CVEs published May 19, 2026

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote…

CtrlPanel is open-source billing software for hosting providers.

The handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap…

Integer overflow in the Networking: JAR component.

A Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.

An OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing.

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and…

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to, and including, 2.1.40.

Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest,…

Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06.

Tyler Identity Local (TID-L) uses documented, default administrative credentials.

The following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY.

An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter.

An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7.

The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization.

The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration.

scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy endpoint.

scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar_url query parameter of the Scalar Proxy endpoint.

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.

Sandbox escape due to use-after-free in the Disability Access APIs component.

The MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints.

A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler.

Same-origin policy bypass in the Networking: HTTP component.

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input.

Same-origin policy bypass in the DOM: Networking component.

A Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware.

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console.

Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150.

Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150.

Memory safety bugs present in Thunderbird 150.

Privilege escalation in the WebRTC: Audio/Video component.

Privilege escalation in the Security component.

Privilege escalation in the Enterprise Policies component.

Privilege escalation in the DOM: Workers component.

Privilege escalation in the Application Update component.

A CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.

Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz.

Sparx Pro Cloud Server requires authentication based on requested URL.

Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database.

A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7.

Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma…

BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository.

in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.

Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected system

Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role.

CtrlPanel is open-source billing software for hosting providers.

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods.

Information disclosure, sandbox escape in the Security: Process Sandboxing component.

Versions 2.28.1 and prior contain a Stored XSS vulnerability.

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris x64, Solaris Sparc 64 allows…

An improper authentication vulnerability was discovered in the Motorola Factory Test component (com.motorola.motocit).

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection.

The extension fails to properly sanitize user input before using it in a database query.

Mitigation bypass in the DOM: Security component.

Mitigation bypass in the DOM: Security component.

NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the…

A flaw was found in Keycloak's URL validation logic during redirect operations.

Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated…

CtrlPanel is open-source billing software for hosting providers.

in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.

Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.

Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.

Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.

The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the…

The backend deserializes Redis cache bytes using pickle.loads without integrity/authenticity checks.

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component.

Information disclosure in the Graphics: WebGPU component.

Information disclosure in the IP Protection component.

Information disclosure in the DOM: Security component.

Spoofing issue in the Popup Blocker component.

Spoofing issue in the Web Speech component.

Spoofing issue in WebExtensions.

Incorrect boundary conditions, integer overflow in the Audio/Video component.

Integer overflow in the Widget: Win32 component.

Incorrect boundary conditions in the Audio/Video: Web Codecs component.

Sandbox escape in Firefox and Firefox Focus for Android.

The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6.

This affects versions of the package exifreader before 4.39.0.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the…

A session fixation vulnerability was found in Keycloak's login-actions endpoints.

A flaw was found in Keycloak.

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode.

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when…

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) when running in…

Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and…

HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the…

Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to be executed by sending an specially crafted SQL query.

Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint.

Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately.

Versions 0.4.2 through 0.6.51 are vulnerable to an unauthenticated Denial of Service (DoS) through the server due to uncontrolled disk space consumption.

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz.

Use-after-free in the DOM: Bindings (WebIDL) component.

An authorization vulnerability exists in Innoshop 0.6.0.

When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade.

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize().

A flaw was found in Keycloak.

Versions 1.21.2 and prior contain a heap buffer over-read in HeifPixelImage::overlay() in libheif/pixelimage.cc.

Versions 1.21.2 and below contain a heap buffer overflow in MaskImageCodec::decode_mask_image().

The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment.

A flaw was found in Keycloak.

A flaw was found in Keycloak.

Versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents through both the…

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.

CtrlPanel is open-source billing software for hosting providers.

Same-origin policy bypass in the Networking: JAR component.

Spoofing issue in the Form Autofill component.

Spoofing issue in the Toolbar component in Firefox for Android.

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in…

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6.

Improper Authorization vulnerability in Apache OFBiz Webtools.

A flaw was found in Keycloak.

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.

CtrlPanel is open-source billing software for hosting providers.

When decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an…

A crafted 800-byte HEIF sequence file causes an infinite loop in Box_stts::get_sample_duration(), consuming 100% CPU indefinitely with zero progress, leading to DoS.

A crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to…

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.

Improper Input Validation vulnerability in Apache OFBiz.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

in OpenHarmony v6.0 and prior versions allow a local attacker arbitrary code execution.

Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering.

A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter.

Due to improper permission control of the Web interface, an unauthorized attacker can  modify configuration through the interface.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS).

Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code…

The file indexer does not normalize the configured directory path.

The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names.

The OOXML parsing of the file indexer does not disable external entity resolution.

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections.

When NanoMQ handles high-concurrency reconnect traffic using a reconnect-collision payload, the broker can crash due to a NULL pointer dereference during MQTT session resumption for clean_start=0 clients.

A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter.

A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter.

A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter.

Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records.

Versions 3.5.2 and prior contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them, related to but not fully fixed by the prior patch in #14289.

Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation.

Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation.

Improper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation.

Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation.

Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation.

Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads.

NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation.

NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containing deeply nested instructions.

The following vulnerability has been resolved: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Yiming reports an integer underflow in mpi_read_raw_from_sgl() when subtracting "lzeros"…

The following vulnerability has been resolved: net: qrtr: ns: Limit the maximum server registration per node Current code does no bound checking on the number of servers added per node.

in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak.

in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak

A flaw was found in Keycloak.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS).

A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7.

Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in…

In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g.…

An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors.

Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue created by another user even after it becomes private, bypassing read access revocation.

Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monitoring feature .

2026.3.1, 2026.4.1 and 2026.5.0-latest.1, a vulnerability in the discourse-subscriptions plugin allows users to gain access to subscription-gated groups without completing payment.

Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by…

The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any…

2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak removed content to anonymous and unprivileged users who cannot regenerate summaries.

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.

Improper Authentication vulnerability in Apache OFBiz.

Versions 2.28.1 and prior have a Privilege Escalation vulnerability where insufficient access control checks in ProjectUsersAddCommand (manage_proj_user_add.php) allow users having manage_project_threshold…

SendEmailBlock in autogpt_platform/backend/backend/blocks/email_block.py accepts a user-supplied smtp_server (string) and smtp_port (integer) as per-execution block inputs, then passes them directly to…

A flaw was found in Keycloak.

CtrlPanel is open-source billing software for hosting providers.

An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter.

A flaw was found in Keycloak.

Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels.

A flaw was found in Keycloak.

2026.3.1, 2026.4.1 and 2026.5.0-latest.1, an authenticated user on a Discourse instance with the form templates feature enabled can read the name and structured content of form templates that are intended…

An authenticated user with forms READ permission can export the structure of unauthorized forms.

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing.

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.

Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing.

The network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command usage information.

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system…

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build…

Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object (rather than a String) to Faraday::Connection#build_exclusive_url.