Source: github

Caddy Defender trusted proxy client IP bypass

2026-05-19 CVE-2026-46415

Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

2026-05-19 CVE-2026-45692

Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching

2026-05-19 GHSA-GX7W-56W6-G48X

CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

2026-05-19 GHSA-7HGR-7H44-33W2

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

2026-05-19 CVE-2026-46354

criticalGitHub GitHub 2026-W21

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

2026-05-19 CVE-2026-45796

Cowboy: Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

2026-05-19 CVE-2026-8466

cowlib: Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

2026-05-19 CVE-2026-43970

Cross-site request forgery in Django

2026-05-19 CVE-2011-0696

Cross-site scripting in django

2026-05-19 CVE-2011-0697

Cross-site Scripting in Ericsson CodeChecker

2026-05-19 CVE-2021-44217

Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

2026-05-19 CVE-2026-46378

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

2026-05-19 CVE-2026-46377

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

2026-05-19 GHSA-M9P2-FXP5-V3FP

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

2026-05-19 GHSA-Q8X8-JRHJ-FH9P

Envoy AI Proxy - MCP Message Smuggling Vulnerability

2026-05-19 GHSA-4GPH-2HHR-5MWG

fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

2026-05-19 CVE-2026-45581

FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

2026-05-19 CVE-2026-27964

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

2026-05-19 CVE-2026-27892

Fava time and filter parameters vulnerable to reflected Cross-site Scripting

2026-05-19 CVE-2022-2514

FileBrowser Quantum: unauthenticated user share share info

2026-05-19 CVE-2026-46410

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

2026-05-19 CVE-2024-6221

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

2026-05-19 CVE-2026-45802

Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

2026-05-19 CVE-2026-45793

GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

2026-05-19 CVE-2026-45803

Gradio Path Traversal vulnerability

2026-05-19 CVE-2024-0964

HashiCorp Nomad vulnerable to a path traversal

2026-05-19 CVE-2026-7474

HashiCorp Nomad vulnerable to symlink attack

2026-05-19 CVE-2026-6959

HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack

2026-05-19 CVE-2026-8052

HAX CMS: Denial of Service using Malicious Import Request

2026-05-19 CVE-2026-46357

HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft

2026-05-19 CVE-2026-46496

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

2026-05-19 CVE-2026-46391

HAXcms createSite SSRF Enables Arbitrary File Read

2026-05-19 CVE-2026-46393

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

2026-05-19 CVE-2026-46511

HAXcms: Private Key Disclosure via Broken HMAC Implementation

2026-05-19 CVE-2026-46395

criticalGitHub GitHub 2026-W21

Improper date handling in Django

2026-05-19 CVE-2010-4535

Improper query string handling in Django

2026-05-19 CVE-2010-4534

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

2026-05-19 CVE-2026-45409

Jupyter Server open redirect vulnerability

2026-05-19 CVE-2020-26275

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

2026-05-19 GHSA-M23H-6MWM-39M8

Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint

2026-05-19 GHSA-3278-C88V-XRH4

Kopia: RCE via SSH ProxyCommand Injection

2026-05-19 CVE-2026-45695

criticalGitHub GitHub 2026-W21

libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case

2026-05-19 GHSA-FHVH-VW7H-9XF3

libcrux: Potential Panic on Overlong Ciphertext Buffer

2026-05-19 GHSA-HC3C-63HC-2R9F

Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

2026-05-19 CVE-2026-45709

Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

2026-05-19 CVE-2026-45712

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

2026-05-19 CVE-2026-45711

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

2026-05-19 CVE-2026-45713

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

2026-05-19 CVE-2026-46412

criticalGitHub GitHub 2026-W21

Malware in @opensearch-project/opensearch

2026-05-19 GHSA-27F5-XJRR-Q9FF

criticalGitHub GitHub 2026-W21

MantisBT Has Authorization Bypass in Global Profile Creation

2026-05-19 CVE-2026-33052

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

2026-05-19 GHSA-G53W-W6MJ-HRPP

criticalGitHub GitHub 2026-W21

MCP Registry: OCI validator skips ownership check on upstream rate limits

2026-05-19 CVE-2026-45781

n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass

2026-05-19 GHSA-3875-8GCX-7V46

n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions

2026-05-19 GHSA-2VX9-7WPG-88JQ

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

2026-05-19 CVE-2025-49142

Netmaker has Hardcoded DNS Secret Key

2026-05-19 CVE-2023-32077

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

2026-05-19 CVE-2026-46342

Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

2026-05-19 CVE-2026-45670