Skip to content
OpenAdvisories

Archive

7 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /7 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-42880 Public exploit

    ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with r…

    argoproj Argo CD argocd-image-updater github.com/argoproj/argo-cd Wolfi Go
  • Critical 10.0
    CVE-2026-42826 Public exploit

    Azure DevOps Information Disclosure Vulnerability

    Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.

    Microsoft Azure DevOps
  • High 7.0
    CVE-2026-41653 Public exploit

    BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration

    BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may be able to execute arbitrary JavaScript in certain circumstances in Markdown to PDF Tool. This…

    alam00000 bentopdf
  • High 8.3
    CVE-2026-41490 Public exploit

    Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

    Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster libraries version 0.29.1, the DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed S…

    dagster-io dagster dagster dagster-duckdb PyPI
  • Medium 6.8
    CVE-2026-8080 Public exploit

    MISP core - Stored XSS in MISP template (old engine) element attribute type

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute ha…

    MISP MISP
  • Critical 9.8
    CVE-2026-6508 Public exploit

    RCE in TUBITAK BILGEM's Liderahenk

    Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liderahenk: from 2.0.1 before 2.0.2.

    TUBITAK BILGEM Software Technologies Research Institute Liderahenk
  • Critical 9.1
    CVE-2026-40982 Public exploit

    Spring Cloud Config vulnerable to Path Traversal

    Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spri…

    Spring Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven
  • Medium 5.1
    CVE-2026-40003 Public exploit

    USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM

    ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the …

    ZTE ZX297520V3 BootROM
  • Medium 5.4
    CVE-2026-36341 Public exploit

    Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint

    Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint

    krayin/laravel-crm Packagist