Skip to content
OpenAdvisories

Archive

18 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /18 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2026-30950 Public exploit

    AutoGPT has Authenticated Session Hijacking via IDOR

    AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are vulnerable to Authenticated Session Hijacking via IDOR. If an authenticated attacker can determine th…

    Significant-Gravitas AutoGPT
  • Critical 9.8
    CVE-2026-8838 Public exploit

    Remote Code Execution via eval() Injection in amazon-redshift-python-driver

    Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should up…

    AWS Amazon Redshift connector for Python airflow-3 redshift-connector Wolfi PyPI
  • Critical 10.0
    CVE-2026-45829 Public exploit EPSS 15%

    ChromaDB Python project has a pre-authentication code injection vulnerability

    A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the…

    Chroma ChromaDB open-webui chromadb Wolfi PyPI
  • Medium 6.5
    CVE-2026-20685 Public exploit

    An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addre…

    Apple Private Cloud Compute Server Software
  • High 8.6
    CVE-2026-6379 Public exploit

    WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter

    The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

    Web / CMS
  • Medium 5.3
    CVE-2026-36438 Public exploit

    An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information…