# CVEs published 2026-05-18

101 CVEs were published on May 18, 2026: 13 critical, 32 high. Days are UTC.

- [CVE-2026-32312](https://cve.now/CVE-2026-32312.md): GLPI: Unauthorized export of form structure (CVSS 5.1, glpi-project glpi)
- [CVE-2026-30950](https://cve.now/CVE-2026-30950.md): AutoGPT has Authenticated Session Hijacking via IDOR (CVSS 7.1, Significant-Gravitas AutoGPT)
- [CVE-2026-27964](https://cve.now/CVE-2026-27964.md): FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation (CVSS 3.9, NeoRazorX facturascripts · facturascripts/facturascripts)
- [CVE-2026-27892](https://cve.now/CVE-2026-27892.md): FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download (CVSS 6.5, NeoRazorX facturascripts · facturascripts/facturascripts)
- [CVE-2026-27891](https://cve.now/CVE-2026-27891.md): Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism (CVSS 7.2, NeoRazorX facturascripts · facturascripts/facturascripts)
- [CVE-2026-27737](https://cve.now/CVE-2026-27737.md): BigBlueButton has Stored XSS in bbb-playback replay (CVSS 6.5, bigbluebutton · blindsidenetworks scalite)
- [CVE-2026-27130](https://cve.now/CVE-2026-27130.md): Dokploy has Command Injection in its Service Operations (CVSS 9.9, dokploy)
- [CVE-2026-26978](https://cve.now/CVE-2026-26978.md): Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php (CVSS 8.6, FreePBX security-reporting)
- [CVE-2026-25244](https://cve.now/CVE-2026-25244.md): WebdriverIO has Command Injection in the BrowserStack Service (CVSS 9.8, webdriverio · @wdio/browserstack-service)
- [CVE-2026-4137](https://cve.now/CVE-2026-4137.md): Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow (CVSS 7.0, mlflow/mlflow · mlflow)
- [CVE-2026-22810](https://cve.now/CVE-2026-22810.md): Joplin: Path traversal in OneNote importer allows overwriting arbitrary files (CVSS 8.2, laurent22 joplin · @joplin/onenote-converter)
- [CVE-2026-8838](https://cve.now/CVE-2026-8838.md): Remote Code Execution via eval() Injection in amazon-redshift-python-driver (CVSS 9.8, AWS Amazon Redshift connector for Python · redshift-connect…)
- [CVE-2026-8851](https://cve.now/CVE-2026-8851.md): SOGo \< 5.12.8 SQL Injection via addUserInAcls endpoint (CVSS 8.6, Alinto SOGo Webmail)
- [CVE-2025-65954](https://cve.now/CVE-2025-65954.md): SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout (CVSS 4.7, simplesamlphp-module-casserver · simplesamlphp/simplesamlph…)
- [CVE-2026-47092](https://cve.now/CVE-2026-47092.md): Claude HUD 0.0.12 Arbitrary Command Execution via COMSPEC Environment Variable (CVSS 7.3, jarrodwatts claude-hud)
- [CVE-2026-47091](https://cve.now/CVE-2026-47091.md): Claude HUD 0.0.12 Path Traversal via transcript\_path (CVSS 4.8, jarrodwatts claude-hud)
- [CVE-2026-47090](https://cve.now/CVE-2026-47090.md): Claude HUD 0.0.12 Terminal Injection via OSC 8 Hyperlinks (CVSS 2.4, jarrodwatts claude-hud)
- [CVE-2026-21789](https://cve.now/CVE-2026-21789.md): HCL Connections is vulnerable to broken access control (CVSS 4.6, HCLSoftware Connections)
- [CVE-2026-45246](https://cve.now/CVE-2026-45246.md): Summarize \< 0.15.1 Insecure File Permissions Information Disclosure (CVSS 6.8, steipete summarize)
- [CVE-2026-45245](https://cve.now/CVE-2026-45245.md): Summarize \< 0.15.1 Unauthorized Daemon Request via Untrusted Events (CVSS 4.6, steipete summarize · @steipete/summarize)
- [CVE-2026-45244](https://cve.now/CVE-2026-45244.md): Summarize \< 0.15.1 Unapproved Browser Automation Execution (CVSS 2.1, steipete summarize · @steipete/summarize)
- [CVE-2026-45242](https://cve.now/CVE-2026-45242.md): Summarize \< 0.15.1 Path Traversal via slidesDir Parameter (CVSS 7.1, steipete summarize · @steipete/summarize)
- [CVE-2026-45243](https://cve.now/CVE-2026-45243.md): Summarize \< 0.15.1 Browser Extension Missing Authorization via Content Script (CVSS 5.3, steipete summarize · @steipete/summarize)
