Skip to content
OpenAdvisories

Archive

3 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /3 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.3
    CVE-2026-7711

    MindsDB Engine proc_wrapper.py exec unrestricted upload

    A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack …

    mindsdb PyPI
  • High 7.3
    CVE-2026-7710

    YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication

    A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the file JwtAuthenticationTokenFilter.java of the component Ruoyi-Vue-Pro. Performing a manipulation of the argument mock-token results in imp…

    YunaiV yudao-cloud
  • High 7.3
    CVE-2026-7703

    AV Stumpfl Pixera Two Media Server Websocket API code injection

    A flaw has been found in AV Stumpfl Pixera Two Media Server up to 25.2 R2. Impacted is an unknown function of the component Websocket API. This manipulation causes code injection. The attack can be initiated remotely. The exploit has been published and may be…

    AV Stumpfl Pixera Two Media Server
  • High 7.3
    CVE-2026-7698

    Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection

    A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Affected by this vulnerability is an unknown functionality of the file /Easy7/rest/systemInfo/updateDbBackupInfo. Such manipulation of the argument week leads to os command …

    Tiandy Easy7 Integrated Management Platform
  • High 7.3
    CVE-2026-7695

    Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform elecMaxMinAvgValue sql injection

    A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This affects an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. The manipulation of the argument fCircuitids leads …

    Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform
  • High 7.3
    CVE-2026-7694

    Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injection

    A flaw has been found in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0. The impacted element is an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. Executing a manipulation of the argument fCircuit…

    Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System
  • High 8.8
    CVE-2026-7685

    Edimax BR-6208AC setWAN buffer overflow

    A vulnerability was detected in Edimax BR-6208AC up to 1.02. Affected is an unknown function of the file /goform/setWAN. Performing a manipulation of the argument pptpDfGateway  results in buffer overflow. The attack may be initiated remotely. The exploit is …

    Edimax BR-6208AC
  • High 8.8
    CVE-2026-7684

    Edimax BR-6428nC setWAN buffer overflow

    A security vulnerability has been detected in Edimax BR-6428nC up to 1.16. This impacts an unknown function of the file /goform/setWAN. Such manipulation of the argument pptpDfGateway  leads to buffer overflow. The attack can be launched remotely. The exploit…

    Edimax BR-6428nC
  • High 7.2
    CVE-2026-5063

    NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names

    The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via POST parameter key names in the submit_nex_form() function in versions up to, and including, 9.1.11 due to insufficient input sanitizatio…

    webaways NEX-Forms – Ultimate Forms Plugin for WordPress Web / CMS
  • High 7.3
    CVE-2026-7679

    YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication

    A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulati…

    YunaiV yudao-cloud
  • High 8.8
    CVE-2026-7675

    Shenzhen Libituo Technology LBT-T300-HW1 apply.cgi start_lan buffer overflow

    A vulnerability has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. Impacted is the function start_lan of the file /apply.cgi. The manipulation of the argument Channel/ApCliSsid leads to buffer overflow. The attack is possible to be carrie…

    Shenzhen Libituo Technology LBT-T300-HW1
  • High 8.8
    CVE-2026-7674

    Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflow

    A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to…

    Shenzhen Libituo Technology LBT-T300-HW1