Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2026

351 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 4

  • CVE-2026-7567
    40Plan

    Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    elemntor · temporary loginMay 1, 2026

  • CVE-2026-42778
    39Monitor

    Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    apache · minaMay 1, 2026

  • CVE-2026-42779
    39Monitor

    Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    apache · minaMay 1, 2026

  • CVE-2026-31717
    35Monitor

    ksmbd: validate owner of durable handle on reconnect

    HighCVSS 8.8Proof of conceptEPSS 0%

    linux · linux kernelMay 1, 2026

  • CVE-2026-3143
    21Monitor

    Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation

    MediumCVSS 5.3Proof of conceptEPSS 0%

    boldgrid · total upkeep – wordpress backup plugin plus restore & migrate by boldgridMay 1, 2026

  • CVE-2026-31720
    31Monitor

    usb: gadget: f_uac1_legacy: validate control request size

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelMay 1, 2026

  • CVE-2026-31721
    22Monitor

    usb: gadget: f_hid: move list and spinlock inits from bind to alloc

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelMay 1, 2026

  • CVE-2026-42471
    33Monitor

    Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17.

    HighCVSS 8.1Proof of conceptEPSS 1%

    May 1, 2026

  • CVE-2025-69606
    24Monitor

    Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    May 1, 2026

  • CVE-2026-31694
    31Monitor

    fuse: reject oversized dirents in page cache

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelMay 1, 2026

  • CVE-2026-4882
    39Monitor

    User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    wpeverest · user registration advanced fieldsMay 2, 2026

  • CVE-2026-7458
    39Monitor

    User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    pickplugins · user verification by pickpluginsMay 2, 2026

  • CVE-2026-5113
    28Monitor

    Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input

    HighCVSS 7.2No exploitEPSS 0%

    gravity forms · gravity formsMay 2, 2026

  • CVE-2025-14726
    26Monitor

    Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpo

    MediumCVSS 6.5Proof of conceptEPSS 0%

    trustindex · widgets for social photo feedMay 2, 2026

  • CVE-2026-4060
    30Monitor

    Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter

    HighCVSS 7.5Proof of conceptEPSS 1%

    cyberhobo · geo mashupMay 2, 2026

  • CVE-2026-7669
    25Monitor

    sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection

    MediumCVSS 6.3Proof of conceptEPSS 0%

    sgl-project · sglangMay 2, 2026

  • CVE-2026-7671
    11Monitor

    CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication

    LowCVSS 2.9Proof of conceptEPSS 0%

    codewise · tornet scooter mobile appMay 2, 2026

  • CVE-2026-7731
    8Monitor

    code-projects BloodBank Managing System get_state.php sql injection

    LowCVSS 2.1Proof of conceptEPSS 0%

    code-projects · bloodbank managing systemMay 4, 2026

  • CVE-2026-24072
    35Monitor

    Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

    HighCVSS 8.8Proof of conceptEPSS 0%

    apache · http serverMay 4, 2026

  • CVE-2026-7482
    35Monitor

    Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers

    HighCVSS 8.8Proof of conceptEPSS 0%

    ollama · ollamaMay 4, 2026

  • CVE-2026-23918
    50Plan

    Apache HTTP Server: http2: double free and possible RCE on early reset

    HighCVSS 8.8Proof of conceptEPSS 49%

    apache · http serverMay 4, 2026

  • CVE-2026-33006
    19Monitor

    Apache HTTP Server: mod_auth_digest timing attack

    MediumCVSS 4.8Proof of conceptEPSS 0%

    apache · http serverMay 4, 2026

  • CVE-2026-24118
    39Monitor

    VM2 Sandbox Breakout Through __lookupGetter__

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    vm2 project · vm2May 4, 2026

  • CVE-2026-0073
    35Monitor

    In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code.

