Skip to content
OpenAdvisories

Archive

19 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /19 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-45585 Public exploit

    Windows BitLocker Security Feature Bypass Vulnerability

    Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CV…

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
  • Critical 10.0
    CVE-2026-34234 Public exploit Scanner template

    CtrlPanel: Unauthenticated RCE using installer script

    CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only aft…

    Ctrlpanel-gg panel
  • High 8.8
    CVE-2026-32740 Public exploit

    libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

    libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a…

    strukturag libheif libheif libheif Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-6009 Public exploit

    Jaspersoft Library Deserialisation Vulnerability

    Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

    Jaspersoft JasperReports Server Jaspersoft Studio Community Edition JasperReports Library Professional Ubuntu Maven
  • Critical 9.1
    CVE-2026-2586 Public exploit

    GlassFish's Administration Console is Vulnerable to RCE

    An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of t…

    Eclipse Foundation Eclipse Glassfish org.glassfish.main.admingui:console-common org.glassfish.jsftemplating:jsftemplating Maven
  • Critical 9.6
    CVE-2026-2587 Public exploit

    GlassFish's gadget handler is vulnerable to RCE

    A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression…

    Eclipse Foundation Eclipse Glassfish org.glassfish.jsftemplating:jsftemplating org.glassfish.main.admingui:admingui Maven
  • High 7.5
    CVE-2026-47100 Public exploit

    Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX

    Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts…

    FunnelKit Funnel Builder for WooCommerce Checkout Web / CMS
  • High 8.7
    CVE-2026-42096 Public exploit

    Broken Access Control in Sparx Pro Cloud Server

    Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context. The vendor was notified early about thi…

    Sparx Systems Pro Cloud Server
  • Critical 9.8
    CVE-2026-47323 Public exploit EPSS 20%

    Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

    Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilt…

    Apache Software Foundation Apache Camel org.apache.camel:camel-cxf-rest Maven
  • Critical 9.8
    CVE-2026-4883 Public exploit Scanner template

    Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload

    The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to, and including, 2.1.40. The plugin uses an incomplete extension blacklist …

    Piotnet Piotnet Forms Web / CMS
  • High 8.2
    CVE-2026-8726 Public exploit

    SQL Injection in extension "News system" (news)

    The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires th…

    TYPO3 Extension "News system" georgringer/news Packagist
  • Critical 9.8
    CVE-2026-4885 Public exploit

    Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload

    The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension…

    Piotnet Piotnet Addons For Elementor Pro Web / CMS
  • Medium 5.0
    CVE-2026-33234 Public exploit

    AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server

    AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, SendEmailBlock in autogpt_platform/backend/backend/blocks/email_block.py accepts a user-supplied smtp_…

    Significant-Gravitas AutoGPT