Skip to content
OpenAdvisories

Archive

9 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /9 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-42601

    ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

    ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as envi…

    ArchiveBox ArchiveBox archivebox PyPI
  • Critical 9.4
    CVE-2026-42569 Public exploit Scanner template

    phpvms: /importer authorization bypass causing full database wipe

    phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.

    phpvms phpvms nabeel/phpvms Packagist
  • Critical 9.0
    CVE-2026-42571

    Privilege Escalation Attack affecting Pelican Web UI

    Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2, there is a a privilege escalation vulnerability affecting Pelican's Web User Interface (…

    PelicanPlatform pelican github.com/pelicanplatform/pelican Go
  • Critical 9.1
    CVE-2026-42560

    auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

    auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the same local user.ID, instead of deriving a unique ID from the…

    go-pkgz auth github.com/go-pkgz/auth/v2 github.com/go-pkgz/auth Go
  • Critical 9.8
    GHSA-v6wj-c83f-v46x

    @profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module

    <html> <body> <!--StartFragment--><html><head></head><body><h1>Security Advisory: OS Command Injection in <code>profullstack/mcp-server</code> <code>domain_lookup</code> Module</h1> Field | Value -- | -- Project | profullstack/mcp-server Repository | https://…

    @profullstack/mcp-server npm