By publication date

Exploited and new serious CVEs: May 2026

374 records · 23 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 4

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-42461Proof of concept	Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)getarcane · arcane · CWE-862 Pre-auth Broken access control (IDOR)	High8.7	—	1.2%	May 9, 2026
37Monitor	CVE-2026-42569Proof of concept	phpvms: /importer authorization bypass causing full database wipephpvms · phpvms · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.4	—	1.1%	May 9, 2026
11Monitor	CVE-2026-8196Proof of concept	JeecgBoot mLogin Endpoint LoginController.java authorizationCWE-285 Pre-auth Broken access control (IDOR)	Low2.9	—	0.4%	May 9, 2026
29Monitor	CVE-2026-6433Proof of concept	Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCEunknown · custom css-js-php · CWE-94 pre-auth RCE SQL injection	High7.3	—	1.1%	May 11, 2026
59Plan	CVE-2026-43500Weaponized	rxrpc: Also unshare DATA/RESPONSE packets when paged frags are presentlinux · linux kernel · CWE-787 Memory safety	High7.8	—	94.1%	May 11, 2026
23Monitor	CVE-2026-6815Proof of concept	An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider.casbin · casdoor · CWE-22 Path traversal Local privilege escalation	Medium5.9	—	0.5%	May 11, 2026
29Monitor	CVE-2026-2291Proof of concept	dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, whicdnsmasq · dnsmasq · CWE-190 Pre-auth Memory safety	High7.3	—	0.6%	May 11, 2026
32Monitor	CVE-2026-4802Proof of concept	Cockpit: cockpit: arbitrary command execution via crafted links in system logs uired hat · red hat enterprise linux 10 · CWE-78 RCE Command injection	High8.0	—	1.0%	May 11, 2026
22Monitor	CVE-2026-4893Proof of concept	An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 cldnsmasq · dnsmasq · CWE-287 Pre-auth Auth bypass	Medium5.3	—	1.7%	May 11, 2026
30Monitor	CVE-2026-5172Proof of concept	A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting dnsmasq · dnsmasq · CWE-125 Pre-auth Memory safety	High7.3	—	2.6%	May 11, 2026
37Monitor	CVE-2026-42607Proof of concept	Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Featuregetgrav · grav · CWE-94 RCE	Critical9.1	—	4.3%	May 11, 2026
37Monitor	CVE-2026-42613Proof of concept	Grav: Privilege Escalation via Missing Server-Side Validation of groups/accessgetgrav · grav · CWE-20 Pre-auth	Critical9.4	—	1.1%	May 11, 2026
31Monitor	CVE-2026-2614Proof of concept	Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflowlfprojects · mlflow · CWE-22 Pre-auth Path traversal	High7.5	—	3.6%	May 11, 2026
31Monitor	CVE-2026-3609Proof of concept	XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerabilitywellbia · xigncode3 · CWE-269 Local privilege escalation	High7.8	—	0.2%	May 11, 2026
26Monitor	CVE-2026-28956Proof of concept	A memory corruption issue was addressed with improved input validation.apple · ipados · CWE-125 Pre-auth Memory safety Denial of service	Medium6.5	—	0.5%	May 11, 2026
30Monitor	CVE-2026-28990Proof of concept	The issue was addressed with improved memory handling.apple · ipados · CWE-119 Pre-auth Memory safety	High7.5	—	0.3%	May 11, 2026
18Monitor	CVE-2026-28992Proof of concept	A memory corruption vulnerability was addressed with improved locking.apple · ipados · CWE-362 Race condition Denial of service	Medium4.7	—	0.1%	May 11, 2026
35Monitor	CVE-2026-28995Proof of concept	A logic issue was addressed with improved restrictions.apple · ipados · CWE-269 Local privilege escalation	High8.8	—	0.1%	May 11, 2026
29Monitor	CVE-2026-43655Proof of concept	An out-of-bounds read was addressed with improved bounds checking.apple · ipados · CWE-125 Pre-auth Memory safety	High7.3	—	0.3%	May 11, 2026
32Monitor	CVE-2026-42564Proof of concept	jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impactfccview · jotty · CWE-22 Pre-auth Path traversal	High8.2	—	1.1%	May 11, 2026
32Monitor	CVE-2026-43893Proof of concept	exiftool-vendored: Argument injection via newline characters in tag namesphotostructure · exiftool-vendored.js · CWE-88 Pre-auth	High8.2	—	0.4%	May 11, 2026
39Monitor	CVE-2026-43914Proof of concept	Vaultwarden: Brute-force protection bypass vulnerabilitydani-garcia · vaultwarden · CWE-307 Pre-auth	Critical9.8	—	0.2%	May 11, 2026
