CVEs published May 18, 2026
101 CVEs were published on May 18, 2026: 13 critical, 32 high.
- Published
- 101
- Critical
- 13
- High
- 32
- Medium
- 47
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 65
Most affected products
- Mattermost · github.com/mattermost/mattermost/server/v8 +3
- 7
- Mattermost
- 5
- Mattermost · github.com/mattermost/mattermost-server +3
- 5
- omec-project amf · github.com/omec-project/amf
- 5
- steipete summarize · @steipete/summarize
- 4
- Edimax BR-6428NS
- 3
- jarrodwatts claude-hud
- 3
- langgenius dify
- 3
- Microsoft Edge
- 3
- NeoRazorX facturascripts · facturascripts/facturascripts
- 3
Critical 13
- CVE-2026-27130Dokploy has Command Injection in its Service Operationsdokploy
- CVE-2026-25244WebdriverIO has Command Injection in the BrowserStack Servicewebdriverio · @wdio/browserstack-service
- CVE-2026-8838Remote Code Execution via eval() Injection in amazon-redshift-python-driverAWS Amazon Redshift connector for Python · redshift-connect…
- CVE-2026-8836lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflowlwIP
- CVE-2026-42822Azure Local Disconnected Operations (ALDO) Elevation of Privilege VulnerabilityMicrosoft Azure Local
- CVE-2026-45829A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attackChromaDB
- CVE-2026-41948Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Accesslanggenius dify
- CVE-2026-41947Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpointslanggenius dify
- CVE-2026-7304CVE-2026-7304SGLang
- CVE-2026-7302CVE-2026-7302SGLang
- CVE-2026-7301CVE-2026-7301SGLang
- CVE-2026-4320Authorization Bypass in ICMS Content Management by Creartia Internet ConsultingCreartia Internet Consulting ICMS Content Management
- CVE-2023-24215Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administr
High 32
- CVE-2026-30950AutoGPT has Authenticated Session Hijacking via IDORSignificant-Gravitas AutoGPT
- CVE-2026-27891Remote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismNeoRazorX facturascripts · facturascripts/facturascripts
- CVE-2026-26978Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.phpFreePBX security-reporting
- CVE-2026-4137Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-22810Joplin: Path traversal in OneNote importer allows overwriting arbitrary fileslaurent22 joplin · @joplin/onenote-converter
- CVE-2026-8851SOGo < 5.12.8 SQL Injection via addUserInAcls endpointAlinto SOGo Webmail
- CVE-2026-47092Claude HUD 0.0.12 Arbitrary Command Execution via COMSPEC Environment Variablejarrodwatts claude-hud
- CVE-2026-45242Summarize < 0.15.1 Path Traversal via slidesDir Parametersteipete summarize · @steipete/summarize
- CVE-2026-45230DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-fileDumbWareio DumbAssets
- CVE-2026-45495Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-8843Calling createIndex with certain index types can crash mongodMongoDB Server
- CVE-2026-41949Dify < 1.14.2 Authorization Bypass via File Preview Endpointlanggenius dify
- CVE-2026-42009Gnutls: gnutls: denial of service via dtls packet reordering vulnerabilitygnutls · Red Hat Enterprise Linux +7
- CVE-2026-0983Denial of service vulnerability in M-Files ServerM-Files Server
- CVE-2026-7498Stored XSS in Basamak Informatics' DernekWebBasamak Information Technology Consulting and Organization…
- CVE-2026-6346Sensitive credentials exposed in plaintext in Mattermost support packetsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-6347Mattermost Calls plugin exposes TURN server credentials in plaintext in support packetsMattermost · github.com/mattermost/mattermost-server +1
- CVE-2026-6902Code Injection in Perforce P4 (Helix Core)Perforce P4
- CVE-2026-8788Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injectionsRRWO Net::Statsd::Lite
- CVE-2026-6495Ajax Load More < 7.8.4 - Reflected XSSAjax Load More
- CVE-2026-6381WP Maps < 4.9.3 - Subscriber+ Local File InclusionWP Maps
- CVE-2026-6379WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' ParameterWP Photo Album Plus
- CVE-2026-3220Multiple Plugins - Unauthenticated Stored XSS via Minify LibraryAutoptimize · Clearfy Cache +1
- CVE-2026-8776Edimax BR-6428NS POST Request formPPTPSetup buffer overflowEdimax BR-6428NS
- CVE-2026-8775Edimax BR-6428NS POST Request formL2TPSetup buffer overflowEdimax BR-6428NS
- CVE-2025-56352In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles protocol violations during CONNECT packet pa
- CVE-2025-57282ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.ngrok
- CVE-2026-26462Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration.
- CVE-2026-29962HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths.
- CVE-2026-29963HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint.
