Source: github

Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header

2026-05-13 CVE-2026-44242

Micronaut has unbounded `formattersCache` in `TimeConverterRegistrar` that Allows Memory Exhaustion via `Accept-Language` Header

2026-05-13 CVE-2026-44241

MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

2026-05-13 CVE-2026-42600

n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests

2026-05-13 CVE-2026-41495

n8n-mcp webhook and API client paths has an authenticated SSRF

2026-05-13 CVE-2026-44694

n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode

2026-05-13 CVE-2026-42282

Nautobot: GitRepository.current_head field should not be writable through REST API

2026-05-13 CVE-2026-44798

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

2026-05-13 CVE-2026-44796

Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference

2026-05-13 CVE-2026-44794

Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)

2026-05-13 CVE-2026-44797

net-imap has quadratic complexity when reading response literals

2026-05-13 CVE-2026-42245

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

2026-05-13 CVE-2026-42257

net-imap vulnerable to command Injection via unvalidated Symbol inputs

2026-05-13 CVE-2026-42258

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

2026-05-13 CVE-2026-42256

net-imap vulnerable to STARTTLS stripping via invalid response timing

2026-05-13 CVE-2026-42246

Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls

2026-05-13 CVE-2026-42856

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

2026-05-13 CVE-2026-41432

Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services

2026-05-13 CVE-2026-44015

NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

2026-05-13 CVE-2026-42072

criticalGitHub GitHub 2026-W20

nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

2026-05-13 CVE-2026-42202

Null pointer dereference in PKCS12 parsing

2026-05-13 CVE-2024-0727

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

2026-05-13 GHSA-VW82-7FV8-R6GP

criticalGitHub GitHub 2026-W20

OpAMP client reads unbounded HTTP response bodies

2026-05-13 CVE-2026-42348

open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`

2026-05-13 CVE-2026-42260

OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs

2026-05-13 GHSA-X3H8-JRGH-P8JX

OpenID Connect nonce generated but never validated — ID token replay attack

2026-05-13 CVE-2026-42206

OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

2026-05-13 CVE-2026-44720

OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

2026-05-13 CVE-2026-41511

OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints

2026-05-13 CVE-2026-40213

OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer

2026-05-13 CVE-2026-40214

OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter

2026-05-13 CVE-2026-42191

parse-server: MFA SMS one-time password accepted twice under concurrent login

2026-05-13 CVE-2026-43930

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

2026-05-13 CVE-2024-4367

Pelican Web UI Affected by a Privilege Escalation Attack

2026-05-13 CVE-2026-42571

criticalGitHub GitHub 2026-W20

pgx: SQL Injection via placeholder confusion with dollar quoted string literals

2026-05-13 CVE-2026-41889

phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

2026-05-13 CVE-2026-44167

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

2026-05-13 CVE-2026-40863

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

2026-05-13 CVE-2026-40902

phpVMS has an /importer authorization bypass causing full database wipe

2026-05-13 CVE-2026-42569

criticalGitHub GitHub 2026-W20

Pillow has a heap buffer overflow with nested list coordinates

2026-05-13 CVE-2026-42309

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

2026-05-13 CVE-2026-42310

Pillow has an integer overflow when processing fonts

2026-05-13 CVE-2026-42308

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

2026-05-13 CVE-2026-42311

PocketBase vulnerable to account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

2026-05-13 CVE-2026-44166

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

2026-05-13 CVE-2023-48795

pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider

2026-05-13 CVE-2026-42351

pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

2026-05-13 CVE-2026-42352

PyLoad Vulnerable to Path Traversal via Package Folder Name

2026-05-13 CVE-2026-42314

PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data

2026-05-13 CVE-2026-42315

PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI

2026-05-13 CVE-2026-44226

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

2026-05-13 CVE-2026-42312

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestric…

2026-05-13 CVE-2026-42313

pyp2spec is Vulnerable to Code Injection

2026-05-13 CVE-2026-42301

QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0

2026-05-13 CVE-2026-42339

quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

2026-05-13 CVE-2026-42333

Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

2026-05-13 CVE-2026-34763

Rack has Content-Length mismatch in Rack::Files error responses

2026-05-13 CVE-2026-34831