Skip to content
OpenAdvisories

Archive

5 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /5 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.6
    CVE-2026-35397 Public exploit

    jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

    Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the…

    jupyter-server jupyter_server jupyter-server jupyter-server Debian Ubuntu Alpine PyPI
  • High 7.7
    CVE-2026-25243 Public exploit

    redis-server RESTORE invalid memory access may allow remote code execution

    Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that tr…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.7
    CVE-2026-23479 Public exploit

    redis-server use-after-free in unblock client flow may allow remote code execution

    Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flo…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-3359 Public exploit

    Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'

    The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and…

    10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Web / CMS
  • High 7.5
    CVE-2026-3456 Public exploit

    GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'

    The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied param…

    ahmadgb GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content Web / CMS
  • High 7.7
    CVE-2026-36355 Public exploit

    The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perf…