69This week	CVE-2026-45321Weaponized	Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keystanstack · tanstack/arktype-adapter · CWE-506 Pre-auth	Critical9.6	KEV	3.2%	May 12, 2026
34Monitor	CVE-2026-5029Proof of concept	RCE in Code Runner MCP Servercode runner mcp server · code runner mcp server · CWE-306 pre-auth RCE Auth bypass	High8.7	—	0.2%	May 12, 2026
30Monitor	CVE-2026-8161Proof of concept	multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exceptionpillarjs · multiparty · CWE-248 Pre-auth Prototype pollution Denial of service	High7.5	—	0.4%	May 12, 2026
37Monitor	CVE-2026-41551Proof of concept	A vulnerability has been identified in ROS# (All versions < V2.2.2).siemens · ros# · CWE-23 Pre-auth Path traversal	Critical9.3	—	0.4%	May 12, 2026
36Monitor	CVE-2026-45091Proof of concept	sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)davidalmeidac · sealed-env · CWE-200 Pre-auth Info leak	Critical9.1	—	0.3%	May 12, 2026
31Monitor	CVE-2026-34344Proof of concept	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-843 Local privilege escalation	High7.8	—	0.3%	May 12, 2026
26Monitor	CVE-2026-8388Proof of concept	Incorrect boundary conditions in the JavaScript Engine: JIT componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Medium6.5	—	0.2%	May 12, 2026
35Monitor	CVE-2026-8389Proof of concept	JIT miscompilation in the JavaScript Engine: JIT componentmozilla · firefox · CWE-119 Pre-auth Memory safety	High8.8	—	0.4%	May 12, 2026
40Plan	CVE-2026-41096Proof of concept	Windows DNS Client Remote Code Execution Vulnerabilitymicrosoft · windows 11 23h2 · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	2.6%	May 12, 2026
39Monitor	CVE-2026-42048Proof of concept	Langflow: Path Traversal in Langflow Knowledge Bases APIlangflow · langflow · CWE-22 Path traversal	Critical9.6	—	4.1%	May 12, 2026
24Monitor	CVE-2026-44166Proof of concept	Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgradepocketbase · pocketbase · CWE-287 Pre-auth Auth bypass	Medium6.1	—	0.2%	May 12, 2026
38Monitor	CVE-2026-44343Proof of concept	WGDashboard: Critical Vulnerability in 4.3.2wgdashboard · wgdashboard · CWE-20 Pre-auth Auth bypass	Critical9.3	—	1.8%	May 12, 2026
18Monitor	CVE-2026-5061Proof of concept	Consul-template vulnerable to sandbox path bypass in file helper via a symlink attackhashicorp · tooling · CWE-59	Medium4.7	—	0.1%	May 12, 2026
40Plan	CVE-2026-41293Proof of concept	Apache Tomcat: HTTP/2 request headers not validatedapache · tomcat · CWE-20 Pre-auth	Critical9.8	—	1.7%	May 12, 2026
39Monitor	CVE-2026-43512Proof of concept	Apache Tomcat: Digest authenticator will authenticate any unknown userapache · tomcat · CWE-592 Pre-auth Auth bypass	Critical9.8	—	1.3%	May 12, 2026
36Monitor	CVE-2026-43515Proof of concept	Apache Tomcat: Security constraints not correctly appliedapache · tomcat · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.1	—	1.2%	May 12, 2026
39Monitor	CVE-2026-45185Proof of concept	Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path.exim · exim · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	1.2%	May 12, 2026
35Monitor	CVE-2026-44403Proof of concept	Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serializationwftpserver · wing ftp server · CWE-94 RCE	High8.6	—	2.6%	May 12, 2026
36Monitor	CVE-2026-29204Proof of concept	Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` webpros · whmcs · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.3%	May 12, 2026
44Plan	CVE-2026-33112No exploit	Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 RCE Deserialization	High8.8	—	31.1%	May 12, 2026
32Monitor	CVE-2026-40369Proof of concept	Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 11 24h2 · CWE-822 Local privilege escalation	High7.8	—	4.7%	May 12, 2026
63This week	CVE-2026-41089Proof of concept	Windows Netlogon Remote Code Execution Vulnerabilitymicrosoft · windows server 2012 · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	79.6%	May 12, 2026
30Monitor	CVE-2026-42141Proof of concept	Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionalityxibosignage · xibo-cms · CWE-918 SSRF	High7.7	—	0.3%	May 12, 2026
39Monitor	CVE-2026-44277Proof of concept	A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6fortinet · fortiauthenticator · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	May 12, 2026
