Skip to content
OpenAdvisories

Archive

19 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /19 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.8
    CVE-2026-32740 Public exploit

    libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

    libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a…

    strukturag libheif libheif libheif Debian Ubuntu Alpine
  • High 8.7
    CVE-2026-6009 Public exploit

    Jaspersoft Library Deserialisation Vulnerability

    Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

    Jaspersoft JasperReports Server Jaspersoft Studio Professional JasperReports IO At-Scale Ubuntu Maven
  • High 7.5
    CVE-2026-47100 Public exploit

    Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX

    Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts…

    FunnelKit Funnel Builder for WooCommerce Checkout Web / CMS
  • High 8.7
    CVE-2026-42096 Public exploit

    Broken Access Control in Sparx Pro Cloud Server

    Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context. The vendor was notified early about thi…

    Sparx Systems Pro Cloud Server
  • High 8.2
    CVE-2026-8726 Public exploit

    SQL Injection in extension "News system" (news)

    The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires th…

    TYPO3 Extension "News system" georgringer/news Packagist