# CVEs published 2026-05-19

205 CVEs were published on May 19, 2026: 29 critical, 79 high. Days are UTC.

- [CVE-2026-39309](https://cve.now/CVE-2026-39309.md): Trilium Notes: macOS TCC Bypass via Prompt Spoofing (CVSS 5.5, TriliumNext Trilium)
- [CVE-2026-35593](https://cve.now/CVE-2026-35593.md): Trilium Notes has Local File Inclusion via upload modified file API endpoint (CVSS 6.8, TriliumNext Trilium)
- [CVE-2026-45585](https://cve.now/CVE-2026-45585.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2026-34970](https://cve.now/CVE-2026-34970.md): MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked (CVSS 5.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-34754](https://cve.now/CVE-2026-34754.md): MantisBT allows unauthorized users to upload attachments to restricted issues via REST API (CVSS 4.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-34744](https://cve.now/CVE-2026-34744.md): MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues (CVSS 5.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-8495](https://cve.now/CVE-2026-8495.md): Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037 (CVSS 9.8, Drupal Date iCal · drupal/date\_ical)
- [CVE-2026-8493](https://cve.now/CVE-2026-8493.md): Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036 (CVSS 5.4, Drupal Colorbox Inline · drupal/colorbox\_inline)
- [CVE-2026-8492](https://cve.now/CVE-2026-8492.md): Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035 (CVSS 2.7, Translate Drupal with GTranslate · drupal/gtranslate)
- [CVE-2026-8491](https://cve.now/CVE-2026-8491.md): Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034 (CVSS 3.7, Drupal Node View Permissions · drupal/node\_view\_permissions)
- [CVE-2026-6871](https://cve.now/CVE-2026-6871.md): Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033 (CVSS 6.1, Drupal Obfuscate · drupal/obfuscate)
- [CVE-2026-34600](https://cve.now/CVE-2026-34600.md): Joplin Server delta API returns note content after share access is revoked (CVSS 5.7, laurent22 joplin)
- [CVE-2026-6367](https://cve.now/CVE-2026-6367.md): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 (CVSS 6.1, Drupal core · drupal/core)
- [CVE-2026-6366](https://cve.now/CVE-2026-6366.md): Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 (CVSS 6.6, Drupal core · drupal/core)
- [CVE-2026-6365](https://cve.now/CVE-2026-6365.md): Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001 (CVSS 6.1, Drupal core · drupal/core)
- [CVE-2026-6095](https://cve.now/CVE-2026-6095.md): Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032 (CVSS 6.1, Drupal Orejime · drupal/orejime)
- [CVE-2026-34579](https://cve.now/CVE-2026-34579.md): MantisBT has an authorization bypass via private issue monitoring (CVSS 5.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-34463](https://cve.now/CVE-2026-34463.md): MantisBT has Stored HTML Injection/XSS via Clone Issue Form (CVSS 8.6, mantisbt · mantisbt/mantisbt)
- [CVE-2023-7345](https://cve.now/CVE-2023-7345.md): Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation (CVSS 6.5, ledgerhq/hw-app-eth · Ledger Live)
- [CVE-2026-34390](https://cve.now/CVE-2026-34390.md): MantisBT: Privilege Escalation from Manager to Administrator (CVSS 5.1, mantisbt · mantisbt/mantisbt)
- [CVE-2025-15645](https://cve.now/CVE-2025-15645.md): Ledger Nano X, Flex, Stax MCU Firmware Update Denial of Service (CVSS 4.6, Ledger Nano X · Ledger Flex +1)
- [CVE-2026-34358](https://cve.now/CVE-2026-34358.md): CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass (CVSS 8.1, Ctrlpanel-gg panel)
- [CVE-2026-5090](https://cve.now/CVE-2026-5090.md): Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected (CVSS 6.1, Template-Toolkit)
- [CVE-2026-34246](https://cve.now/CVE-2026-34246.md): CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output (CVSS 4.8, Ctrlpanel-gg panel)
- [CVE-2026-34241](https://cve.now/CVE-2026-34241.md): CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking (CVSS 8.7, Ctrlpanel-gg panel)
