Skip to content
OpenAdvisories

Archive

29 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /29 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-44648 Public exploit

    SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

    SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, st…

    SillyTavern SillyTavern sillytavern npm
  • Medium 5.4
    CVE-2026-9811 Public exploit

    Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector

    A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before inje…

    mautic/core Packagist
  • High 7.6
    CVE-2026-9809 Public exploit

    Mautic has Stored Cross-Site Scripting (XSS) in Projects Component

    A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without pr…

    mautic/core Packagist
  • Critical 9.9
    CVE-2026-9558 Public exploit

    Mautic has Server-Side Template Injection (SSTI) in Theme Templates

    A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated users with permissions to create or upload themes can abuse th…

    mautic/core Packagist
  • High 7.2
    CVE-2025-11262 Public exploit

    Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting

    The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…

    linkwhspr Link Whisper Free Web / CMS
  • Critical 9.8
    CVE-2026-8732 Public exploit Scanner template EPSS 20%

    WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action

    The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protecte…

    Flipper Code WP Maps Pro Web / CMS
  • High 7.3
    CVE-2026-39292 Public exploit

    Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilde…