Skip to content
OpenAdvisories

Archive

12 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /12 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-41901 Exploited Public exploit

    Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

    Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the exec…

    thymeleaf thymeleaf org.thymeleaf:thymeleaf-spring5 org.thymeleaf:thymeleaf Maven
  • Critical 9.4
    CVE-2026-44262 Public exploit Scanner template

    Scramble: Remote code execution via evaluation of user-controlled input in validation rules

    Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation gen…

    dedoc scramble dedoc/scramble Packagist
  • Critical 9.3
    CVE-2026-44225 Public exploit

    Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files

    Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to …

    enesgkky Pulpy
  • Critical 9.1
    CVE-2026-29204 Public exploit

    Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using anot…

    WebPros WHMCS
  • Critical 9.6
    CVE-2026-42048 Public exploit

    Langflow: Path Traversal in Langflow Knowledge Bases API

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are con…

    langflow-ai langflow langflow PyPI
  • Critical 9.8
    CVE-2026-41096 Public exploit

    Windows DNS Client Remote Code Execution Vulnerability

    Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
  • Critical 9.8
    CVE-2026-41089 Public exploit EPSS 78%

    Windows Netlogon Remote Code Execution Vulnerability

    Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows
  • Critical 9.1
    CVE-2026-44277 Public exploit

    A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthentica…

    Fortinet FortiAuthenticator Network devices
  • Critical 9.1
    CVE-2026-43515 Public exploit

    Apache Tomcat: Security constraints not correctly applied

    Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…

    Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Critical 9.8
    CVE-2026-43512 Public exploit

    Apache Tomcat: Digest authenticator will authenticate any unknown user

    DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…

    Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Critical 9.8
    CVE-2026-41293 Public exploit

    Apache Tomcat: HTTP/2 request headers not validated

    Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also …

    Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Critical 9.1
    CVE-2026-45091 Public exploit

    sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

    sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unse…

    davidalmeidac sealed-env sealed-env io.github.davidalmeidac:sealed-env-core npm Maven
  • Critical 9.1
    CVE-2026-41551 Public exploit

    A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnera…

    Siemens ROS# ICS / OT
  • Critical 9.6
    CVE-2026-45321 Exploited · Ransomware Public exploit

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/r…

    TanStack react-start start-server-core solid-start npm
    KEV May 27, 2026
  • Critical 9.8
    CVE-2026-45185 Public exploit

    Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing …

    Exim Exim exim4 exim4 Debian Ubuntu Wolfi