- [CVE-2026-8836](https://cve.now/CVE-2026-8836.md): lwIP snmpv3 USM snmp\_msg.c snmp\_parse\_inbound\_frame stack-based overflow (CVSS 9.3, lwIP)
- [CVE-2026-45231](https://cve.now/CVE-2026-45231.md): DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields (CVSS 5.3, DumbWareio DumbAssets)
- [CVE-2026-45230](https://cve.now/CVE-2026-45230.md): DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file (CVSS 8.8, DumbWareio DumbAssets)
- [CVE-2026-32848](https://cve.now/CVE-2026-32848.md): NetBSD cryptodev Race Condition Double-Free via cryptodev\_op() (CVSS 5.7, NetBSD src)
- [CVE-2026-32849](https://cve.now/CVE-2026-32849.md): NetBSD Signed Integer Overflow in cryptodev\_op via cryptodev.c (CVSS 5.7, NetBSD src)
- [CVE-2026-42822](https://cve.now/CVE-2026-42822.md): Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Local)
- [CVE-2026-45495](https://cve.now/CVE-2026-45495.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2026-45494](https://cve.now/CVE-2026-45494.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-45492](https://cve.now/CVE-2026-45492.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-45829](https://cve.now/CVE-2026-45829.md): A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attack (CVSS 10.0, ChromaDB)
- [CVE-2026-8843](https://cve.now/CVE-2026-8843.md): Calling createIndex with certain index types can crash mongod (CVSS 7.1, MongoDB Server)
- [CVE-2026-20685](https://cve.now/CVE-2026-20685.md): An attacker in a privileged network position may be able to leak sensitive information. (CVSS 6.5, Apple Private Cloud Compute Server Software)
- [CVE-2026-41949](https://cve.now/CVE-2026-41949.md): Dify \< 1.14.2 Authorization Bypass via File Preview Endpoint (CVSS 8.2, langgenius dify)
- [CVE-2026-41948](https://cve.now/CVE-2026-41948.md): Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access (CVSS 9.3, langgenius dify)
- [CVE-2026-41947](https://cve.now/CVE-2026-41947.md): Dify \< 1.14.2 Authorization Bypass via Trace Configuration Endpoints (CVSS 9.3, langgenius dify)
- [CVE-2026-42009](https://cve.now/CVE-2026-42009.md): Gnutls: gnutls: denial of service via dtls packet reordering vulnerability (CVSS 7.5, gnutls · Red Hat Enterprise Linux +7)
- [CVE-2026-8803](https://cve.now/CVE-2026-8803.md): opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash (CVSS 6.3, opensourcepos Open Source Point of Sale)
- [CVE-2026-0983](https://cve.now/CVE-2026-0983.md): Denial of service vulnerability in M-Files Server (CVSS 7.1, M-Files Server)
- [CVE-2026-7304](https://cve.now/CVE-2026-7304.md): CVE-2026-7304 (CVSS 9.8, SGLang)
- [CVE-2026-7302](https://cve.now/CVE-2026-7302.md): CVE-2026-7302 (CVSS 9.1, SGLang)
- [CVE-2026-7301](https://cve.now/CVE-2026-7301.md): CVE-2026-7301 (CVSS 9.8, SGLang)
- [CVE-2026-4320](https://cve.now/CVE-2026-4320.md): Authorization Bypass in ICMS Content Management by Creartia Internet Consulting (CVSS 9.3, Creartia Internet Consulting ICMS Content Management)
- [CVE-2026-8802](https://cve.now/CVE-2026-8802.md): opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal (CVSS 5.3, opensourcepos Open Source Point of Sale)
- [CVE-2026-41119](https://cve.now/CVE-2026-41119.md): Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability. (CVSS 6.8, Dell Live Optics)
- [CVE-2026-7498](https://cve.now/CVE-2026-7498.md): Stored XSS in Basamak Informatics' DernekWeb (CVSS 8.8, Basamak Information Technology Consulting and Organization…)
- [CVE-2026-3471](https://cve.now/CVE-2026-3471.md): Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App (CVSS 6.5, Mattermost)
- [CVE-2026-4643](https://cve.now/CVE-2026-4643.md): Calling window.close() from server-side content causes crash in the Mattermost Desktop App (CVSS 3.5, Mattermost)
