Skip to content
OpenAdvisories

Archive

27 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /27 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-44590 Public exploit

    Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml

    Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull_request_target trigger. Any GitHub user can execute arbitr…

    sherlock-project sherlock sherlock Ubuntu
  • Medium 6.3
    CVE-2026-42879 Public exploit

    FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

    FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a P…

    NeoRazorX facturascripts facturascripts/facturascripts Packagist
  • Critical 10.0
    CVE-2026-45087 Public exploit

    Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

    Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly…

    hahwul dalfox github.com/hahwul/dalfox github.com/hahwul/dalfox/v2 Go
  • Medium 5.4
    CVE-2026-4390 Public exploit

    TeamSpeak 3 Server Connection State Management process_resend_queue use after free

    A weakness has been identified in TeamSpeak 3 Server up to 3.13.7. This affects the function process_resend_queue of the component Connection State Management. This manipulation causes use after free. The attack may be initiated remotely. Upgrading to version…

  • Critical 9.8
    CVE-2026-42758 Public exploit

    WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Privilege Escalation.This issue affects WebinarIgnition: from n/a through < 4.08.253.

    Saleswonder Team: Tobias WebinarIgnition
  • Critical 10.0
    CVE-2026-8054 Public exploit Scanner template

    Unauthenticated SQL Injection in dotCMS Publish Audit API

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated atta…

    dotCMS dotCMS Core
  • High 8.8
    CVE-2026-8832 Public exploit

    WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost

    The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a…

    smub WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager Web / CMS
  • High 7.3
    CVE-2026-48962 Public exploit

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() …

    PMQS IO::Compress perl perl Debian Ubuntu Azure Linux Alpine
  • High 7.8
    CVE-2025-69600 Public exploit

    Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execu…

  • High 7.3
    CVE-2026-38426 Public exploit

    Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary co…

  • High 7.8
    CVE-2026-38945 Public exploit

    Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary co…

  • High 7.3
    CVE-2026-38422 Public exploit

    Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary co…

  • High 7.3
    CVE-2026-38427 Public exploit

    An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buff…

  • High 7.3
    CVE-2026-36539 Public exploit

    Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the entire router configu…

  • High 7.3
    CVE-2026-31266 Public exploit

    Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrat…

  • Medium 6.3
    CVE-2026-30498 Public exploit

    A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.

  • Low 3.1
    CVE-2026-49009 Public exploit

    Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.