CVEs published May 10, 2026
78,575 CVEs in 2026
8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage.
8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts.
When an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings…
A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2.
XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences.
8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string.
DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document.
8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing…
8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()).
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids.
A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03.
8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial…
Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.
Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.
A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0.
A flaw has been found in Wavlink NU516U1 240425.
A vulnerability was detected in Wavlink NU516U1 240425.
A security vulnerability has been detected in Wavlink NU516U1 240425.
A weakness has been identified in Wavlink NU516U1 240425.
A security flaw has been discovered in Industrial Application Software IAS Canias ERP 8.03.
8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript…
A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0.
A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03.
A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03.
A vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03.
A security flaw has been discovered in Open5GS up to 2.7.7.
A vulnerability was identified in Open5GS up to 2.7.7.
A vulnerability was determined in Open5GS up to 2.7.7.
A vulnerability was found in Open5GS up to 2.7.7.
A vulnerability has been found in Open5GS up to 2.7.7.
A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03.
A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03.
Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses.
A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4.
A vulnerability was found in Open5GS up to 2.7.7.
A vulnerability has been found in Open5GS up to 2.7.7.
A flaw has been found in Open5GS up to 2.7.7.
A vulnerability was detected in Open5GS up to 2.7.7.
A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03.
A vulnerability was found in Dotouch XproUPF 2.0.0-release-088aa7c4.
The computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
A flaw has been found in Devs Palace ERP Online up to 4.0.0.
A vulnerability was detected in Devs Palace ERP Online up to 4.0.0.
A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0.
A weakness has been identified in Devs Palace ERP Online up to 4.0.0.