- [CVE-2024-36343](https://cve.now/CVE-2024-36343.md): Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of b (CVSS 4.6, AMD EPYC™ · AMD Ryzen™ 6000 Series Processors with Rade… +14)
- [CVE-2026-34234](https://cve.now/CVE-2026-34234.md): CtrlPanel: Unauthenticated RCE using installer script (CVSS 10.0, Ctrlpanel-gg panel)
- [CVE-2026-34233](https://cve.now/CVE-2026-34233.md): CtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints (CVSS 6.5, Ctrlpanel-gg panel)
- [CVE-2026-34216](https://cve.now/CVE-2026-34216.md): CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php (CVSS 6.6, Ctrlpanel-gg panel)
- [CVE-2025-57798](https://cve.now/CVE-2025-57798.md): Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input (CVSS 5.5, laurent22 joplin)
- [CVE-2026-32882](https://cve.now/CVE-2026-32882.md): libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (CVSS 7.1, strukturag libheif)
- [CVE-2026-32741](https://cve.now/CVE-2026-32741.md): libheif has a heap buffer overflow in decode\_mask\_image() (CVSS 7.1, strukturag libheif)
- [CVE-2026-32814](https://cve.now/CVE-2026-32814.md): libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (CVSS 6.5, strukturag libheif)
- [CVE-2026-32740](https://cve.now/CVE-2026-32740.md): libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (CVSS 8.8, strukturag libheif)
- [CVE-2026-27173](https://cve.now/CVE-2026-27173.md): Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments (CVSS 8.7, Apache Software Foundation Apache Airflow CNCF Kubernetes p…)
- [CVE-2026-42526](https://cve.now/CVE-2026-42526.md): Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends (CVSS 5.3, Apache Software Foundation Apache Airflow Amazon provider ·…)
- [CVE-2026-32739](https://cve.now/CVE-2026-32739.md): libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup (CVSS 6.5, strukturag libheif)
- [CVE-2026-32738](https://cve.now/CVE-2026-32738.md): libheif has a Heap OOB Read/SEGV Crash via Zero samples\_per\_chunk (CVSS 6.5, strukturag libheif)
- [CVE-2026-41470](https://cve.now/CVE-2026-41470.md): LIVE555 \< 2026.04.22 RTSP Server Authorization Bypass via Session Token (CVSS 8.2, Live Networks LIVE555)
- [CVE-2026-8370](https://cve.now/CVE-2026-8370.md): Automic Automation Agent Unix privilege escalation (CVSS 8.5, Broadcom Automic Automation)
- [CVE-2026-34154](https://cve.now/CVE-2026-34154.md): Discourse has a subscription access bypass in its discourse-subscriptions plugin (CVSS 2.1, discourse)
- [CVE-2026-8073](https://cve.now/CVE-2026-8073.md): Kirki \<= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP (CVSS 7.5, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-8096](https://cve.now/CVE-2026-8096.md): Kirki \<= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki\_wp\_admin\_get\_apis' Action (CVSS 6.5, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-33741](https://cve.now/CVE-2026-33741.md): EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript (CVSS 6.8, espocrm)
- [CVE-2026-33642](https://cve.now/CVE-2026-33642.md): Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose\_rectangles Bounds Check (CVSS 9.9, kovidgoyal kitty)
- [CVE-2026-33637](https://cve.now/CVE-2026-33637.md): Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2) (CVSS 0.0, lostisland faraday · faraday)
- [CVE-2026-33633](https://cve.now/CVE-2026-33633.md): Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler (CVSS 7.5, kovidgoyal kitty)
- [CVE-2026-6009](https://cve.now/CVE-2026-6009.md): Jaspersoft Library Deserialisation Vulnerability (CVSS 8.7, Jaspersoft JasperReports Library Community Edition · Jas… +7)
- [CVE-2026-32134](https://cve.now/CVE-2026-32134.md): NanoMQ: NULL Pointer Dereference Crash in tcptran\_pipe\_peer During Session Restore (CVSS 5.9, nanomq)
- [CVE-2026-8605](https://cve.now/CVE-2026-8605.md): Use of Hard-coded Credentials in ScadaBR (CVSS 5.1, ScadaBR)
- [CVE-2026-8604](https://cve.now/CVE-2026-8604.md): Cross-Site request forgery (CSRF) in ScadaBR (CVSS 8.6, ScadaBR)
- [CVE-2026-8603](https://cve.now/CVE-2026-8603.md): Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR (CVSS 8.7, ScadaBR)
- [CVE-2026-8602](https://cve.now/CVE-2026-8602.md): Missing authentication for critical function in ScadaBR (CVSS 8.8, ScadaBR)
- [CVE-2026-47107](https://cve.now/CVE-2026-47107.md): Windmill \< 1.703.2 Incorrect Default Permissions in nsjail Configuration (CVSS 8.6, windmill-labs windmill)
- [CVE-2026-5511](https://cve.now/CVE-2026-5511.md): Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72 (CVSS 4.6, TP-Link Systems Archer AX72 (SG))
- [CVE-2026-47358](https://cve.now/CVE-2026-47358.md): Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when (CVSS 7.5, tenable Terrascan)
- [CVE-2026-47357](https://cve.now/CVE-2026-47357.md): Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote\_url parameter in the remote directory scan e (CVSS 7.5, tenable Terrascan)
- [CVE-2026-47356](https://cve.now/CVE-2026-47356.md): Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook\_url parameter in the file scan endpoint (PO (CVSS 7.5, tenable Terrascan)
- [CVE-2026-5804](https://cve.now/CVE-2026-5804.md): An improper authentication vulnerability was discovered in the Motorola Factory Test component (com.motorola.motocit). (CVSS 8.4, Motorola Phones)
- [CVE-2026-8706](https://cve.now/CVE-2026-8706.md): Sensitive user data could be leaked to other applications through Reader mode (CVSS 6.5, Mozilla Firefox for iOS)
- [CVE-2026-2586](https://cve.now/CVE-2026-2586.md): An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. (CVSS 9.1, Eclipse Foundation Eclipse Glassfish · org.glassfish.mai… +1)
- [CVE-2026-8711](https://cve.now/CVE-2026-8711.md): NGINX JavaScript vulnerability (CVSS 8.1, F5 NGINX JavaScript)
- [CVE-2026-2587](https://cve.now/CVE-2026-2587.md): A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish ga (CVSS 9.6, Eclipse Foundation Eclipse Glassfish · org.glassfish.mai… +1)
- [CVE-2026-47100](https://cve.now/CVE-2026-47100.md): Funnel Builder for WooCommerce Checkout \< 3.15.0.3 Missing Authorization via AJAX (CVSS 8.7, FunnelKit Funnel Builder for WooCommerce Checkout)
- [CVE-2026-45557](https://cve.now/CVE-2026-45557.md): Technitium DNS Server excessive DNSSEC requests (CVSS 5.8, Technitium DNS Server)
- [CVE-2026-44159](https://cve.now/CVE-2026-44159.md): Tyler Identity Local (TID-L) default administrative credentials (CVSS 9.8, Tyler Technologies TID-L)
- [CVE-2026-43634](https://cve.now/CVE-2026-43634.md): HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header (CVSS 8.7, hestiacp)
- [CVE-2026-43633](https://cve.now/CVE-2026-43633.md): HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal (CVSS 9.5, hestiacp)
- [CVE-2025-40904](https://cve.now/CVE-2025-40904.md): HTML injection in Smart Polling in Guardian/CMC before 26.1.0 (CVSS 5.1, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40903](https://cve.now/CVE-2025-40903.md): HTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0 (CVSS 4.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40902](https://cve.now/CVE-2025-40902.md): HTML injection in Users in Guardian/CMC before 26.1.0 (CVSS 4.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40901](https://cve.now/CVE-2025-40901.md): HTML injection in Credentials Manager in Guardian/CMC before 26.1.0 (CVSS 4.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-40900](https://cve.now/CVE-2025-40900.md): Angular template injection in Reports in Guardian/CMC before 26.1.0 (CVSS 5.1, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2025-14575](https://cve.now/CVE-2025-14575.md): Uncontrolled Search Path Element in Qt Network OpenSSL TLS backend allows rogue CA certificate loading (CVSS 1.8, Qt)
- [CVE-2026-42100](https://cve.now/CVE-2026-42100.md): DoS in Sparx Pro Cloud Server (CVSS 7.1, Sparx Systems Pro Cloud Server)
