.now/CVE-2026-8612.md): WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution (CVSS 5.3, OALDERS WWW::Mechanize::Cached)
- [CVE-2025-67031](https://cve.now/CVE-2025-67031.md): ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the partic (CVSS 6.3)
- [CVE-2025-67437](https://cve.now/CVE-2025-67437.md): Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows arbitrary user passwo (CVSS 6.5)
- [CVE-2026-34253](https://cve.now/CVE-2026-34253.md): A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in r (CVSS 8.2)
- [CVE-2026-38728](https://cve.now/CVE-2026-38728.md): An issue in Nodemailer smtp\_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream.\_write, lib/smtp (CVSS 7.5, smtp-server)
- [CVE-2026-39052](https://cve.now/CVE-2026-39052.md): Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. (CVSS 6.5)
- [CVE-2026-39053](https://cve.now/CVE-2026-39053.md): Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. (CVSS 6.5)
- [CVE-2026-39054](https://cve.now/CVE-2026-39054.md): Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands. (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.