Archive
May 2026
Vulnerabilities first published in this month (UTC), newest first.
294 results · Clear filters · Feed
-
High 7.3CVE-2026-48962 Public exploit
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() …
-
High 7.8CVE-2025-69600 Public exploit
Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execu…
-
High 7.3CVE-2026-38426 Public exploit
Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary co…
-
High 7.8CVE-2026-38945 Public exploit
Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary co…
-
High 7.3CVE-2026-38422 Public exploit
Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary co…
-
High 7.3CVE-2026-38427 Public exploit
An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buff…
-
High 7.3CVE-2026-36539 Public exploit
Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the entire router configu…
-
High 7.3CVE-2026-31266 Public exploit
Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrat…
-
Medium 6.3CVE-2026-30498 Public exploit
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.
-
Low 3.1CVE-2026-49009 Public exploit
Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.
-
Medium 6.5
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuil…
KEV Sep 2, 2026 -
Medium 5.9CVE-2026-44788 Public exploit
SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)
SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction …
-
High 8.9CVE-2026-9560 Public exploit
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute…
-
High 8.5CVE-2026-44706 Public exploit
Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values
Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering by a custom attribute of type date or number using the is_greater_than or is_less_than opera…
-
High 7.6CVE-2026-44680 Public exploit
MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) …
-
High 8.6
Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
An improper access check allows unauthorized access to com_config webservice endpoints.
-
Medium 6.5CVE-2026-40564 Public exploit
Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator
Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a u…
-
Critical 9.8
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. A…
KEV Jun 3, 2026 -
High 8.8CVE-2026-46368 Public exploit
luci-app-https-dns-proxy Authenticated Command Injection via setInitAction
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAct…
-
Critical 9.0
Samba: samba: remote code execution in printing subsystem via unescaped job description
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacke…
-
Medium 4.3CVE-2026-36239 Public exploit
PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality
-
Medium 4.4CVE-2026-48849 Public exploit
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored val…
-
High 8.1CVE-2026-48842 Public exploit
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query…
-
Medium 6.8CVE-2026-9490 Public exploit
Acer Care Center creates a Named Pipe with a weak Security Descriptor
A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type…
-
High 7.8CVE-2026-4372 Public exploit
Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers
A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows an attacker to craft a malicious `config.json` file containing the `_attn_implementation_internal` f…
-
High 7.8
net: skbuff: preserve shared-frag marker during coalescing
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain t…
KEV Oct 28, 2026 -
High 8.8CVE-2026-43503 Public exploit
net: skbuff: propagate shared-frag marker through frag-transfer helpers
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shi…
-
High 8.8
Microsoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
KEV Jul 1, 2026 -
Medium 5.4CVE-2026-40864 Public exploit
JupyterHub: Cross-origin form POSTs bypass XSRF
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing …
-
High 8.2CVE-2026-5843 Public exploit
Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading
The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model's config.json speci…
-
High 8.2CVE-2026-5817 Public exploit
Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary P…
-
High 7.6CVE-2026-34207 Public exploit
TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation
TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostname literals, and literal IP formats. It does not resolve DNS before allowing the request. As a resul…
-
High 8.1
NGINX ngx_http_rewrite_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/…
-
Low 2.3CVE-2026-8347 Public exploit
Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog
Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express an…
-
High 8.1CVE-2026-9277 Public exploit
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+202…
-
Critical 10.0CVE-2026-46595 Public exploit
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
-
Critical 10.0
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
KEV Jun 23, 2026 -
Critical 10.0
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS d…
KEV Jun 23, 2026 -
Medium 6.5CVE-2026-36227 Public exploit
Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and …
-
High 7.3CVE-2026-36228 Public exploit
Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and exec…