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · androidMay 4, 2026

  • CVE-2026-42796
    37Monitor

    Arelle < 2.39.10 Unauthenticated RCE via /rest/configure

    CriticalCVSS 9.2Proof of conceptEPSS 3%

    workiva · arelleMay 4, 2026

  • CVE-2026-38751
    28Monitor

    OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiorna

    HighCVSS 7.2Proof of conceptEPSS 0%

    devcode · openstamanagerMay 4, 2026

  • CVE-2026-42154
    30Monitor

    Prometheus: remote read endpoint allows denial of service via crafted snappy payload

    HighCVSS 7.5Proof of conceptEPSS 0%

    prometheus · prometheusMay 4, 2026

  • CVE-2026-42228
    25Monitor

    n8n: Hijacking of Unauthenticated Chat Execution

    MediumCVSS 6.3Proof of conceptEPSS 0%

    n8n · n8nMay 4, 2026

  • CVE-2026-42231
    37Monitor

    n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    n8n · n8nMay 4, 2026

  • CVE-2026-42221
    39Monitor

    nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    nginxui · nginx uiMay 4, 2026

  • CVE-2026-7791
    34Monitor

    Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before

    HighCVSS 8.5Proof of conceptEPSS 0%

    amazon · workspacesMay 4, 2026

  • CVE-2026-3456
    30Monitor

    GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'

    HighCVSS 7.5Proof of conceptEPSS 0%

    ahmadgb · geekybot — ai copilot, chatbot, woocommerce lead gen & zero-prompt contentMay 5, 2026

  • CVE-2026-3359
    30Monitor

    Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'

    HighCVSS 7.5Proof of conceptEPSS 0%

    10web · form maker by 10web – mobile-friendly drag & drop contact form builderMay 5, 2026

  • CVE-2026-36355
    30Monitor

    The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access contro

    HighCVSS 7.7Proof of conceptEPSS 0%

    May 5, 2026

  • CVE-2026-36356
    37Monitor

    The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injec

    CriticalCVSS 9.1Proof of conceptEPSS 3%

    May 5, 2026

  • CVE-2026-23479
    30Monitor

    redis-server use-after-free in unblock client flow may allow remote code execution

    HighCVSS 7.7Proof of conceptEPSS 1%

    redis · redisMay 5, 2026

  • CVE-2026-23631
    25Monitor

    redis-server Lua use-after-free may allow remote code execution

    MediumCVSS 6.1Proof of conceptEPSS 2%

    redis · redisMay 5, 2026

  • CVE-2026-25243
    31Monitor

    redis-server RESTORE invalid memory access may allow remote code execution

    HighCVSS 7.7Proof of conceptEPSS 3%

    redis · redisMay 5, 2026

  • CVE-2026-27960
    60This week

    OpenCTI privilege escalation and unauthenticated access via default admin account

    CriticalCVSS 9.8WeaponizedEPSS 4%

    citeum · openctiMay 5, 2026

  • CVE-2026-32699
    21Monitor

    FacturaScripts unauthorized modification of immutable nick field via EditUser controller

    MediumCVSS 5.3Proof of conceptEPSS 0%

    neorazorx · facturascriptsMay 5, 2026

  • CVE-2026-35397
    30Monitor

    jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

    HighCVSS 7.6Proof of conceptEPSS 0%

    jupyter · jupyter serverMay 5, 2026

  • CVE-2026-40280
    32Monitor

    Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists

    HighCVSS 7.8Proof of conceptEPSS 2%

    thecodingmachine · gotenbergMay 5, 2026

  • CVE-2026-36358
    21Monitor

    Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the Ad

    MediumCVSS 5.4Proof of conceptEPSS 0%

    May 6, 2026

  • CVE-2026-43074
    31Monitor

    eventpoll: defer struct eventpoll free to RCU grace period

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelMay 6, 2026

  • CVE-2026-20169
    25Monitor

    Cisco IoT Field Network Director Command Injection Vulnerability

    MediumCVSS 6.4Proof of conceptEPSS 0%

    cisco · iot field network directorMay 6, 2026

  • CVE-2026-23870
    30Monitor

    A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lea

    HighCVSS 7.5Proof of conceptEPSS 1%

    facebook · react-server-dom-parcelMay 6, 2026

  • CVE-2026-0300
    77This week

    PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

    CriticalCVSS 9.3KEVWeaponizedEPSS 31%

    paloaltonetworks · pan-osMay 6, 2026

  • CVE-2026-34473
    31Monitor

    Unauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A,

    HighCVSS 7.5Proof of conceptEPSS 1%

    May 6, 2026

  • CVE-2026-34474
    31Monitor

    Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6.