36Monitor	CVE-2026-41901Proof of concept	Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressionsthymeleaf · thymeleaf · CWE-917 pre-auth RCE SSTI	Critical9.0	—	0.4%	May 12, 2026
36Monitor	CVE-2026-34648No exploit	Adobe Commerce \| Uncontrolled Resource Consumption (CWE-400)adobe · commerce · CWE-400 Pre-auth Denial of service	High7.5	—	21.3%	May 12, 2026
34Monitor	CVE-2026-34649No exploit	Adobe Commerce \| Uncontrolled Resource Consumption (CWE-400)adobe · commerce · CWE-400 Pre-auth Denial of service	High7.5	—	13.6%	May 12, 2026
35Monitor	CVE-2026-34650No exploit	Adobe Commerce \| Uncontrolled Resource Consumption (CWE-400)adobe · commerce · CWE-400 Pre-auth Denial of service	High7.5	—	15.0%	May 12, 2026
37Monitor	CVE-2026-44225Proof of concept	Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user filesenesgkky · pulpy · CWE-22 Pre-auth Path traversal	Critical9.3	—	1.5%	May 12, 2026
34Monitor	CVE-2026-44011Proof of concept	Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms · cms · CWE-479 RCE	High8.6	—	0.6%	May 12, 2026
28Monitor	CVE-2026-44246Proof of concept	nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`dkfz · nnu-net · CWE-74 Pre-auth	High7.2	—	0.2%	May 12, 2026
39Monitor	CVE-2026-44262Proof of concept	Scramble: Remote code execution via evaluation of user-controlled input in validation rulesdedoc · scramble · CWE-94 pre-auth RCE	Critical9.4	—	5.8%	May 12, 2026
27Monitor	CVE-2026-21015Proof of concept	Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.samsung · android · CWE-276	Medium6.8	—	0.0%	May 13, 2026
20Monitor	CVE-2026-21016Proof of concept	Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.samsung · android · CWE-266 Local privilege escalation	Medium5.1	—	0.0%	May 13, 2026
27Monitor	CVE-2026-21018Proof of concept	Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.samsung · android · CWE-787 RCE Local privilege escalation Memory safety	Medium6.8	—	0.1%	May 13, 2026
34Monitor	CVE-2026-21019Proof of concept	Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code wsamsung mobile · samsung mobile devices · CWE-20 RCE Local privilege escalation	High8.6	—	0.1%	May 13, 2026
20Monitor	CVE-2026-21020Proof of concept	Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged funcsamsung · android · CWE-926 Local privilege escalation	Medium5.1	—	0.0%	May 13, 2026
26Monitor	CVE-2026-4782Proof of concept	Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameterthemefusion · avada (fusion) builder · CWE-36 Path traversal	Medium6.5	—	0.4%	May 13, 2026
34Monitor	CVE-2026-42031Proof of concept	CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`okfn · ckan · CWE-89 Pre-auth SQL injection	High8.3	—	1.8%	May 13, 2026
26Monitor	CVE-2026-42032No exploit	CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`okfn · ckan · CWE-863 Pre-auth Broken access control (IDOR)	Medium6.7	—	0.3%	May 13, 2026
22Monitor	CVE-2025-29338Proof of concept	NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buffer overflow via the CWE-120 Memory safety	Medium5.6	—	0.1%	May 13, 2026
26Monitor	CVE-2026-31156Proof of concept	A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_geneopenplcproject · openplc v3 firmware · CWE-22 Path traversal	Medium6.5	—	0.3%	May 13, 2026
34Monitor	CVE-2026-34176No exploit	Knowledge Appliance mode iControl REST vulnerabilityf5 · big-ip access policy manager · CWE-78 RCE Command injection	High8.5	—	0.6%	May 13, 2026
25Monitor	CVE-2026-40701Proof of concept	NGINX ngx_http_ssl_module vulnerabilityf5 · dos · CWE-416 Pre-auth Memory safety	Medium6.3	—	0.6%	May 13, 2026
25Monitor	CVE-2026-42926Proof of concept	NGINX ngx_http_proxy_v2_module vulnerabilityf5 · nginx gateway fabric · CWE-172 Pre-auth	Medium6.3	—	0.3%	May 13, 2026
56Plan	CVE-2026-42945Proof of concept	NGINX ngx_http_rewrite_module vulnerabilityf5 · dos · CWE-122 Pre-auth Memory safety	Critical9.2	—	68.0%	May 13, 2026
34Monitor	CVE-2026-45033Proof of concept	GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitorgithub · copilot-cli · CWE-696 RCE Path traversal	High8.5	—	0.3%	May 13, 2026
30Monitor	CVE-2026-44575No exploit	Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesvercel · next.js · CWE-288 Pre-auth Auth bypass	High7.5	—	1.5%	May 13, 2026