- [CVE-2026-42099](https://cve.now/CVE-2026-42099.md): Race Condition in Sparx Pro Cloud Server (CVSS 7.7, Sparx Systems Pro Cloud Server)
- [CVE-2026-42098](https://cve.now/CVE-2026-42098.md): Authorization Bypass in Sparx Enterprise Architect (CVSS 8.7, Sparx Systems Enterprise Architect)
- [CVE-2026-42097](https://cve.now/CVE-2026-42097.md): Authentication Bypass in Sparx Pro Cloud Server (CVSS 9.3, Sparx Systems Pro Cloud Server)
- [CVE-2026-42096](https://cve.now/CVE-2026-42096.md): Broken Access Control in Sparx Pro Cloud Server (CVSS 8.7, Sparx Systems Pro Cloud Server)
- [CVE-2026-23558](https://cve.now/CVE-2026-23558.md): grant table v2 race in status page mapping (CVSS 7.8, Xen)
- [CVE-2026-23557](https://cve.now/CVE-2026-23557.md): Xenstored DoS via XS\_RESET\_WATCHES command (CVSS 6.5, Xen)
- [CVE-2026-8975](https://cve.now/CVE-2026-8975.md): Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8974](https://cve.now/CVE-2026-8974.md): Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8973](https://cve.now/CVE-2026-8973.md): Memory safety bugs fixed in Thunderbird 151 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8972](https://cve.now/CVE-2026-8972.md): Privilege escalation in the WebRTC: Audio/Video component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8971](https://cve.now/CVE-2026-8971.md): Same-origin policy bypass in the Networking: JAR component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8970](https://cve.now/CVE-2026-8970.md): Privilege escalation in the Security component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8969](https://cve.now/CVE-2026-8969.md): Mitigation bypass in the DOM: Security component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8968](https://cve.now/CVE-2026-8968.md): Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8967](https://cve.now/CVE-2026-8967.md): Information disclosure in the Graphics: WebGPU component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8966](https://cve.now/CVE-2026-8966.md): Information disclosure in the IP Protection component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8965](https://cve.now/CVE-2026-8965.md): Information disclosure in the DOM: Security component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8964](https://cve.now/CVE-2026-8964.md): Spoofing issue in the Popup Blocker component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8963](https://cve.now/CVE-2026-8963.md): Spoofing issue in the Web Speech component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8962](https://cve.now/CVE-2026-8962.md): Mitigation bypass in the DOM: Security component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8961](https://cve.now/CVE-2026-8961.md): Spoofing issue in the Form Autofill component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8960](https://cve.now/CVE-2026-8960.md): Spoofing issue in WebExtensions (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8959](https://cve.now/CVE-2026-8959.md): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8958](https://cve.now/CVE-2026-8958.md): Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVSS 8.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8957](https://cve.now/CVE-2026-8957.md): Privilege escalation in the Enterprise Policies component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8956](https://cve.now/CVE-2026-8956.md): Integer overflow in the Networking: JAR component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8955](https://cve.now/CVE-2026-8955.md): Privilege escalation in the DOM: Workers component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8954](https://cve.now/CVE-2026-8954.md): Incorrect boundary conditions, integer overflow in the Audio/Video component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8953](https://cve.now/CVE-2026-8953.md): Sandbox escape due to use-after-free in the Disability Access APIs component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8952](https://cve.now/CVE-2026-8952.md): Privilege escalation in the Application Update component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8951](https://cve.now/CVE-2026-8951.md): Spoofing issue in the Toolbar component in Firefox for Android (CVSS 6.5, Mozilla Firefox)
