Skip to content
OpenAdvisories

Archive

1 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /1 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Unscored —
    CVE-2026-31721 Public exploit

    usb: gadget: f_hid: move list and spinlock inits from bind to alloc

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: move list and spinlock inits from bind to alloc There was an issue when you did the following: - setup and bind an hid gadget - open /dev/hidg0 - use the resulting fd in E…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-31720 Public exploit

    usb: gadget: f_uac1_legacy: validate control request size

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate control request size f_audio_complete() copies req->length bytes into a 4-byte stack variable: u32 data = 0; memcpy(&data, req->buf, req->length); req->le…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-31717 Public exploit

    ksmbd: validate owner of durable handle on reconnect

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate owner of durable handle on reconnect Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-31694 Public exploit

    fuse: reject oversized dirents in page cache

    In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-3143 Public exploit

    Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation

    The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_cli_cancel' function in all versions up to, and including, …

    Bold Grid Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Web / CMS
  • Critical 9.8
    CVE-2026-42778 Public exploit

    Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)

    The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deseri…

    Apache Software Foundation Apache MINA apache-nifi jenkins-2-openjdk-21 Ubuntu Wolfi Maven
  • Critical 9.8
    CVE-2026-42779 Public exploit

    Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)

    The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the cl…

    Apache Software Foundation Apache MINA apache-nifi jenkins-2-openjdk-21 Ubuntu Wolfi Maven
  • Critical 9.8
    CVE-2026-7567 Public exploit

    Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover

    The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, which fails to verify that the 'temp-login-token' GET…

    elemntor Temporary Login Web / CMS
  • Medium 6.1
    CVE-2025-69606 Public exploit

    Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. The `msg` parameter in …

  • High 8.1
    CVE-2026-42471 Public exploit

    Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client (Connection.php:76) ca…