- [CVE-2026-6333](https://cve.now/CVE-2026-6333.md): SSRF via Host Header Spoofing in Custom Slash Commands (CVSS 3.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-6345](https://cve.now/CVE-2026-6345.md): Prevent password disclosure and force reset during Slack import (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-6346](https://cve.now/CVE-2026-6346.md): Sensitive credentials exposed in plaintext in Mattermost support packets (CVSS 8.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-28732](https://cve.now/CVE-2026-28732.md): Slash command trigger-word update allowed command hijacking (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-6343](https://cve.now/CVE-2026-6343.md): Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-plugin-pla… +4)
- [CVE-2026-6347](https://cve.now/CVE-2026-6347.md): Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets (CVSS 7.6, Mattermost · github.com/mattermost/mattermost-server +1)
- [CVE-2026-5163](https://cve.now/CVE-2026-5163.md): Missing authorization check in AI message rewrite endpoint allows access to private thread content (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-3117](https://cve.now/CVE-2026-3117.md): Instance and webhook GitLab plugin commands were able to be run by non-admin users (CVSS 6.5, Mattermost)
- [CVE-2026-4286](https://cve.now/CVE-2026-4286.md): Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +4)
- [CVE-2026-6339](https://cve.now/CVE-2026-6339.md): Missing request origin validation on burn-on-read reveal endpoint (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-6902](https://cve.now/CVE-2026-6902.md): Code Injection in Perforce P4 (Helix Core) (CVSS 7.7, Perforce P4)
- [CVE-2026-6340](https://cve.now/CVE-2026-6340.md): Memory Exhaustion via Malicious 7zip File Upload (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-6341](https://cve.now/CVE-2026-6341.md): Incomplete group locking implementation (CVSS 4.3, Mattermost)
- [CVE-2026-6342](https://cve.now/CVE-2026-6342.md): Group prefix matching bypass for subscriptions (CVSS 4.3, Mattermost)
- [CVE-2026-3495](https://cve.now/CVE-2026-3495.md): Unescaped variables during error page composition (CVSS 3.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-4273](https://cve.now/CVE-2026-4273.md): Insufficient token rotation validation in remote cluster invite confirmation (CVSS 3.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-3637](https://cve.now/CVE-2026-3637.md): Mattermost fails to enforce create\_post permission when editing posts (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-2325](https://cve.now/CVE-2026-2325.md): Improper Input Validation in MS Teams Meetings API Handler (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +1)
- [CVE-2026-28759](https://cve.now/CVE-2026-28759.md): Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-8788](https://cve.now/CVE-2026-8788.md): Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections (CVSS 7.3, RRWO Net::Statsd::Lite)
- [CVE-2026-6334](https://cve.now/CVE-2026-6334.md): OAuth authorization code client binding not enforced during token redemption in Mattermost (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-6495](https://cve.now/CVE-2026-6495.md): Ajax Load More \< 7.8.4 - Reflected XSS (CVSS 7.1, Ajax Load More)
- [CVE-2026-6381](https://cve.now/CVE-2026-6381.md): WP Maps \< 4.9.3 - Subscriber+ Local File Inclusion (CVSS 7.5, WP Maps)
- [CVE-2026-6379](https://cve.now/CVE-2026-6379.md): WP Photo Album Plus \< 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter (CVSS 8.6, WP Photo Album Plus)
- [CVE-2026-3220](https://cve.now/CVE-2026-3220.md): Multiple Plugins - Unauthenticated Stored XSS via Minify Library (CVSS 8.8, Autoptimize · Clearfy Cache +1)
- [CVE-2026-1631](https://cve.now/CVE-2026-1631.md): Feeds for YouTube \< 2.6.4 - Subscriber+ License Data Deletion (CVSS 5.4, Feeds for YouTube)
