CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation4.6 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)3.5 Low
- openwebui open webui, open-webui +1 moreOpen WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image7.4 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions8.7 High
- pyloadpyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory6.5 Medium
ha-mcpPyPIHome Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/6.5 Medium- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS via the HTML renedering view7.7 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file8.1 High
- electermelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark9.4 Critical
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored Cross-Site Scripting In Profile Picture5.4 Medium
- kumahq kumaKuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin5.1 Medium
- kong inc. meshKong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin5.1 Medium
- universal-tool-calling-protocol python-utcppython-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol8.3 High
- universal-tool-calling-protocol python-utcppython-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection7.7 High
- theonedev onedevOneDev: Path Traversal (read capability via Git LFS pointer resolution)7.1 High
- saitoha libsixellibsixel: integer overflow in parser7.1 High
- saitoha libsixellibsixel: integer overflow in encoder7.4 High
- saitoha libsixellibsixel: NULL pointer dereference2.5 Low
- google chromeUse after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker...8.8 High
- google chromeInappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a...5.5 Medium
- google chromeInappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a...7.5 High
- google chromeInappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a...4.2 Medium
- google chromeInsufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168...5.3 Medium
- google chromeObject lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker...5.3 Medium
- google chromeUse after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to...8.8 High
- google chromeUse after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to...9.6 Critical
- google chromeInsufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168...3.1 Low
- google chromeOut of bounds read in GPU in Google Chrome on Linux prior to 148.0.7778.168 allowed a remote...3.1 Low
- google chromeInteger overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to...8.8 High
- google chromeInappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778...4.3 Medium
- google chromeUse after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had...8.3 High
- google chromeUse after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote...8.3 High
- google chromeInteger overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote...8.3 High
- google chromeInsufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168...3.1 Low
- google chromeInsufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168...8.3 High
- google chromeType Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain...6.5 Medium
- google chromeOut of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote...8.3 High
- google chromeInteger overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote...4.3 Medium
- google chromeInsufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168...4.3 Medium
- google chromeInappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed...4.7 Medium
- google chromeIncorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168...4.2 Medium
- google chromeInsufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778...4.3 Medium
- google chromeSide-channel information leakage in Navigation in Google Chrome prior to 148.0.7778.168 allowed a...4.3 Medium
- google chromeIncorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote...5.4 Medium
- google chromeHeap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168...4.3 Medium
- google chromeInteger overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168...4.3 Medium
- google chromeUse after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote...7.5 High
- google chromeInappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed...3.1 Low
- google chromeUse after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote...8.8 High
- Show moreLoading…