CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- openclaw crabboxCrabbox < v0.12.0 Environment Variable Information Disclosure9.3 Critical
- openclaw crabboxCrabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints8.6 High
- academysoftwarefoundation openimageioOpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release builds8.4 High
- academysoftwarefoundation openimageioOpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width8.4 High
- academysoftwarefoundation openimageioOpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation7.1 High
- academysoftwarefoundation openimageioOpenImageIO: Integer wraparound in bounds check of decode_pixel leads to out-of-bounds read in TGA paletted image decoder5.5 Medium
- academysoftwarefoundation openimageioOpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR)8.3 High
- ethyca fidesFides: DOM-based XSS vulnerability in fides.js via fides_description override7.0 High
- academysoftwarefoundation openimageioOpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder8.8 High
- academysoftwarefoundation openimageioOpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder8.8 High
- academysoftwarefoundation openimageioOpenImageIO: HEIF Heap overflow8.5 High
- livehelperchatLive Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries8.1 High
- openclaw crabboxCrabbox < v0.12.0 Authentication Bypass via Header Spoofing8.7 High
- wavelens gradientGradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning9.4 Critical
- sap netweaver application server abapCSS Injection vulnerability in SAP NetWeaver Application Server ABAP3.1 Low
- midoks mdserver-webmdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')9.3 Critical
- apostrophecms apostropheApostrophe has stored XSS via javascript: URL in Image Widget Link7.3 High
- apostrophecms apostropheApostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation8.1 High
- apostrophecms apostropheApostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget7.6 High
- apostrophecms sanitize-html, red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +27 more +29 moreApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`9.3 Critical
@karakeep/sdknpmKarakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections7.1 High- go-git go-billyBilly: Path traversal vulnerabilities8.1 High
- dbt-labs dbt-mcp, getdbt dbt mcp server +1 moredbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction3.1 Low
- dbt-labs dbt-mcp, getdbt dbt mcp server +1 moredbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled2.5 Low
- dbt-labs dbt-mcp, getdbt dbt mcp server +1 moredbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters6.3 Medium
- siyuan-note siyuanSiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution8.3 High
- badgerati podePode: Directory Traversal is possible on Static Routes6.9 Medium
- yordam information technology consulting, training and electronic systems industry and trade inc. library automation systemRCE in Yordam Informatics' Library Automation System8.8 High
- freedesktop gst-plugins-good, gstreamer good plug-ins +1 moreAn issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio...4.0 Medium
- freedesktop gst-plugins-good, gstreamer good plug-ins +1 moreAn issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio...4.0 Medium
- yordam information technology consulting, training and electronic systems industry and trade inc. library automation systemImproper Access Control in Yordam Informatics' Library Automation System8.8 High
- microsoft authenticator, authenticator for android, authenticator for ios +2 moreMicrosoft Authenticator Information Disclosure Vulnerability9.6 Critical
- microsoft exchange server, microsoft, microsoft exchange server subscription edition +4 more +6 moreMicrosoft Exchange Server Spoofing Vulnerability8.1 High
- schneider electric ecostruxure™ machine expert hvac, schneider-electric ecostruxure machine expert hvac +1 moreClear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC6.8 Medium
- ntop ntopngntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')4.3 Medium
- podofoPoDoFo: Double-free vulnerability in compute_hash_to_sign()2.5 Low
@tanstack/start-server-corenpmTanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function6.3 Medium- lepture mistuneMistune Image Directive CSS Injection Vulnerability4.7 Medium
- lepture mistuneMistune TOC Anchor Injection XSS6.1 Medium
- nextcloud newsNextcloud News: Authenticated blind SSRF via feed URL2.3 Low
- io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 moreopentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation5.3 Medium
- portainerPortainer: Missing authorization on custom template file endpoint exposes template content6.0 Medium
- portainerPortainer: JWT accepted in URL query leaks tokens to logs and referers7.7 High
- portainerPortainer: Endpoint security bypass via Swarm service create/update9.4 Critical
- portainerPortainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorization8.1 High
- portainerPortainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update8.5 High
- portainerPortainer: Bind-mount restriction bypass via HostConfig.Mounts8.5 High
- portainerPortainer: Path traversal in backup archive extraction allows arbitrary file write5.5 Medium
- portainerPortainer: Missing authorization on Docker plugin endpoints allows host RCE9.4 Critical
- flowiseai flowiseFlowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover7.7 High
- Show moreLoading…