24Monitor	CVE-2026-44376Proof of concept	CubeCart: Reflected XSS in Store Search Barcubecart · v6 · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	May 13, 2026
37Monitor	CVE-2026-44381Proof of concept	MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listingsmisp-project · misp · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.6%	May 13, 2026
60This week	CVE-2026-0265Weaponized	PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabledpaloaltonetworks · pan-os · CWE-347 Pre-auth Auth bypass Weak crypto	High7.2	—	1.0%	May 13, 2026
45Plan	CVE-2026-44578Proof of concept	Next.js: Server-side request forgery in applications using WebSocket upgradesvercel · next.js · CWE-918 Pre-auth SSRF	High8.6	—	35.5%	May 13, 2026
30Monitor	CVE-2026-44579Proof of concept	Next.js: Denial of Service via connection exhaustion in applications using Cache Componentsvercel · next.js · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	May 13, 2026
30Monitor	CVE-2026-45109No exploit	Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesvercel · next.js · CWE-288 Pre-auth Auth bypass	High7.5	—	0.6%	May 13, 2026
90Now	CVE-2026-0257Weaponized	PAN-OS: GlobalProtect Authentication Bypass Vulnerabilitiespaloaltonetworks · pan-os · CWE-565 Pre-auth Auth bypass	High7.8	KEV	95.6%	May 13, 2026
30Monitor	CVE-2026-42582No exploit	Netty: HTTP/3 QPACK literal unbounded allocationnetty · netty · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	May 13, 2026
36Monitor	CVE-2026-44351Proof of concept	fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassnearform · fast-jwt · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.2%	May 13, 2026
23Monitor	CVE-2026-8328No exploit	FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host addresspython software foundation · cpython · CWE-918 Pre-auth SSRF	Medium5.9	—	0.4%	May 13, 2026
43Plan	CVE-2026-8181Proof of concept	Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeoverburstbv · burst statistics – privacy-friendly wordpress analytics (google analytics alternative) · CWE-287 Pre-auth Auth bypass	Critical9.8	—	14.6%	May 14, 2026
39Monitor	CVE-2026-6271Proof of concept	Career Section <= 1.7 - Unauthenticated Arbitrary File Uploadshahinurislam · career section · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.6%	May 14, 2026
21Monitor	CVE-2026-6145Proof of concept	User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameterwpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.4%	May 14, 2026
35Monitor	CVE-2026-6475Proof of concept	PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choicepostgresql · postgresql · CWE-61 Pre-auth	High8.8	—	0.4%	May 14, 2026
35Monitor	CVE-2026-6477No exploit	PostgreSQL libpq lo_* functions let server superuser overwrite client stack memorypostgresql · postgresql · CWE-242 Pre-auth	High8.8	—	0.4%	May 14, 2026
40Plan	CVE-2026-42589Proof of concept	Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injectionthecodingmachine · gotenberg · CWE-78 pre-auth RCE Command injection	Critical9.8	—	3.0%	May 14, 2026
37Monitor	CVE-2026-42596Proof of concept	Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookthecodingmachine · gotenberg · CWE-918 Pre-auth SSRF	Critical9.4	—	1.5%	May 14, 2026
37Monitor	CVE-2026-27886Proof of concept	Strapi may leak sensitive data via relational filtering due to lack of query sanitizationstrapi · strapi · CWE-22 Pre-auth Auth bypass Path traversal	Critical9.2	—	1.9%	May 14, 2026
35Monitor	CVE-2026-42559Proof of concept	RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportmodelcontextprotocol · rust-sdk · CWE-346 Pre-auth	High8.8	—	0.2%	May 14, 2026
36Monitor	CVE-2026-42281Proof of concept	MagicMirror²: Unauthenticated SSRF via /cors endpointmagicmirror · magicmirror · CWE-918 Pre-auth SSRF	Critical9.2	—	1.6%	May 14, 2026
98Now	CVE-2026-20182Weaponized	Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerabilitycisco · catalyst sd-wan manager · CWE-287 Pre-auth Auth bypass	Critical10.0	KEV	91.8%	May 14, 2026
34Monitor	CVE-2026-20224Proof of concept	Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerabilitycisco · catalyst sd-wan manager · CWE-20 Pre-auth XXE	High8.6	—	1.0%	May 14, 2026
