Skip to content
OpenAdvisories

Archive

12 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /12 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.2
    CVE-2026-44403 Public exploit

    Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization

    Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can e…

    Wing FTP Server Wing FTP Server
  • High 7.2
    CVE-2026-44246 Public exploit

    nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`

    nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_no…

    MIC-DKFZ nnUNet
  • High 8.6
    CVE-2026-44011 Public exploit

    Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

    Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary command…

    craftcms cms craftcms/cms Packagist
  • High 7.7
    CVE-2026-42141 Public exploit

    Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

    Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permis…

    Xibo Signage xibo-cms
  • High 7.8
    CVE-2026-40369 Public exploit

    Windows Kernel Elevation of Privilege Vulnerability

    Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
  • High 7.8
    CVE-2026-34344 Public exploit

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 8.8
    CVE-2026-8389 Public exploit

    JIT miscompilation in the JavaScript Engine: JIT component

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Wolfi
  • High 8.7
    CVE-2026-5029 Public exploit

    RCE in Code Runner MCP Server

    A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool…

    Code Runner MCP Server Code Runner MCP Server
  • High 7.5
    CVE-2026-8161 Public exploit

    multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception

    multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, t…

    multiparty multiparty node-multiparty node-multiparty Debian Ubuntu npm