CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- eskapism simple history – track, log, and audit wordpress changesSimple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint7.5 High
- ninjew geo my wpGEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters7.5 High
- No product listedOpen5GS Shared NF-profile nnrf-handler.c denial of service5.3 Medium
- cyber-iii student-management-systemsambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting4.8 Medium
- cyber-iii student-management-systemsambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection6.9 Medium
- zephyrproject zephyrcan: Local Denial of Service via SocketCAN Send6.1 Medium
- code-projects student details management systemcode-projects Student Details Management System index.php sql injection6.9 Medium
- cloud-hypervisorCloud Hypervisor: Use-after-free in virtio-block Async I/O Completion8.9 High
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}9.6 Critical
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}8.1 High
- mervinpraison praisonai-platformpraisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOR7.6 High
- mervinpraison praisonai-platformpraisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace issue linking + read + delete IDOR8.1 High
- mervinpraison praisonai-platformpraisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset9.8 Critical
- mervinpraison praisonai-platformPraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership8.8 High
- mervinpraison praisonai-platformPraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID8.8 High
- mervinpraison praisonai-platformPraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation9.4 Critical
- mervinpraison praisonai-platformpraisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership6.5 Medium
- mervinpraison praisonai-platformPraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API8.8 High
- mervinpraison praisonaiPraisonAI has an Arbitrary File Write in Python API7.1 High
- mervinpraison praisonaiPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution9.8 Critical
- mervinpraison praisonaiPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate8.7 High
- mervinpraison praisonai, < 1.6.40 +1 morePraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)9.9 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context5.5 Medium
- mervinpraison praisonaiPraisonAI `deploy --type api` emits a Flask server with authentication disabled by default9.8 Critical
- mervinpraison praisonaiPraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset9.8 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings5.5 Medium
- home-assistant home assistant coreHome Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore9.3 Critical
- mervinpraison praisonaiPraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-443348.1 High
- eidetic-labs stigmemstigmem Federation Peer Registration Authentication Bypass9.1 Critical
- eidetic-labs stigmemstigmem Plugin Signature Enforcement Bypass via Configuration7.3 High
- eidetic-labs stigmemstigmem-node Insecure Federation Transport Configuration9.1 Critical
- eidetic-labs stigmemstigmem Postgres SQL Injection via Schema Identifier7.5 High
- eidetic-labs stigmemstigmem Federation Peer Token Timestamp Validation Bypass7.1 High
- eidetic-labs stigmemstigmem before 0.9.0a2 Authentication Bypass via Disabled Auth9.2 Critical
- nezhahq nezhaNezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host6.4 Medium
- admidioAdmidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #20246.5 Medium
- admidioAdmidio writes session IDs and auto-login cookie values to application logs4.4 Medium
- admidioAdmidio PKCS#12 private key export action lacks CSRF protection4.3 Medium
- admidioAdmidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders8.1 High
- admidioAdmidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders6.5 Medium
- admidioAdmidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation5.4 Medium
- admidioAdmidio's CSRF in registration `send_login` mode resets arbitrary user passwords5.2 Medium
- admidioAdmidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`6.5 Medium
- admidioAdmidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges6.5 Medium
- boxlite-ai boxliteBoxLite: Timeout Bypass Vulnerability6.5 Medium
- sensiolabs symfony, symfony twilio-notifier +1 moreSymfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection6.9 Medium
- q00 ouroborosOuroboros: Remote Code Execution via Untrusted Project-Directory .env8.4 High
- autheliaAuthelia Missing Username Canonicalization in Basic Auth (LDAP)2.9 Low
- extreme networks platform oneExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition6.3 Medium
- goauthentik authentikauthentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user8.5 High
- Show moreLoading…