75This week	CVE-2026-42897Weaponized	Microsoft Exchange Server Spoofing Vulnerabilitymicrosoft · exchange server · CWE-79 Pre-auth XSS	Medium6.1	KEV	70.6%	May 14, 2026
27Monitor	CVE-2025-64526No exploit	Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingstrapi · strapi · CWE-307 Pre-auth	Medium6.9	—	0.4%	May 14, 2026
37Monitor	CVE-2026-22599Proof of concept	Strapi Vulnerable to SQL Injection in Content Type Builderstrapi · strapi · CWE-89 SQL injection	Critical9.3	—	1.1%	May 14, 2026
8Monitor	CVE-2026-22706Proof of concept	Strapi: Password Reset Does Not Revoke Existing Refresh Sessionsstrapi · strapi · CWE-613	Low2.1	—	0.3%	May 14, 2026
40Plan	CVE-2026-2652Proof of concept	Authentication Bypass in mlflow/mlflowlfprojects · mlflow · CWE-305 Pre-auth Auth bypass	High8.6	—	20.7%	May 14, 2026
39Monitor	CVE-2026-5229Proof of concept	Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callbackm615926 · receive notifications after form submitting – form notify for any forms · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.7%	May 15, 2026
67This week	CVE-2026-8398Weaponized	A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434)disc-soft · daemon tools · CWE-506 Pre-auth	Critical9.3	KEV	1.4%	May 15, 2026
30Monitor	CVE-2026-44714Proof of concept	bitcoinj: ScriptExecution P2PKH/P2WPKH Verification Bypassbitcoinj · bitcoinj · CWE-347 Pre-auth Weak crypto	High7.5	—	0.2%	May 15, 2026

CVE-2026-42461
34Monitor
Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)
HighCVSS 8.7Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
getarcane · arcaneMay 9, 2026
CVE-2026-42569
37Monitor
phpvms: /importer authorization bypass causing full database wipe
CriticalCVSS 9.4Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
phpvms · phpvmsMay 9, 2026
CVE-2026-8196
11Monitor
JeecgBoot mLogin Endpoint LoginController.java authorization
LowCVSS 2.9Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
May 9, 2026
CVE-2026-6433
29Monitor
Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE
HighCVSS 7.3Proof of conceptEPSS 1%
- pre-auth RCE
- SQL injection
unknown · custom css-js-phpMay 11, 2026
CVE-2026-43500
59Plan
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
HighCVSS 7.8WeaponizedEPSS 94%
- Memory safety
linux · linux kernelMay 11, 2026
CVE-2026-6815
23Monitor
An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider.
MediumCVSS 5.9Proof of conceptEPSS 0%
- Path traversal
- Local privilege escalation
casbin · casdoorMay 11, 2026
CVE-2026-2291
29Monitor
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, whic
HighCVSS 7.3Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
dnsmasq · dnsmasqMay 11, 2026
CVE-2026-4802
32Monitor
Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
HighCVSS 8.0Proof of conceptEPSS 1%
- RCE
- Command injection
red hat · red hat enterprise linux 10May 11, 2026
CVE-2026-4893
22Monitor
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 cl
MediumCVSS 5.3Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
dnsmasq · dnsmasqMay 11, 2026
CVE-2026-5172
30Monitor
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting
HighCVSS 7.3Proof of conceptEPSS 2%
- Pre-auth
- Memory safety
dnsmasq · dnsmasqMay 11, 2026
CVE-2026-42607
37Monitor
Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
CriticalCVSS 9.1Proof of conceptEPSS 4%
- RCE
getgrav · gravMay 11, 2026
CVE-2026-42613
37Monitor
Grav: Privilege Escalation via Missing Server-Side Validation of groups/access
CriticalCVSS 9.4Proof of conceptEPSS 1%
- Pre-auth
getgrav · gravMay 11, 2026
CVE-2026-2614
31Monitor
Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow
HighCVSS 7.5Proof of conceptEPSS 3%
- Pre-auth
- Path traversal
lfprojects · mlflowMay 11, 2026
CVE-2026-3609
31Monitor
XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
wellbia · xigncode3May 11, 2026
CVE-2026-28956
26Monitor
A memory corruption issue was addressed with improved input validation.
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apple · ipadosMay 11, 2026
CVE-2026-28990
30Monitor
The issue was addressed with improved memory handling.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
apple · ipadosMay 11, 2026
CVE-2026-28992
18Monitor
A memory corruption vulnerability was addressed with improved locking.
MediumCVSS 4.7Proof of conceptEPSS 0%
- Race condition
- Denial of service
apple · ipadosMay 11, 2026
CVE-2026-28995
35Monitor
A logic issue was addressed with improved restrictions.
HighCVSS 8.8Proof of conceptEPSS 0%
- Local privilege escalation
apple · ipadosMay 11, 2026
CVE-2026-43655
29Monitor
An out-of-bounds read was addressed with improved bounds checking.
HighCVSS 7.3Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
apple · ipadosMay 11, 2026
CVE-2026-42564
32Monitor
jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impact
HighCVSS 8.2Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
fccview · jottyMay 11, 2026
CVE-2026-43893
32Monitor
exiftool-vendored: Argument injection via newline characters in tag names
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
photostructure · exiftool-vendored.jsMay 11, 2026
CVE-2026-43914
39Monitor
Vaultwarden: Brute-force protection bypass vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
dani-garcia · vaultwardenMay 11, 2026
CVE-2026-45321
69This week
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
CriticalCVSS 9.6KEVWeaponizedEPSS 3%
- Pre-auth
tanstack · tanstack/arktype-adapterMay 12, 2026
CVE-2026-5029
34Monitor
RCE in Code Runner MCP Server
HighCVSS 8.7Proof of conceptEPSS 0%
- pre-auth RCE
- Auth bypass
code runner mcp server · code runner mcp serverMay 12, 2026
CVE-2026-8161
30Monitor
multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Prototype pollution
- Denial of service
pillarjs · multipartyMay 12, 2026
CVE-2026-41551
37Monitor
A vulnerability has been identified in ROS# (All versions < V2.2.2).
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
siemens · ros#May 12, 2026
CVE-2026-45091
36Monitor
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Info leak
davidalmeidac · sealed-envMay 12, 2026
CVE-2026-34344
31Monitor
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
microsoft · windows 10 1607May 12, 2026
CVE-2026-8388
26Monitor
Incorrect boundary conditions in the JavaScript Engine: JIT component
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxMay 12, 2026
CVE-2026-8389
35Monitor
JIT miscompilation in the JavaScript Engine: JIT component
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxMay 12, 2026
CVE-2026-41096
40Plan
Windows DNS Client Remote Code Execution Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 2%
- pre-auth RCE
- Memory safety
microsoft · windows 11 23h2May 12, 2026
CVE-2026-42048
39Monitor
Langflow: Path Traversal in Langflow Knowledge Bases API
CriticalCVSS 9.6Proof of conceptEPSS 4%
- Path traversal
langflow · langflowMay 12, 2026
CVE-2026-44166
24Monitor
Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
pocketbase · pocketbaseMay 12, 2026
CVE-2026-44343
38Monitor
WGDashboard: Critical Vulnerability in 4.3.2
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
wgdashboard · wgdashboardMay 12, 2026
CVE-2026-5061
18Monitor
Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack
MediumCVSS 4.7Proof of conceptEPSS 0%
hashicorp · toolingMay 12, 2026
CVE-2026-41293
40Plan
Apache Tomcat: HTTP/2 request headers not validated
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
apache · tomcatMay 12, 2026
CVE-2026-43512
39Monitor
Apache Tomcat: Digest authenticator will authenticate any unknown user
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
apache · tomcatMay 12, 2026
CVE-2026-43515
36Monitor
Apache Tomcat: Security constraints not correctly applied
CriticalCVSS 9.1Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
apache · tomcatMay 12, 2026
CVE-2026-45185
39Monitor
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path.
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Memory safety
exim · eximMay 12, 2026
CVE-2026-44403
35Monitor
Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
HighCVSS 8.6Proof of conceptEPSS 2%
- RCE
wftpserver · wing ftp serverMay 12, 2026
CVE-2026-29204
36Monitor
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId`
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
webpros · whmcsMay 12, 2026
CVE-2026-33112
44Plan
Microsoft SharePoint Server Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 31%
- RCE
- Deserialization
microsoft · sharepoint serverMay 12, 2026
CVE-2026-40369
32Monitor
Windows Kernel Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 4%
- Local privilege escalation
microsoft · windows 11 24h2May 12, 2026
CVE-2026-41089
63This week
Windows Netlogon Remote Code Execution Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 79%
- pre-auth RCE
- Memory safety
microsoft · windows server 2012May 12, 2026
CVE-2026-42141
30Monitor
Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality
HighCVSS 7.7Proof of conceptEPSS 0%
- SSRF
xibosignage · xibo-cmsMay 12, 2026
CVE-2026-44277
39Monitor
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
fortinet · fortiauthenticatorMay 12, 2026
CVE-2026-41901
36Monitor
Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
CriticalCVSS 9.0Proof of conceptEPSS 0%
- pre-auth RCE
- SSTI
thymeleaf · thymeleafMay 12, 2026
CVE-2026-34648
36Monitor
Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
HighCVSS 7.5No exploitEPSS 21%
- Pre-auth
- Denial of service
adobe · commerceMay 12, 2026
CVE-2026-34649
34Monitor
Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
HighCVSS 7.5No exploitEPSS 13%
- Pre-auth
- Denial of service
adobe · commerceMay 12, 2026
CVE-2026-34650
35Monitor
Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)
HighCVSS 7.5No exploitEPSS 15%
- Pre-auth
- Denial of service
adobe · commerceMay 12, 2026
CVE-2026-44225
37Monitor
Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
enesgkky · pulpyMay 12, 2026
CVE-2026-44011
34Monitor
Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
HighCVSS 8.6Proof of conceptEPSS 0%
- RCE
craftcms · cmsMay 12, 2026
CVE-2026-44246
28Monitor
nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`
HighCVSS 7.2Proof of conceptEPSS 0%
- Pre-auth
dkfz · nnu-netMay 12, 2026
CVE-2026-44262
39Monitor
Scramble: Remote code execution via evaluation of user-controlled input in validation rules
CriticalCVSS 9.4Proof of conceptEPSS 5%
- pre-auth RCE
dedoc · scrambleMay 12, 2026
CVE-2026-21015
27Monitor
Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.
MediumCVSS 6.8Proof of conceptEPSS 0%
samsung · androidMay 13, 2026
CVE-2026-21016
20Monitor
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
MediumCVSS 5.1Proof of conceptEPSS 0%
- Local privilege escalation
samsung · androidMay 13, 2026
CVE-2026-21018
27Monitor
Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.
MediumCVSS 6.8Proof of conceptEPSS 0%
- RCE
- Local privilege escalation
- Memory safety
samsung · androidMay 13, 2026
CVE-2026-21019
34Monitor
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code w
HighCVSS 8.6Proof of conceptEPSS 0%
- RCE
- Local privilege escalation
samsung mobile · samsung mobile devicesMay 13, 2026
CVE-2026-21020
20Monitor
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged func
MediumCVSS 5.1Proof of conceptEPSS 0%
- Local privilege escalation
samsung · androidMay 13, 2026
CVE-2026-4782
26Monitor
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
MediumCVSS 6.5Proof of conceptEPSS 0%
- Path traversal
themefusion · avada (fusion) builderMay 13, 2026
CVE-2026-42031
34Monitor
CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
HighCVSS 8.3Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
okfn · ckanMay 13, 2026
CVE-2026-42032
26Monitor
CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`
MediumCVSS 6.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
okfn · ckanMay 13, 2026
CVE-2025-29338
22Monitor
NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buffer overflow via the
MediumCVSS 5.6Proof of conceptEPSS 0%
- Memory safety
May 13, 2026
CVE-2026-31156
26Monitor
A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_gene
MediumCVSS 6.5Proof of conceptEPSS 0%
- Path traversal
openplcproject · openplc v3 firmwareMay 13, 2026
CVE-2026-34176
34Monitor
Knowledge Appliance mode iControl REST vulnerability
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
f5 · big-ip access policy managerMay 13, 2026
CVE-2026-40701
25Monitor
NGINX ngx_http_ssl_module vulnerability
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
f5 · dosMay 13, 2026
CVE-2026-42926
25Monitor
NGINX ngx_http_proxy_v2_module vulnerability
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
f5 · nginx gateway fabricMay 13, 2026
CVE-2026-42945
56Plan
NGINX ngx_http_rewrite_module vulnerability
CriticalCVSS 9.2Proof of conceptEPSS 68%
- Pre-auth
- Memory safety
f5 · dosMay 13, 2026
CVE-2026-45033