    HighCVSS 7.5Proof of conceptEPSS 2%

    May 6, 2026

  • CVE-2026-7899
    35Monitor

    Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sand

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeMay 6, 2026

  • CVE-2026-40281
    37Monitor

    Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    thecodingmachine · gotenbergMay 6, 2026

  • CVE-2026-40003
    27Monitor

    USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM

    MediumCVSS 6.8Proof of conceptEPSS 0%

    zte · zx297520v3 firmwareMay 6, 2026

  • CVE-2026-40982
    36Monitor

    Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module.

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    vmware · spring cloud configMay 7, 2026

  • CVE-2026-41640
    36Monitor

    NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading

    HighCVSS 8.8Proof of conceptEPSS 2%

    nocobase · nocobaseMay 7, 2026

  • CVE-2026-41641
    29Monitor

    NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call

    HighCVSS 7.2Proof of conceptEPSS 2%

    nocobase · nocobaseMay 7, 2026

  • CVE-2026-6508
    39Monitor

    RCE in TUBITAK BILGEM's Liderahenk

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    tubitak bilgem software technologies research institute · liderahenkMay 7, 2026

  • CVE-2026-8080
    27Monitor

    MISP core - Stored XSS in MISP template (old engine) element attribute type

    MediumCVSS 6.8Proof of conceptEPSS 0%

    misp-project · mispMay 7, 2026

  • CVE-2026-41490
    33Monitor

    Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

    HighCVSS 8.3Proof of conceptEPSS 0%

    dagster-io · dagsterMay 7, 2026

  • CVE-2026-36341
    21Monitor

    Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    May 7, 2026

  • CVE-2026-6973
    59Plan

    An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with admin

    HighCVSS 7.2KEVWeaponizedEPSS 2%

    ivanti · endpoint manager mobileMay 7, 2026

  • CVE-2026-41653
    28Monitor

    BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration

    HighCVSS 7.0Proof of conceptEPSS 0%

    alam00000 · bentopdfMay 7, 2026

  • CVE-2026-42826
    30Monitor

    Azure DevOps Information Disclosure Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 1%

    microsoft · azure devopsMay 7, 2026

  • CVE-2026-42880
    38Monitor

    ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    argoproj · argo cdMay 7, 2026

  • CVE-2026-41900
    40Plan

    OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    th30d4y · openlearnxMay 8, 2026

  • CVE-2026-42203
    34Monitor

    LiteLLM: Server-Side Template Injection in /prompts/test endpoint

    HighCVSS 8.6Proof of conceptEPSS 0%

    litellm · litellmMay 8, 2026

  • CVE-2026-42208
    69This week

    LiteLLM: SQL injection in Proxy API key verification

    CriticalCVSS 9.3KEVWeaponizedEPSS 5%

    litellm · litellmMay 8, 2026

  • CVE-2026-42271
    92Now

    LiteLLM: Authenticated command execution via MCP stdio test endpoints

    HighCVSS 8.7KEVWeaponizedEPSS 92%

    litellm · litellmMay 8, 2026

  • CVE-2023-42343
    24Monitor

    A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    May 8, 2026

  • CVE-2023-42344
    30Monitor

    Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on

    HighCVSS 7.3Proof of conceptEPSS 2%

    May 8, 2026

  • CVE-2023-47268
    21Monitor

    In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host whe

    MediumCVSS 5.3Proof of conceptEPSS 0%

    prusa3d · prusaslicerMay 8, 2026

  • CVE-2024-27686
    30Monitor

    Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted

    HighCVSS 7.5Proof of conceptEPSS 0%

    May 8, 2026

  • CVE-2024-30167
    25Monitor

    /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a P

    MediumCVSS 6.3Proof of conceptEPSS 1%

    May 8, 2026

  • CVE-2024-33288
    29Monitor

    Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page.

    HighCVSS 7.3Proof of conceptEPSS 0%

    May 8, 2026

  • CVE-2024-33722
    25Monitor

    SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].

