CVEs published May 25, 2026

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521.

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521.

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521.

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521.

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521.

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521.

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521.

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521.

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521.

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521.

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521.

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521.

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521.

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521.

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521.

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521.

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521.

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521.

For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection.

A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled.

A vulnerability has been found in Edimax EW-7438RPn 1.31.

A flaw has been found in Edimax EW-7438RPn 1.31.

A vulnerability was detected in Edimax EW-7438RPn 1.31.

A security vulnerability has been detected in Edimax EW-7438RPn 1.31.

A flaw has been found in Edimax EW-7438RPn 1.31.

A vulnerability was detected in Edimax EW-7438RPn 1.31.

A security vulnerability has been detected in Edimax EW-7438RPn 1.31.

A weakness has been identified in Edimax EW-7438RPn 1.31.

A security flaw has been discovered in Edimax EW-7438RPn 1.31.

A security vulnerability has been detected in Edimax BR-6478AC 1.23.

A weakness has been identified in Edimax BR-6478AC 1.23.

A vulnerability was identified in Tenda F1202 1.2.0.20(408).

A vulnerability was determined in Tenda F1202 1.2.0.20(408).

A vulnerability was found in Tenda F1202 1.2.0.20(408).

A vulnerability has been found in Tenda F1202 1.2.0.20(408).

A flaw has been found in Edimax EW-7438RPn 1.31.

A vulnerability was detected in Edimax EW-7438RPn 1.31.

A security vulnerability has been detected in Edimax EW-7438RPn 1.31.

Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation.

NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions.

An OS Command Injection vulnerability exists in Aterm.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection.

Kenik Camera management Panel is vulnerable to Path Traversal vulnerability.

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers…

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed…

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. hackney_h3:await_response_loop/6 accumulates the HTTP/3 response body in memory without any size cap.

Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query…

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting.

Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding.

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding.

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation.

Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.

Missing Authorization vulnerability in edward_plainview MyCryptoCheckout allows Exploiting Incorrectly Configured Access Control Security Levels.

A vulnerability was found in yashpokharna2555 StudentManagementSystem up to cb2f558ddf8d19396de0f92abf2d224d46a0a203.

A security vulnerability has been detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203.

A weakness has been identified in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203.

A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0.

A vulnerability was detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125.

A security vulnerability has been detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125.

A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0.

A vulnerability was identified in KLiK SocialMediaWebsite 1.0.

A vulnerability was determined in KLiK SocialMediaWebsite 1.0.

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with…

Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g.,…

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection.

Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery.

SQL Injection affecting the Access Manager role.

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an…

The remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

Remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.

Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS.

Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommerce allows Password Recovery Exploitation.

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.

Default configurations of Apache Shiro have a session fixation vulnerability.

Missing Authorization vulnerability in SePay team SePay Gateway allows Retrieve Embedded Sensitive Data.

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk.

Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Forgery.

A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510.

A weakness has been identified in Totolink CA750-PoE 6.2c.510.

A security flaw has been discovered in Totolink CA750-PoE 6.2c.510.

A vulnerability was identified in Totolink CA750-PoE 6.2c.510.

A vulnerability has been found in Dromara lamp-cloud up to 5.6.2.

A flaw has been found in changmingxie tcc-transaction up to 2.1.0.

A vulnerability was determined in SourceCodester Student Grades Management System 1.0.

A vulnerability was found in SourceCodester Student Grades Management System 1.0.

A vulnerability has been found in c-rick jimeng-mcp 1.10.0.

A flaw has been found in dazeb markdown-downloader up to 3d4394b34b6c99d81af817623af55e3384df5a6a.

A security flaw has been discovered in dazeb cline-mcp-memory-bank up to 55c81b9cf6c16700983c84dc4cdea3cafa19a75f.

A weakness has been identified in code-projects Employee Management System 1.0.

A security flaw has been discovered in code-projects Employee Management System 1.0.

A vulnerability was identified in code-projects Employee Management System 1.0.

A flaw has been found in SourceCodester Simple POS and Inventory System 1.0.

A security flaw has been discovered in Edimax BR-6478AC 1.23.

A vulnerability was identified in Edimax BR-6478AC 1.23.

A vulnerability was determined in Edimax BR-6675nD 1.12.

A vulnerability has been found in DTStack Taier 1.4.0.

A weakness has been identified in Edimax EW-7438RPn 1.31.

A vulnerability was found in KLiK SocialMediaWebsite 1.0.

A vulnerability was determined in SourceCodester Indian Invoicing System 1.0.

A vulnerability was found in SourceCodester Indian Invoicing System 1.0.

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.

Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data.

A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.

A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor.

A vulnerability was found in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203.

Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces.

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.

With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro.

Missing Authorization vulnerability in Linethemes NanoCare allows Exploiting Incorrectly Configured Access Control Security Levels.

Missing Authorization vulnerability in Themeansar Newses allows Exploiting Incorrectly Configured Access Control Security Levels.

A vulnerability was identified in GNU LibreDWG up to 0.14.

A vulnerability was found in GNU LibreDWG up to 0.14.

A vulnerability was determined in Tiandy Easy7 Integrated Management Platform 7.17.0.

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Response Splitting.

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication.

OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter.

Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels.

Missing Authorization vulnerability in Cornel Raiu WP Search Analytics allows Exploiting Incorrectly Configured Access Control Security Levels.

Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.

Missing Authorization vulnerability in Ruben Garcia GamiPress allows Exploiting Incorrectly Configured Access Control Security Levels.

This vulnerability exists in CP Plus Wi-Fi Camera due to improper protection of sensitive information in runtime memory.

Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope.

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels.

A cross-site scripting vulnerability exists in Aterm.

A vulnerability has been found in YunaiV yudao-cloud 2026.03.

A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0.

A vulnerability was detected in SourceCodester Simple POS and Inventory System 1.0.

A security flaw has been discovered in Edimax BR-6675nD 1.12.

An unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

A security flaw has been discovered in SourceCodester Student Grades Management System 1.0.

A vulnerability was identified in debugmcp mcp-debugger up to 0.20.0.

A vulnerability was determined in code-projects Employee Management System 1.0.

A vulnerability has been found in code-projects Employee Management System 1.0.

A flaw has been found in code-projects Employee Management System 1.0.

A vulnerability was detected in code-projects Employee Management System 1.0.

A security vulnerability has been detected in code-projects Employee Management System 1.0.

A weakness has been identified in code-projects Employee Management System 1.0.

A vulnerability was identified in SourceCodester Indian Invoicing System 1.0.

A vulnerability has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b.

A flaw has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b.

Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart allows Cross Site Request Forgery.

Missing Authorization vulnerability in WPPOOL FlexTable allows Exploiting Incorrectly Configured Access Control Security Levels.

Cross-Site Request Forgery (CSRF) vulnerability in Convers Lab WPSubscription allows Cross Site Request Forgery.

Missing Authorization vulnerability in Nikki Blight QR Redirector allows Exploiting Incorrectly Configured Access Control Security Levels.

Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels.

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

PuTTY 0.72 before 0.84 has a double free in RSA KEX.

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.

A vulnerability was identified in SourceCodester Student Grades Management System 1.0.

A vulnerability was detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203.

A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0.

A weakness has been identified in GNU LibreDWG up to 0.14.

A security flaw has been discovered in GNU LibreDWG up to 0.14.

A vulnerability was determined in GNU LibreDWG up to 0.14.

PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.