34Monitor
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
HighCVSS 8.5Proof of conceptEPSS 0%
- RCE
- Path traversal
github · copilot-cliMay 13, 2026
CVE-2026-44575
30Monitor
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Auth bypass
vercel · next.jsMay 13, 2026
CVE-2026-44376
24Monitor
CubeCart: Reflected XSS in Store Search Bar
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
cubecart · v6May 13, 2026
CVE-2026-44381
37Monitor
MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
misp-project · mispMay 13, 2026
CVE-2026-0265
60This week
PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled
HighCVSS 7.2WeaponizedEPSS 1%
- Pre-auth
- Auth bypass
- Weak crypto
paloaltonetworks · pan-osMay 13, 2026
CVE-2026-44578
45Plan
Next.js: Server-side request forgery in applications using WebSocket upgrades
HighCVSS 8.6Proof of conceptEPSS 35%
- Pre-auth
- SSRF
vercel · next.jsMay 13, 2026
CVE-2026-44579
30Monitor
Next.js: Denial of Service via connection exhaustion in applications using Cache Components
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
vercel · next.jsMay 13, 2026
CVE-2026-45109
30Monitor
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
vercel · next.jsMay 13, 2026
CVE-2026-0257
90Now
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
HighCVSS 7.8KEVWeaponizedEPSS 95%
- Pre-auth
- Auth bypass
paloaltonetworks · pan-osMay 13, 2026
CVE-2026-42582
30Monitor
Netty: HTTP/3 QPACK literal unbounded allocation
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
netty · nettyMay 13, 2026
CVE-2026-44351
36Monitor
fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
nearform · fast-jwtMay 13, 2026
CVE-2026-8328
23Monitor
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
- SSRF
python software foundation · cpythonMay 13, 2026
CVE-2026-8181
43Plan
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
CriticalCVSS 9.8Proof of conceptEPSS 14%
- Pre-auth
- Auth bypass
burstbv · burst statistics – privacy-friendly wordpress analytics (google analytics alternative)May 14, 2026
CVE-2026-6271
39Monitor
Career Section <= 1.7 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
shahinurislam · career sectionMay 14, 2026
CVE-2026-6145
21Monitor
User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderMay 14, 2026
CVE-2026-6475
35Monitor
PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
postgresql · postgresqlMay 14, 2026
CVE-2026-6477
35Monitor
PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
postgresql · postgresqlMay 14, 2026
CVE-2026-42589
40Plan
Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
CriticalCVSS 9.8Proof of conceptEPSS 3%
- pre-auth RCE
- Command injection
thecodingmachine · gotenbergMay 14, 2026
CVE-2026-42596
37Monitor
Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
CriticalCVSS 9.4Proof of conceptEPSS 1%
- Pre-auth
- SSRF
thecodingmachine · gotenbergMay 14, 2026
CVE-2026-27886
37Monitor
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
CriticalCVSS 9.2Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
- Path traversal
strapi · strapiMay 14, 2026
CVE-2026-42559
35Monitor
RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
modelcontextprotocol · rust-sdkMay 14, 2026
CVE-2026-42281
36Monitor
MagicMirror²: Unauthenticated SSRF via /cors endpoint
CriticalCVSS 9.2Proof of conceptEPSS 1%
- Pre-auth
- SSRF
magicmirror · magicmirrorMay 14, 2026
CVE-2026-20182
98Now
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
CriticalCVSS 10.0KEVWeaponizedEPSS 91%
- Pre-auth
- Auth bypass
cisco · catalyst sd-wan managerMay 14, 2026
CVE-2026-20224
34Monitor
Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability
HighCVSS 8.6Proof of conceptEPSS 1%
- Pre-auth
- XXE
cisco · catalyst sd-wan managerMay 14, 2026
CVE-2026-42897
75This week
Microsoft Exchange Server Spoofing Vulnerability
MediumCVSS 6.1KEVWeaponizedEPSS 70%
- Pre-auth
- XSS
microsoft · exchange serverMay 14, 2026
CVE-2025-64526
27Monitor
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
strapi · strapiMay 14, 2026
CVE-2026-22599
37Monitor
Strapi Vulnerable to SQL Injection in Content Type Builder
CriticalCVSS 9.3Proof of conceptEPSS 1%
- SQL injection
strapi · strapiMay 14, 2026
CVE-2026-22706
8Monitor
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
LowCVSS 2.1Proof of conceptEPSS 0%
strapi · strapiMay 14, 2026
CVE-2026-2652
40Plan
Authentication Bypass in mlflow/mlflow
HighCVSS 8.6Proof of conceptEPSS 20%
- Pre-auth
- Auth bypass
lfprojects · mlflowMay 14, 2026
CVE-2026-5229
39Monitor
Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
m615926 · receive notifications after form submitting – form notify for any formsMay 15, 2026
CVE-2026-8398
67This week
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434)
CriticalCVSS 9.3KEVWeaponizedEPSS 1%
- Pre-auth
disc-soft · daemon toolsMay 15, 2026
CVE-2026-44714
30Monitor
bitcoinj: ScriptExecution P2PKH/P2WPKH Verification Bypass
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
bitcoinj · bitcoinjMay 15, 2026