- CVE-2026-39079An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /mod
- CVE-2026-41085Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an authenticated user with
Medium, low and unrated 56
- CVE-2026-32312GLPI: Unauthorized export of form structureglpi-project glpi
- CVE-2026-27964FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie ManipulationNeoRazorX facturascripts · facturascripts/facturascripts
- CVE-2026-27892FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/DownloadNeoRazorX facturascripts · facturascripts/facturascripts
- CVE-2026-27737BigBlueButton has Stored XSS in bbb-playback replaybigbluebutton · blindsidenetworks scalite
- CVE-2025-65954SimpleSAMLphp-casserver has an Open Redirect vulnerability via logoutsimplesamlphp-module-casserver · simplesamlphp/simplesamlph…
- CVE-2026-47091Claude HUD 0.0.12 Path Traversal via transcript_pathjarrodwatts claude-hud
- CVE-2026-47090Claude HUD 0.0.12 Terminal Injection via OSC 8 Hyperlinksjarrodwatts claude-hud
- CVE-2026-21789HCL Connections is vulnerable to broken access controlHCLSoftware Connections
- CVE-2026-45246Summarize < 0.15.1 Insecure File Permissions Information Disclosuresteipete summarize
- CVE-2026-45245Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Eventssteipete summarize · @steipete/summarize
- CVE-2026-45244Summarize < 0.15.1 Unapproved Browser Automation Executionsteipete summarize · @steipete/summarize
- CVE-2026-45243Summarize < 0.15.1 Browser Extension Missing Authorization via Content Scriptsteipete summarize · @steipete/summarize
- CVE-2026-45231DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset FieldsDumbWareio DumbAssets
- CVE-2026-32848NetBSD cryptodev Race Condition Double-Free via cryptodev_op()NetBSD src
- CVE-2026-32849NetBSD Signed Integer Overflow in cryptodev_op via cryptodev.cNetBSD src
- CVE-2026-45494Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-45492Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2026-20685An attacker in a privileged network position may be able to leak sensitive information.Apple Private Cloud Compute Server Software
- CVE-2026-8803opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hashopensourcepos Open Source Point of Sale
- CVE-2026-8802opensourcepos Open Source Point of Sale Items.php getPicThumb path traversalopensourcepos Open Source Point of Sale
- CVE-2026-41119Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability.Dell Live Optics
- CVE-2026-3471Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop AppMattermost
- CVE-2026-4643Calling window.close() from server-side content causes crash in the Mattermost Desktop AppMattermost
- CVE-2026-6333SSRF via Host Header Spoofing in Custom Slash CommandsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-6345Prevent password disclosure and force reset during Slack importMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-28732Slash command trigger-word update allowed command hijackingMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-6343Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooksMattermost · github.com/mattermost/mattermost-plugin-pla… +4
- CVE-2026-5163Missing authorization check in AI message rewrite endpoint allows access to private thread contentMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-3117Instance and webhook GitLab plugin commands were able to be run by non-admin usersMattermost
- CVE-2026-4286Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook updateMattermost · github.com/mattermost/mattermost/server/v8 +4
- CVE-2026-6339Missing request origin validation on burn-on-read reveal endpointMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-6340Memory Exhaustion via Malicious 7zip File UploadMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-6341Incomplete group locking implementationMattermost
- CVE-2026-6342Group prefix matching bypass for subscriptionsMattermost
- CVE-2026-3495Unescaped variables during error page compositionMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-4273Insufficient token rotation validation in remote cluster invite confirmationMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-3637Mattermost fails to enforce create_post permission when editing postsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-2325Improper Input Validation in MS Teams Meetings API HandlerMattermost · github.com/mattermost/mattermost-server +1
- CVE-2026-28759Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channelsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-6334OAuth authorization code client binding not enforced during token redemption in MattermostMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-1631Feeds for YouTube < 2.6.4 - Subscriber+ License Data DeletionFeeds for YouTube
- CVE-2026-8786Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorizationTencent WeKnora
- CVE-2026-8785projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injectionprojectworlds hospital-management-system-in-php
- CVE-2026-8784npitre cramfs-tools cramfsck.c change_file_status symlinknpitre cramfs-tools
- CVE-2026-8783omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereferenceomec-project amf · github.com/omec-project/amf
- CVE-2026-8782omec-project amf NGAP Message handler.go null pointer dereferenceomec-project amf · github.com/omec-project/amf
- CVE-2026-8781omec-project amf handler.go RANConfiguration null pointer dereferenceomec-project amf · github.com/omec-project/amf
- CVE-2026-8780omec-project amf NGAP Message dispatcher.go memory corruptionomec-project amf · github.com/omec-project/amf
- CVE-2026-8779omec-project amf handler.go NGSetupRequest memory corruptionomec-project amf · github.com/omec-project/amf
- CVE-2026-8777Edimax BR-6428NS POST Request formStaDrvSetup command injectionEdimax BR-6428NS
- CVE-2026-8774Edimax BR-6228NC POST Request mp command injectionEdimax BR-6228NC
- CVE-2026-8773linlinjava litemall Database Setting DbUtil.java load argument injectionlinlinjava litemall
- CVE-2026-29964HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization o
- CVE-2026-29965HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralizat
- CVE-2026-36438An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset f
- CVE-2026-38719OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specifically in CreateCommon