Vendor: github

SQL injection in Django

2026-05-19 CVE-2020-9402

SQLFluff: Recursive Stack Overflow in Parser

2026-05-19 CVE-2026-46373

SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser

2026-05-19 CVE-2026-46374

Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover

2026-05-19 CVE-2026-46396

Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

2026-05-19 CVE-2026-45739

tar-rs incorrectly ignores PAX size headers if header size is nonzero

2026-05-19 CVE-2026-33055

Trubo: Login callback CSRF/session fixation

2026-05-19 CVE-2026-45773

Turbo: Unexpected local code execution during Yarn Berry detection

2026-05-19 CVE-2026-45772

Use of Hard-coded Cryptographic Key in Netmaker

2026-05-19 CVE-2022-23650

WebdriverIO BrowserStack Service has a Command Injection issue

2026-05-19 CVE-2026-25244

criticalGitHub GitHub 2026-W21

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

2026-05-19 CVE-2026-45799

Apache Tomcat - Digest authenticator will authenticate any unknown user

2026-05-18 CVE-2026-43512

criticalGitHub GitHub 2026-W21

Apache Tomcat - HTTP/2 request headers not validated

2026-05-18 CVE-2026-41293

criticalGitHub GitHub 2026-W21

Apache Tomcat - WebSocket authentication header exposure

2026-05-18 CVE-2026-42498

Apache Tomcat: LockOutRealm treats user names as case-sensitive

2026-05-18 CVE-2026-43513

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

2026-05-18 CVE-2026-41284

AVideo: Authenticated Arbitrary File Read in view/update.php

2026-05-18 CVE-2026-45731

Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

2026-05-18 GHSA-JGG6-4RPR-WFH7

Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration

2026-05-18 CVE-2026-45716

Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

2026-05-18 CVE-2026-45719

Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

2026-05-18 CVE-2026-45718

CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

2026-05-18 CVE-2026-45727

cowlib: Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

2026-05-18 CVE-2026-43969

Docker: `PUT /containers/{id}/archive` executes container binary on the host

2026-05-18 CVE-2026-41567

Docker: Race condition in docker cp allows bind mount redirection to host path

2026-05-18 CVE-2026-42306

Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

2026-05-18 CVE-2026-41568

Formie: Pre-authenticated server-side template injection in Hidden fields

2026-05-18 CVE-2026-45697

criticalGitHub GitHub 2026-W21

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

2026-05-18 CVE-2026-45367

ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

2026-05-18 CVE-2026-45624

ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

2026-05-18 CVE-2026-46520

ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

2026-05-18 CVE-2026-46521

ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.

2026-05-18 CVE-2026-46559

ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

2026-05-18 CVE-2026-46522

ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

2026-05-18 CVE-2026-45359

ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

2026-05-18 CVE-2026-45358

ImageMagick: Policy Bypass in MNG coder could

2026-05-18 CVE-2026-45664

ImageMagick: Policy Bypass in PSD decoder

2026-05-18 CVE-2026-45031

ImageMagick: Stack overflow in fx operation

2026-05-18 CVE-2026-46557

ImageMagick: Use-After-Free in MSL decoder.

2026-05-18 CVE-2026-46523

Malicious dropper in mistralai 2.4.6 PyPI package

2026-05-18 GHSA-WX9M-WX4F-4CMG

criticalGitHub GitHub 2026-W21

Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability

2026-05-18 CVE-2026-32175

Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability

2026-05-18 CVE-2026-35433

Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability

2026-05-18 CVE-2026-42899

multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing

2026-05-18 CVE-2026-8162

multiparty vulnerable to ReDoS via filename parsing

2026-05-18 CVE-2026-8159

multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception

2026-05-18 CVE-2026-8161

n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

2026-05-18 CVE-2026-45707

NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

2026-05-18 CVE-2026-45553

NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

2026-05-18 CVE-2026-45554

omec-project amf crashes when processing malformed LocationReports

2026-05-18 CVE-2026-8349

OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

2026-05-18 CVE-2026-45682

OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

2026-05-18 CVE-2026-45681

OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

2026-05-18 CVE-2026-45683

OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers

2026-05-18 CVE-2026-45684

OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

2026-05-18 CVE-2026-45686

OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

2026-05-18 CVE-2026-45685

OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

2026-05-18 CVE-2026-45678

OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

2026-05-18 CVE-2026-45679

OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

2026-05-18 CVE-2026-45680