Skip to content
OpenAdvisories

Archive

20 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /20 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-9082 Exploited Public exploit Scanner template EPSS 89%

    Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, fr…

    Drupal Drupal core drupal/core Web / CMS Packagist
    KEV May 22, 2026
  • Critical 10.0
    CVE-2026-20223 Public exploit

    Cisco Secure Workload Unauthorized API Access Vulnerability

    A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role. This vulnerability is due to insufficient va…

    Cisco Cisco Secure Workload Network devices
  • Critical 9.5
    CVE-2026-8467 Public exploit

    Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

    Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation. The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.Pl…

    phenixdigital phoenix_storybook phoenix_storybook Hex
  • Medium 5.3
    CVE-2026-5950 Public exploit

    Unbounded resend loop in BIND 9 resolver

    An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-45584 Public exploit

    Microsoft Defender Remote Code Execution Vulnerability

    Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.

    Microsoft Microsoft Malware Protection Engine
  • High 7.8
    CVE-2026-41091 Exploited Public exploit

    Microsoft Defender Elevation of Privilege Vulnerability

    Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

    Microsoft Microsoft Malware Protection Engine
    KEV May 20, 2026
  • Medium 4.0
    CVE-2026-45498 Exploited Public exploit EPSS 63%

    Microsoft Defender Denial of Service Vulnerability

    Microsoft Defender Denial of Service Vulnerability

    Microsoft Microsoft Defender Antimalware Platform
    KEV May 20, 2026
  • Critical 9.8
    CVE-2026-24207 Public exploit Scanner template

    NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succe…

    NVIDIA Triton Inference Server
  • High 7.5
    CVE-2026-39047 Public exploit

    Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Pri…

  • Medium 6.1
    CVE-2026-30691 Public exploit

    @cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode

    Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode

    @cyntler/react-doc-viewer npm