Total
4146 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-44874 | 1 Arubanetworks | 1 Arubaos | 2026-05-15 | N/A | 4.9 MEDIUM |
| A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability could result in the disclosure of confidential system information, potentially enabling further attacks against the affected device. | |||||
| CVE-2026-33381 | 2026-05-14 | N/A | 5.9 MEDIUM | ||
| When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this. | |||||
| CVE-2026-44007 | 1 Vm2 Project | 1 Vm2 | 2026-05-14 | N/A | 9.1 CRITICAL |
| vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1. | |||||
| CVE-2026-36738 | 2026-05-14 | N/A | 6.8 MEDIUM | ||
| U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authentication, authorization, or access control mechanisms. An attacker with physical access to the UART pins can connect to the interface and gain unrestricted access to device functionality. | |||||
| CVE-2026-32209 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-05-14 | N/A | 4.4 MEDIUM |
| Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally. | |||||
| CVE-2026-33834 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-05-14 | N/A | 7.8 HIGH |
| Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-43652 | 1 Apple | 1 Macos | 2026-05-14 | N/A | 7.5 HIGH |
| A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data. | |||||
| CVE-2026-42823 | 1 Microsoft | 1 Azure Logic Apps | 2026-05-14 | N/A | 9.9 CRITICAL |
| Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-41614 | 1 Microsoft | 1 365 Copilot | 2026-05-14 | N/A | 6.2 MEDIUM |
| Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally. | |||||
| CVE-2026-28930 | 1 Apple | 1 Macos | 2026-05-14 | N/A | 7.5 HIGH |
| A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protected user data. | |||||
| CVE-2026-44225 | 2026-05-14 | N/A | 9.3 CRITICAL | ||
| Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1. | |||||
| CVE-2026-42158 | 2026-05-14 | N/A | N/A | ||
| Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3. | |||||
| CVE-2026-40300 | 1 Zulip | 1 Zulip Server | 2026-05-13 | N/A | 6.5 MEDIUM |
| Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users' messages. This vulnerability is fixed in 12.0. | |||||
| CVE-2026-44341 | 2026-05-13 | N/A | 5.3 MEDIUM | ||
| GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data. | |||||
| CVE-2025-43524 | 1 Apple | 1 Macos | 2026-05-13 | N/A | 8.8 HIGH |
| An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.2. An app may be able to break out of its sandbox. | |||||
| CVE-2026-41487 | 1 Langfuse | 1 Langfuse | 2026-05-13 | N/A | 5.4 MEDIUM |
| Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-access control flaw in the LLM connection update flow. An authenticated, low-privileged user of role “member” in a project could request the update of an existing LLM connection to an attacker-controlled baseUrl, causing Langfuse to reuse the stored provider secret and redirect the test request to an attacker-controlled endpoint. This could expose the plaintext provider LLM API key for that connection. The attack is only possible if a user is already part of a project and has “member” scoped access. This issue has been patched in version 3.167.0. | |||||
| CVE-2026-42177 | 2026-05-13 | N/A | 5.3 MEDIUM | ||
| linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https://login.microsoftonline.com/*". Chrome's urlFilter without a | or || anchor is substring-matched against the full request URL. The same applied rule action is modifyHeaders that attaches the Entra ID Primary Refresh Token cookie. The Firefox adapter in platform/firefox/js/platform-firefox.js:53 performs a belt-and-braces startsWith(Platform.SSO_URL) check before injecting the header; the Chrome adapter does not. When the extension holds broad host permissions through the optional_host_permissions: ["https://*/*"] declared in platform/chrome/manifest.json:34, a main-frame navigation to a URL whose path embeds https://login.microsoftonline.com/ causes Chrome to attach the PRT cookie to the request to the attacker-controlled host. This vulnerability is fixed in 1.8.1. | |||||
| CVE-2026-44352 | 2026-05-13 | N/A | N/A | ||
| Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access Control allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3. | |||||
| CVE-2026-20887 | 2026-05-13 | N/A | N/A | ||
| Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. | |||||
| CVE-2026-8233 | 2026-05-13 | 4.0 MEDIUM | 4.6 MEDIUM | ||
| A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improper access controls. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The vendor was contacted early about this disclosure. | |||||