- [CVE-2026-8786](https://cve.now/CVE-2026-8786.md): Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization (CVSS 5.3, Tencent WeKnora)
- [CVE-2026-8785](https://cve.now/CVE-2026-8785.md): projectworlds hospital-management-system-in-php GET Parameter update\_info.php getAllPatientDetail sql injection (CVSS 6.9, projectworlds hospital-management-system-in-php)
- [CVE-2026-8784](https://cve.now/CVE-2026-8784.md): npitre cramfs-tools cramfsck.c change\_file\_status symlink (CVSS 4.6, npitre cramfs-tools)
- [CVE-2026-8783](https://cve.now/CVE-2026-8783.md): omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference (CVSS 5.3, omec-project amf · github.com/omec-project/amf)
- [CVE-2026-8782](https://cve.now/CVE-2026-8782.md): omec-project amf NGAP Message handler.go null pointer dereference (CVSS 5.3, omec-project amf · github.com/omec-project/amf)
- [CVE-2026-8781](https://cve.now/CVE-2026-8781.md): omec-project amf handler.go RANConfiguration null pointer dereference (CVSS 5.3, omec-project amf · github.com/omec-project/amf)
- [CVE-2026-8780](https://cve.now/CVE-2026-8780.md): omec-project amf NGAP Message dispatcher.go memory corruption (CVSS 5.3, omec-project amf · github.com/omec-project/amf)
- [CVE-2026-8779](https://cve.now/CVE-2026-8779.md): omec-project amf handler.go NGSetupRequest memory corruption (CVSS 5.3, omec-project amf · github.com/omec-project/amf)
- [CVE-2026-8777](https://cve.now/CVE-2026-8777.md): Edimax BR-6428NS POST Request formStaDrvSetup command injection (CVSS 5.3, Edimax BR-6428NS)
- [CVE-2026-8776](https://cve.now/CVE-2026-8776.md): Edimax BR-6428NS POST Request formPPTPSetup buffer overflow (CVSS 8.7, Edimax BR-6428NS)
- [CVE-2026-8775](https://cve.now/CVE-2026-8775.md): Edimax BR-6428NS POST Request formL2TPSetup buffer overflow (CVSS 8.7, Edimax BR-6428NS)
- [CVE-2026-8774](https://cve.now/CVE-2026-8774.md): Edimax BR-6228NC POST Request mp command injection (CVSS 5.3, Edimax BR-6228NC)
- [CVE-2026-8773](https://cve.now/CVE-2026-8773.md): linlinjava litemall Database Setting DbUtil.java load argument injection (CVSS 5.1, linlinjava litemall)
- [CVE-2023-24215](https://cve.now/CVE-2023-24215.md): Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administr (CVSS 9.1)
- [CVE-2025-56352](https://cve.now/CVE-2025-56352.md): In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles protocol violations during CONNECT packet pa (CVSS 7.5)
- [CVE-2025-57282](https://cve.now/CVE-2025-57282.md): ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. (CVSS 8.8, ngrok)
- [CVE-2026-26462](https://cve.now/CVE-2026-26462.md): Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. (CVSS 7.3)
- [CVE-2026-29962](https://cve.now/CVE-2026-29962.md): HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. (CVSS 7.5)
- [CVE-2026-29963](https://cve.now/CVE-2026-29963.md): HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. (CVSS 7.5)
- [CVE-2026-29964](https://cve.now/CVE-2026-29964.md): HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization o (CVSS 6.1)
- [CVE-2026-29965](https://cve.now/CVE-2026-29965.md): HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralizat (CVSS 6.1)
- [CVE-2026-36438](https://cve.now/CVE-2026-36438.md): An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset f (CVSS 5.3)
- [CVE-2026-38719](https://cve.now/CVE-2026-38719.md): OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specifically in CreateCommon (CVSS 6.2)
- [CVE-2026-39079](https://cve.now/CVE-2026-39079.md): An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /mod (CVSS 7.5)
- [CVE-2026-41085](https://cve.now/CVE-2026-41085.md): Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an authenticated user with (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.