Skip to content
OpenAdvisories

Archive

28 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /28 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-8809 Public exploit

    Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

    The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting…

    hwk-fr Advanced Custom Fields: Extended Web / CMS
  • Critical 9.4
    CVE-2026-44848 Public exploit

    Portainer: Missing authorization on Docker plugin endpoints allows host RCE

    Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, The Docker plugin management end…

    portainer portainer github.com/portainer/portainer Go
  • Critical 9.9
    CVE-2026-9645 Public exploit

    ScadaBR Authenticated Remote Code Execution

    Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

    ScadaBR ScadaBR
  • Critical 9.8
    CVE-2026-46817 Exploited Public exploit EPSS 12%

    Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi…

    Oracle Oracle Payments
    KEV Jul 15, 2026
  • Critical 9.1
    CVE-2026-9090 Public exploit

    CVE-2026-9090

    Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLRes…

    Casdoor Casdoor github.com/casdoor/casdoor Go
  • Critical 9.0
    CVE-2026-4408 Public exploit EPSS 47%

    Samba: remote code execution in samr

    A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controll…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine