Vendor: github

HAXcms createSite SSRF Enables Arbitrary File Read

2026-05-19 CVE-2026-46393

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

2026-05-19 CVE-2026-46511

HAXcms: Private Key Disclosure via Broken HMAC Implementation

2026-05-19 CVE-2026-46395

criticalGitHub GitHub 2026-W21

Improper date handling in Django

2026-05-19 CVE-2010-4535

Improper query string handling in Django

2026-05-19 CVE-2010-4534

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

2026-05-19 CVE-2026-45409

Jupyter Server open redirect vulnerability

2026-05-19 CVE-2020-26275

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

2026-05-19 GHSA-M23H-6MWM-39M8

Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint

2026-05-19 GHSA-3278-C88V-XRH4

Kopia: RCE via SSH ProxyCommand Injection

2026-05-19 CVE-2026-45695

criticalGitHub GitHub 2026-W21

libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case

2026-05-19 GHSA-FHVH-VW7H-9XF3

libcrux: Potential Panic on Overlong Ciphertext Buffer

2026-05-19 GHSA-HC3C-63HC-2R9F

Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer

2026-05-19 CVE-2026-45709

Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)

2026-05-19 CVE-2026-45712

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

2026-05-19 CVE-2026-45711

Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

2026-05-19 CVE-2026-45713

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

2026-05-19 CVE-2026-46412

criticalGitHub GitHub 2026-W21

Malware in @opensearch-project/opensearch

2026-05-19 GHSA-27F5-XJRR-Q9FF

criticalGitHub GitHub 2026-W21

MantisBT Has Authorization Bypass in Global Profile Creation

2026-05-19 CVE-2026-33052

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

2026-05-19 GHSA-G53W-W6MJ-HRPP

criticalGitHub GitHub 2026-W21

MCP Registry: OCI validator skips ownership check on upstream rate limits

2026-05-19 CVE-2026-45781

n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass

2026-05-19 GHSA-3875-8GCX-7V46

n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions

2026-05-19 GHSA-2VX9-7WPG-88JQ

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

2026-05-19 CVE-2025-49142

Netmaker has Hardcoded DNS Secret Key

2026-05-19 CVE-2023-32077

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

2026-05-19 CVE-2026-46342

Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

2026-05-19 CVE-2026-45670

Nuxt: Reflected XSS in `navigateTo()` external redirect

2026-05-19 CVE-2026-45669

Open redirect endpoint in Datasette

2026-05-19 CVE-2025-64481

Open WebUI Arbitrary File Write, Delete via Path Traversal

2026-05-19 CVE-2026-44565

Open WebUI Exposes System Prompt to Regular User [Non-Admin]

2026-05-19 CVE-2026-45351

Open WebUI has an Indirect Object Reference (IDOR) in user notes

2026-05-19 CVE-2026-45666

Open WebUI has Improper Authorization Control

2026-05-19 CVE-2026-44567

Open WebUI has inconsistent authorization controls within memories API

2026-05-19 CVE-2026-44570

Open WebUI has Stored Cross-Site Scripting In Profile Picture

2026-05-19 CVE-2026-45299

Open WebUI Has Stored Cross-Site Scripting in SVG Renderer

2026-05-19 CVE-2026-45346

Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order

2026-05-19 CVE-2026-45665

Open WebUI has stored XSS in Excel file preview

2026-05-19 CVE-2026-44549

Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

2026-05-19 CVE-2026-45315

Open WebUI has stored XSS via the HTML renedering view

2026-05-19 CVE-2026-45303

Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

2026-05-19 CVE-2026-45318

Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

2026-05-19 CVE-2026-45314

Open WebUI missing authorization check at the model update function - models from other users can be updated

2026-05-19 CVE-2026-45345

Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal

2026-05-19 CVE-2026-44566

Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function

2026-05-19 CVE-2026-45347

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

2026-05-19 CVE-2026-45317

Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)

2026-05-19 CVE-2026-45338

Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]

2026-05-19 CVE-2026-45365

Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

2026-05-19 CVE-2026-45301

Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)

2026-05-19 CVE-2026-45316

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

2026-05-19 CVE-2026-45667

Open WebUI's chat completion API allows tool restrictions to be bypassed

2026-05-19 CVE-2026-45350

Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission

2026-05-19 CVE-2026-44571

Open WebUI's Insecure Message Access Breaks Authorization

2026-05-19 CVE-2026-44569

OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution

2026-05-19 CVE-2026-45004

OpenClaw: Hook mapping templates could bypass hook session-key opt-in

2026-05-19 CVE-2026-45002

OpenClaw: Isolated cron awareness events were recorded as trusted system events

2026-05-19 CVE-2026-44999

OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

2026-05-19 CVE-2026-44995

OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners

2026-05-19 CVE-2026-44991