Skip to content
OpenAdvisories

Archive

22 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /22 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.8
    CVE-2026-45659 Exploited · Ransomware Public exploit EPSS 80%

    Microsoft SharePoint Remote Code Execution Vulnerability

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

    Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition
    KEV Jul 1, 2026
  • High 8.2
    CVE-2026-5843 Public exploit

    Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading

    The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model's config.json speci…

    Docker Docker Desktop
  • High 8.2
    CVE-2026-5817 Public exploit

    Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends

    The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary P…

    Docker Docker Desktop
  • High 7.6
    CVE-2026-34207 Public exploit

    TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation

    TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostname literals, and literal IP formats. It does not resolve DNS before allowing the request. As a resul…

    baptisteArno typebot.io
  • High 8.1
    CVE-2026-9256 Public exploit EPSS 11%

    NGINX ngx_http_rewrite_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.1
    CVE-2026-9277 Public exploit

    shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

    shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+202…

    code-server tileserver-gl shell-quote node-shell-quote Debian Ubuntu Wolfi npm
  • High 7.3
    CVE-2026-36228 Public exploit

    Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and exec…