Skip to content
OpenAdvisories

Archive

6 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /6 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-40281 Public exploit Scanner template

    Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

    Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the Ex…

    gotenberg gotenberg github.com/gotenberg/gotenberg/v7 github.com/gotenberg/gotenberg/v8 Go
  • High 8.7
    CVE-2026-0300 Exploited Public exploit EPSS 42%

    PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

    A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
    KEV May 6, 2026
  • High 8.8
    CVE-2026-7899 Public exploit

    Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitra…

    Google Chrome chromium chromium Browsers Debian Alpine Wolfi
  • High 7.5
    CVE-2026-23870 Public exploit

    Facebook React has a Denial of Service Vulnerability in React Server Components

    A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-do…

    Meta react-server-dom-turbopack react-server-dom-webpack react-server-dom-parcel npm
  • Medium 6.4
    CVE-2026-20169 Public exploit

    Cisco IoT Field Network Director Command Injection Vulnerability

    A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to access files and execute commands on a remote router. This vulnerability is due to insufficient inpu…

    Cisco Cisco IoT Field Network Director (IoT-FND) Network devices
  • High 7.8
    CVE-2026-43074 Public exploit

    eventpoll: defer struct eventpoll free to RCU grace period

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2026-34473 Public exploit

    Unauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, …

  • High 7.5
    CVE-2026-34474 Public exploit EPSS 25%

    Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to…

  • Medium 5.4
    CVE-2026-36358 Public exploit

    Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a cra…