    MediumCVSS 6.3Proof of conceptEPSS 0%

    May 8, 2026

  • CVE-2024-33724
    21Monitor

    SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    May 8, 2026

  • CVE-2024-45257
    60This week

    A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on th

    HighCVSS 7.3WeaponizedEPSS 3%

    May 8, 2026

  • CVE-2024-46507
    30Monitor

    A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows atta

    HighCVSS 7.3Proof of conceptEPSS 3%

    yeti-platform · yetiMay 8, 2026

  • CVE-2024-51092
    40Plan

    LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(),

    CriticalCVSS 9.1WeaponizedEPSS 7%

    librenms · librenmsMay 8, 2026

  • CVE-2024-53326
    40Plan

    LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code e

    HighCVSS 7.3WeaponizedEPSS 0%

    May 8, 2026

  • CVE-2025-67886
    25Monitor

    Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload

    MediumCVSS 6.3Proof of conceptEPSS 1%

    May 8, 2026

  • CVE-2025-67887
    39Monitor

    1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    May 8, 2026

  • CVE-2025-67888
    60This week

    An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209.

    HighCVSS 7.3WeaponizedEPSS 3%

    May 8, 2026

  • CVE-2025-69599
    39Monitor

    RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    May 8, 2026

  • CVE-2026-8069
    34Monitor

    PredatorSense V3: Local Privilege Escalation (LPE) vulnerability

    HighCVSS 8.5Proof of conceptEPSS 0%

    acer · nitrosenseMay 8, 2026

  • CVE-2026-43284
    63This week

    xfrm: esp: avoid in-place decrypt on shared skb frags

    HighCVSS 8.8WeaponizedEPSS 94%

    linux · linux kernelMay 8, 2026

  • CVE-2025-55449
    29Monitor

    AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.

    HighCVSS 7.3Proof of conceptEPSS 0%

    astrbot · astrbotMay 8, 2026

  • CVE-2025-69690
    36Monitor

    Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    pfsense · pfsenseMay 8, 2026

  • CVE-2026-39816
    30Monitor

    Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService

    HighCVSS 7.5Proof of conceptEPSS 0%

    apache · nifiMay 8, 2026

  • CVE-2026-44338
    29Monitor

    PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

    HighCVSS 7.3Proof of conceptEPSS 0%

    praison · praisonaiMay 8, 2026

  • CVE-2026-38361
    31Monitor

    Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2.

    HighCVSS 7.5Proof of conceptEPSS 2%

    fohrloop · dash-uploaderMay 8, 2026

  • CVE-2026-41575
    24Monitor

    th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 0%

    th30d4y · w4nn4d13\/ipMay 8, 2026

  • CVE-2026-38360
    41Plan

    Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    May 8, 2026

  • CVE-2026-41432
    32Monitor

    New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

    HighCVSS 8.2Proof of conceptEPSS 0%

    newapi · new apiMay 8, 2026

  • CVE-2026-42298
    39Monitor

    Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    gitroom · postizMay 8, 2026

  • CVE-2026-44656
    18Monitor

    Vim: OS Command Injection via 'path' completion

    MediumCVSS 4.6Proof of conceptEPSS 0%

    vim · vimMay 8, 2026

  • CVE-2026-6664
    30Monitor

    PgBouncer integer overflow in PgBouncer network packet parsing

    HighCVSS 7.5Proof of conceptEPSS 0%

    pgbouncer · pgbouncerMay 8, 2026

  • CVE-2026-6666
    30Monitor

    PgBouncer crash in kill_pool_logins_server_error

    HighCVSS 7.5Proof of conceptEPSS 0%

    pgbouncer · pgbouncerMay 8, 2026

  • CVE-2026-42461
    34Monitor

    Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

    HighCVSS 8.7Proof of conceptEPSS 1%

    getarcane · arcaneMay 9, 2026

  • CVE-2026-42569
    37Monitor

    phpvms: /importer authorization bypass causing full database wipe

    CriticalCVSS 9.4Proof of conceptEPSS 1%

    phpvms · phpvmsMay 9, 2026

  • CVE-2026-8196
    11Monitor

    JeecgBoot mLogin Endpoint LoginController.java authorization

    LowCVSS 2.9Proof of conceptEPSS 0%

    May 9, 2026