CVEs published May 9, 2026

The /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without validation.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby.

A critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature.

A Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function allows authenticated users to make arbitrary HTTP requests to internal services due to insufficient URL validation…

auth provides authentication via oauth2, direct and email.

7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2, there is a a privilege escalation vulnerability affecting Pelican's Web User Interface (WebUI).

Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as PHP.

The currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences.

The archive upload endpoint (POST /api/v1/archives/[linkId]?format=4) accepts HTML files (text/html) without sanitizing JavaScript content.

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.

Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}.

The Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operations (create, read, update, delete).

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message.

The ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist.

A user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod security context, add tolerations to schedule on control-plane…

Processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution.

pyp2spec generates working Fedora RPM spec file for Python projects.

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash.

apko allows users to build and publish OCI container images built from apk packages.

apko allows users to build and publish OCI container images built from apk packages.

Four GET endpoints under /api/templates* in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated network client to list and read the full Compose YAML and .env…

The Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby.

The HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, configurable via HTTP_RATE_LIMITS).

A circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of…

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby.

Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation.

Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing…

If bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase.

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file…

This could allow an unauthenticated user to obtain the admin permission.

Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers to place their code into a plugins directory if the victim uses an…

apko allows users to build and publish OCI container images built from apk packages.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby.

A nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule, when…

`pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API.

Read access to site, user and role information is not gated by permissions.

A weakness has been identified in Akaunting 3.1.21.

A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425.

A vulnerability was identified in Wavlink NU516U1 M16U1_V240425.

A vulnerability was determined in Wavlink NU516U1 M16U1_V240425.

A vulnerability was found in Wavlink NU516U1 M16U1_V240425.

A vulnerability has been found in Wavlink NU516U1 M16U1_V240425.

A security vulnerability has been detected in UGREEN CM933 1.1.59.4319.

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation.

A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.

An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

Passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were…

If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow.

A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4.

A flaw has been found in OSGeo gdal up to 3.13.0dev-4.

A security vulnerability has been detected in aandrew-me tgpt up to 2.11.1 on Linux/macOS.

The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6.

A flaw has been found in Open5GS up to 2.7.7.

A vulnerability was detected in Open5GS up to 2.7.7.

The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthenticated guest booking flow in versions up to, and including, 5.5.0 This is due to the…

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby.

Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk.

The workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation.

A vulnerability was detected in codelibs Fess up to 15.5.1.

A vulnerability was detected in JeecgBoot up to 3.9.1.

A security vulnerability has been detected in osTicket up to 1.18.3.

PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command.

User avatar creation, replacement and deletion are not gated by user update permissions.

The system API endpoint leaks license data and installed version to authenticated users.

A flaw has been found in JeecgBoot 3.9.1.

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let…