Skip to content
OpenAdvisories

Archive

2 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /2 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-7671 Public exploit

    CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication

    A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may …

    CodeWise Tornet Scooter Mobile App
  • Medium 5.6
    CVE-2026-7669 Public exploit

    sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection

    A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote…

    sgl-project SGLang sglang PyPI
  • High 7.5
    CVE-2026-4060 Public exploit Scanner template

    Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter

    The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…

    cyberhobo Geo Mashup Web / CMS
  • Critical 9.8
    CVE-2026-4882 Public exploit

    User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload

    The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthen…

    WPEverest User Registration Advanced Fields Web / CMS
  • Critical 9.8
    CVE-2026-7458 Public exploit

    User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint

    The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_…

    PickPlugins User Verification by PickPlugins Web / CMS