- [CVE-2026-8950](https://cve.now/CVE-2026-8950.md): Same-origin policy bypass in the Networking: HTTP component (CVSS 9.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8949](https://cve.now/CVE-2026-8949.md): Integer overflow in the Widget: Win32 component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8948](https://cve.now/CVE-2026-8948.md): Same-origin policy bypass in the DOM: Networking component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8947](https://cve.now/CVE-2026-8947.md): Use-after-free in the DOM: Bindings (WebIDL) component (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8946](https://cve.now/CVE-2026-8946.md): Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-8945](https://cve.now/CVE-2026-8945.md): Sandbox escape in Firefox and Firefox Focus for Android (CVSS 7.5, Mozilla Firefox)
- [CVE-2026-47323](https://cve.now/CVE-2026-47323.md): Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering (CVSS 9.8, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-4883](https://cve.now/CVE-2026-4883.md): Piotnet Forms \<= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload (CVSS 9.8, Piotnet Forms)
- [CVE-2026-8912](https://cve.now/CVE-2026-8912.md): Contest Gallery \<= 28.1.6 - Unauthenticated SQL Injection (CVSS 7.5, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2026-7860](https://cve.now/CVE-2026-7860.md): Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build (CVSS 1.6, vaadin flow · com.vaadin:flow-plugins +2)
- [CVE-2026-7571](https://cve.now/CVE-2026-7571.md): Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data (CVSS 7.1, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-7507](https://cve.now/CVE-2026-7507.md): Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover (CVSS 7.5, Red Hat build of Keycloak · Red Hat Single Sign-On +2)
- [CVE-2026-7504](https://cve.now/CVE-2026-7504.md): Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak (CVSS 8.1, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-45442](https://cve.now/CVE-2026-45442.md): WordPress Presto Player plugin \<= 4.1.3 - Broken Access Control vulnerability (CVSS 4.3, Brainstorm Force Presto Player)
- [CVE-2026-37982](https://cve.now/CVE-2026-37982.md): Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay (CVSS 6.8, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-37979](https://cve.now/CVE-2026-37979.md): Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass (CVSS 6.5, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-37978](https://cve.now/CVE-2026-37978.md): Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api (CVSS 4.9, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-7307](https://cve.now/CVE-2026-7307.md): Keycloak: keycloak: denial of service via specially crafted saml input (CVSS 7.5, keycloak · Red Hat build of Keycloak +3)
- [CVE-2026-43493](https://cve.now/CVE-2026-43493.md): crypto: pcrypt - Fix handling of MAY\_BACKLOG requests (CVSS 9.8, Linux)
- [CVE-2026-43492](https://cve.now/CVE-2026-43492.md): lib/crypto: mpi: Fix integer underflow in mpi\_read\_raw\_from\_sgl() (no CVSS, Linux)
- [CVE-2026-43491](https://cve.now/CVE-2026-43491.md): net: qrtr: ns: Limit the maximum server registration per node (no CVSS, Linux)
- [CVE-2026-37981](https://cve.now/CVE-2026-37981.md): Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint (CVSS 4.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-4630](https://cve.now/CVE-2026-4630.md): Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference (CVSS 6.8, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-46586](https://cve.now/CVE-2026-46586.md): Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution (CVSS 8.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-45434](https://cve.now/CVE-2026-45434.md): Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE (CVSS 9.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-45187](https://cve.now/CVE-2026-45187.md): Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs (CVSS 6.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-41919](https://cve.now/CVE-2026-41919.md): Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction (CVSS 9.1, Apache Software Foundation Apache OFBiz)
- [CVE-2026-35086](https://cve.now/CVE-2026-35086.md): Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services (CVSS 6.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-31986](https://cve.now/CVE-2026-31986.md): Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection (CVSS 9.1, Apache Software Foundation Apache OFBiz)
- [CVE-2026-31910](https://cve.now/CVE-2026-31910.md): Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access (CVSS 7.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-31909](https://cve.now/CVE-2026-31909.md): Apache OFBiz: Unauthenticated Shipment Label Image Disclosure (CVSS 7.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-31906](https://cve.now/CVE-2026-31906.md): Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters (CVSS 6.1, Apache Software Foundation Apache OFBiz)
- [CVE-2026-31388](https://cve.now/CVE-2026-31388.md): Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature (CVSS 5.3, Apache Software Foundation Apache OFBiz)
- [CVE-2026-31387](https://cve.now/CVE-2026-31387.md): Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation (CVSS 5.3, Apache Software Foundation Apache OFBiz)
- [CVE-2026-46725](https://cve.now/CVE-2026-46725.md): Remote Code Execution in extension "Content Element Selector" (ceselector) (CVSS 9.2, TYPO3 Extension "Content Element Selector" · mmc/ceselector)
- [CVE-2026-8827](https://cve.now/CVE-2026-8827.md): SQL Injection in extension "Address List" (tt\_address) (CVSS 8.2, TYPO3 Extension "Address List" · friendsoftypo3/tt-address)
- [CVE-2026-31380](https://cve.now/CVE-2026-31380.md): Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass (CVSS 6.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-46724](https://cve.now/CVE-2026-46724.md): Path Traversal in extension "Faceted Search" (ke\_search) (CVSS 5.9, TYPO3 Extension "Faceted Search" · tpwd/ke\_search)
- [CVE-2026-46723](https://cve.now/CVE-2026-46723.md): Information Disclosure in extension "Faceted Search" (ke\_search) (CVSS 5.9, TYPO3 Extension "Faceted Search" · tpwd/ke\_search)
- [CVE-2026-46722](https://cve.now/CVE-2026-46722.md): XML External Entity Injection in extension "Faceted Search" (ke\_search) (CVSS 5.9, TYPO3 Extension "Faceted Search" · tpwd/ke\_search)
- [CVE-2026-31379](https://cve.now/CVE-2026-31379.md): Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager (CVSS 6.1, Apache Software Foundation Apache OFBiz)
- [CVE-2026-8726](https://cve.now/CVE-2026-8726.md): SQL Injection in extension "News system" (news) (CVSS 8.2, TYPO3 Extension "News system" · georgringer/news)
- [CVE-2026-31378](https://cve.now/CVE-2026-31378.md): Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution (CVSS 6.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-29226](https://cve.now/CVE-2026-29226.md): Apache OFBiz: Low-Privilege SSRF in Content Component (CVSS 7.3, Apache Software Foundation Apache OFBiz)
- [CVE-2026-46721](https://cve.now/CVE-2026-46721.md): Broken Access Control in extension "Frontend User Registration" (sf\_register) (CVSS 6.9, TYPO3 Extension "Frontend User Registration" · evoweb/sf-re…)
- [CVE-2026-29207](https://cve.now/CVE-2026-29207.md): Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component (CVSS 6.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-29220](https://cve.now/CVE-2026-29220.md): Apache OFBiz: Low-Privilege LFI in Content Component (CVSS 6.5, Apache Software Foundation Apache OFBiz)
- [CVE-2026-2611](https://cve.now/CVE-2026-2611.md): Improper Origin Validation in mlflow/mlflow (CVSS 9.6, mlflow/mlflow · mlflow)
- [CVE-2026-8727](https://cve.now/CVE-2026-8727.md): Remote Code Execution in extension "Site Crawler" (crawler) (CVSS 7.1, TYPO3 Extension "Site Crawler" · tomasnorre/crawler)
- [CVE-2026-44408](https://cve.now/CVE-2026-44408.md): Unauthorized access vulnerability in ZTE MU5250 (CVSS 6.3, ZTE MU5250)
- [CVE-2026-4885](https://cve.now/CVE-2026-4885.md): Piotnet Addons for Elementor Pro \<= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload (CVSS 9.8, Piotnet Addons For Elementor Pro)
- [CVE-2026-47317](https://cve.now/CVE-2026-47317.md): Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. (CVSS 5.5, Samsung Open Source Escargot)
- [CVE-2026-47316](https://cve.now/CVE-2026-47316.md): Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. (CVSS 5.5, Samsung Open Source Escargot)
- [CVE-2026-47315](https://cve.now/CVE-2026-47315.md): Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. (CVSS 5.5, Samsung Open Source Escargot)
- [CVE-2026-47314](https://cve.now/CVE-2026-47314.md): Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. (CVSS 7.8, Samsung Open Source Escargot)
- [CVE-2026-47313](https://cve.now/CVE-2026-47313.md): Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. (CVSS 5.5, Samsung Open Source Escargot)
- [CVE-2026-8922](https://cve.now/CVE-2026-8922.md): Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services (CVSS 5.4, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-47312](https://cve.now/CVE-2026-47312.md): Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. (CVSS 5.5, Samsung Open Source Escargot)
- [CVE-2026-8830](https://cve.now/CVE-2026-8830.md): Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation (CVSS 4.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2025-15609](https://cve.now/CVE-2025-15609.md): Fortis For WooCommerce \< 1.3.1 - Sensitive API Key Disclosure (CVSS 7.5, Fortis for WooCommerce)
- [CVE-2026-8814](https://cve.now/CVE-2026-8814.md): Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to d (CVSS 6.9, exifreader)
- [CVE-2026-8813](https://cve.now/CVE-2026-8813.md): This affects versions of the package exifreader before 4.39.0. (CVSS 8.7, exifreader)
- [CVE-2026-47311](https://cve.now/CVE-2026-47311.md): Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. (CVSS 7.8, Samsung Open Source Escargot)
- [CVE-2026-47310](https://cve.now/CVE-2026-47310.md): Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. (CVSS 7.8, Samsung Open Source Escargot)
- [CVE-2026-47309](https://cve.now/CVE-2026-47309.md): Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. (CVSS 5.5, Samsung Open Source Escargot)
- [CVE-2026-32994](https://cve.now/CVE-2026-32994.md): The /api/v1/autotranslate.translateMessage endpoint in versions \<8.5.0, \<8.4.2, \<8.3.4, \<8.2.4, \<8.1.5, \<8.0.6, \<7.13.8, and \<7.10.12 allows (CVSS 5.3, Rocket.Chat)
- [CVE-2026-47308](https://cve.now/CVE-2026-47308.md): NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. (CVSS 5.5, Samsung Open Source Walrus)
- [CVE-2026-33565](https://cve.now/CVE-2026-33565.md): kernel\_linux\_common\_modules has a Race Condition vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2026-28733](https://cve.now/CVE-2026-28733.md): filemanagement\_storage\_service has an use after free vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2026-27766](https://cve.now/CVE-2026-27766.md): multimedia\_audio\_framework has a Race Condition vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2026-25850](https://cve.now/CVE-2026-25850.md): filemanagement\_storage\_service has an improper preservation of permissions vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2026-25781](https://cve.now/CVE-2026-25781.md): kernel\_liteos\_a has an out-of-bounds write vulnerability (CVSS 8.4, OpenHarmony)
