14 May 2026

4 results · Clear filters · Feed

• High 8.1
  CVE-2026-42897 Exploited Public exploit EPSS 71%

  Microsoft Exchange Server Spoofing Vulnerability

  Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

  Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14
  May 14, 2026

  KEV May 15, 2026
• High 8.6
  CVE-2026-20224 Public exploit

  Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability

  A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials. …

  Cisco Cisco Catalyst SD-WAN Manager Network devices
  May 14, 2026
• High 8.8
  CVE-2026-42559 Public exploit

  RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

  RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious publ…

  Model Context Protocol rust-sdk zed nushell Wolfi npm crates.io
  May 14, 2026
• High 8.8
  CVE-2026-6475 Public exploit

  PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

  Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after t…

  postgresql15 postgresql-15 postgresql16 postgresql-9.3 Debian Ubuntu Azure Linux Alpine
  May 14, 2026