Skip to content
OpenAdvisories

Archive

May 2026

Vulnerabilities first published in this month (UTC), newest first.

← April 2026 2026 / May June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

134 results · Clear filters · Feed

  • High 7.5
    CVE-2026-3359 Public exploit

    Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'

    The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions up to, and including, 1.15.42 due to insufficient escaping on the user supplied parameter and…

    10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Web / CMS
  • High 7.5
    CVE-2026-3456 Public exploit

    GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'

    The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied param…

    ahmadgb GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content Web / CMS
  • High 7.7
    CVE-2026-36355 Public exploit

    The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perf…

  • High 7.8
    CVE-2026-7791 Public exploit

    Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent

    Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary locations bypassing fil…

    amazon Workspaces
  • High 8.1
    CVE-2026-42221 Public exploit Scanner template

    nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

    Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window. The public /…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 7.5
    CVE-2026-42154 Public exploit

    Prometheus: remote read endpoint allows denial of service via crafted snappy payload

    Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An…

    prometheus prometheus k8sgpt minio Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.8
    CVE-2026-0073 Public exploit

    In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic er…

    Google Android Android
  • High 8.8
    CVE-2026-23918 Public exploit EPSS 50%

    Apache HTTP Server: http2: double free and possible RCE on early reset

    Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2026-24072 Public exploit

    Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

    An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • High 7.2
    CVE-2026-38751 Public exploit

    OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality

    OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)

    devcode-it/openstamanager Packagist
  • High 7.5
    CVE-2026-4060 Public exploit Scanner template

    Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter

    The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…

    cyberhobo Geo Mashup Web / CMS
  • High 8.8
    CVE-2026-31717 Public exploit

    ksmbd: validate owner of durable handle on reconnect

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate owner of durable handle on reconnect Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-31694 Public exploit

    fuse: reject oversized dirents in page cache

    In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-42471 Public exploit

    Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client (Connection.php:76) ca…