- [CVE-2026-28751](https://cve.now/CVE-2026-28751.md): filemanagement\_storage\_service has an improper input validation vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2026-27781](https://cve.now/CVE-2026-27781.md): kernel\_liteos\_a has an integer overflow vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2026-27648](https://cve.now/CVE-2026-27648.md): web\_webview has an out-of-bounds write vulnerability (CVSS 8.8, OpenHarmony)
- [CVE-2026-25110](https://cve.now/CVE-2026-25110.md): Sensors\_medical\_sensor has a NULL pointer dereference vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2026-24792](https://cve.now/CVE-2026-24792.md): web\_webview has a Race Condition vulnerability (CVSS 8.1, OpenHarmony)
- [CVE-2026-47307](https://cve.now/CVE-2026-47307.md): NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssemb (CVSS 5.5, Samsung Open Source Walrus)
- [CVE-2026-33514](https://cve.now/CVE-2026-33514.md): Discourse: Information Disclosure in Form Template API Due to Missing Authorization (CVSS 6.0, discourse)
- [CVE-2026-33234](https://cve.now/CVE-2026-33234.md): AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server (CVSS 5.0, Significant-Gravitas AutoGPT)
- [CVE-2026-33233](https://cve.now/CVE-2026-33233.md): AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries (CVSS 7.6, Significant-Gravitas AutoGPT)
- [CVE-2026-33232](https://cve.now/CVE-2026-33232.md): AutoGPT: Unauthenticated DoS via Disk Space Exhaustion (CVSS 7.5, Significant-Gravitas AutoGPT)
- [CVE-2026-33052](https://cve.now/CVE-2026-33052.md): MantisBT: Authorization Bypass in Global Profile Creation (CVSS 5.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-32323](https://cve.now/CVE-2026-32323.md): Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer (CVSS 7.3, mullvadvpn-app)
- [CVE-2026-32244](https://cve.now/CVE-2026-32244.md): Discourse: Cached outdated summaries can leak removed content (CVSS 5.3, discourse)
- [CVE-2025-51427](https://cve.now/CVE-2025-51427.md): An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration fil (CVSS 7.3, modelscope)
- [CVE-2025-70950](https://cve.now/CVE-2025-70950.md): An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request. (CVSS 7.3, github.com/itang/gohttp)
- [CVE-2026-30117](https://cve.now/CVE-2026-30117.md): scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar\_url query parameter of the Scalar Pr (CVSS 9.8)
- [CVE-2026-30118](https://cve.now/CVE-2026-30118.md): scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar\_url query parameter of the Scalar Proxy en (CVSS 9.8)
- [CVE-2026-31069](https://cve.now/CVE-2026-31069.md): BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. (CVSS 8.8, billabear/billabear)
- [CVE-2026-31070](https://cve.now/CVE-2026-31070.md): The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning (CVSS 9.8)
- [CVE-2026-31071](https://cve.now/CVE-2026-31071.md): API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. (CVSS 9.1)
- [CVE-2026-31072](https://cve.now/CVE-2026-31072.md): The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RC (CVSS 9.8, apscheduler)
- [CVE-2026-34883](https://cve.now/CVE-2026-34883.md): An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors. (CVSS 5.3)
- [CVE-2026-36827](https://cve.now/CVE-2026-36827.md): A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. (CVSS 5.4)
- [CVE-2026-36828](https://cve.now/CVE-2026-36828.md): A command injection vulnerability exists in the /cgi-bin/tools/ajax\_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. (CVSS 8.8)
- [CVE-2026-36829](https://cve.now/CVE-2026-36829.md): An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. (CVSS 9.8)
- [CVE-2026-37281](https://cve.now/CVE-2026-37281.md): An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to exec (CVSS 9.8)
- [CVE-2026-39250](https://cve.now/CVE-2026-39250.md): An authorization vulnerability exists in Innoshop 0.6.0. (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.