2026

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated atta

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Ma

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was publish

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a ne

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to a

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS de

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker t

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core

Microsoft Defender Denial of Service Vulnerability

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to el

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fi

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software all

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were publ

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before vers

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before ver

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authentic

A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthe

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges loc

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a netw

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypas

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket e

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated atta

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the render

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is abl

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory ove

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrar

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds m

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could al

Memory corruption while using alignments for memory allocation.

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this is

A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive info

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticat

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalys