Skip to content
OpenAdvisories

Archive

7 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /7 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

88 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-6222

    Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter

    The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()` method in `Forminator_Admin_Module_Edit_Page` (admin/abstracts/class-admin-module-edit-page.php) dis…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Medium 5.1
    CVE-2026-40003 Public exploit

    USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM

    ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the …

    ZTE ZX297520V3 BootROM
  • Medium 5.3
    GHSA-x83w-23jp-g6pw

    OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation

    ### Description A flaw was identified in the OpenSearch Security plugin's document-level security (DLS) implementation. DLS restrictions were not correctly applied to search queries that use has_parent or has_child join relations. This could allow an authenti…

    org.opensearch.plugin:opensearch-security Maven
  • Medium 6.1
    CVE-2025-67202

    Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL

    Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.

    sidekiq-cron RubyGems
  • Medium 5.4
    CVE-2026-36388

    A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms…

  • Medium 6.5
    CVE-2026-36387

    A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. Thi…

  • Medium 5.4
    CVE-2026-36341 Public exploit

    Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint

    Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supplied input in the comment field during Activity creation on the /admin/activities/create endpoint

    krayin/laravel-crm Packagist
  • Medium 6.3
    CVE-2026-40214

    OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer

    In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks …

    OpenStack Cyborg cyborg cyborg Debian Ubuntu PyPI