Skip to content
OpenAdvisories

Archive

5 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /5 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.6
    CVE-2026-35397 Public exploit

    jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

    Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the…

    jupyter-server jupyter_server jupyter-server jupyter-server Debian Ubuntu Alpine PyPI
  • Medium 5.3
    CVE-2026-32699 Public exploit

    FacturaScripts unauthorized modification of immutable nick field via EditUser controller

    FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Critical 9.8
    CVE-2026-27960 Public exploit Scanner template

    OpenCTI privilege escalation and unauthenticated access via default admin account

    OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any exi…

    OpenCTI-Platform opencti pycti PyPI
  • High 7.7
    CVE-2026-25243 Public exploit

    redis-server RESTORE invalid memory access may allow remote code execution

    Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that tr…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.1
    CVE-2026-23631 Public exploit

    redis-server Lua use-after-free may allow remote code execution

    Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or c…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.7
    CVE-2026-23479 Public exploit

    redis-server use-after-free in unblock client flow may allow remote code execution

    Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flo…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-3359 Public exploit

    Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'

    The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and…

    10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Web / CMS
  • High 7.5
    CVE-2026-3456 Public exploit

    GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'

    The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied param…

    ahmadgb GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content Web / CMS
  • Critical 9.1
    CVE-2026-36356 Public exploit EPSS 20%

    The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthentic…

  • High 7.7
    CVE-2026-36355 Public exploit

    The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perf…