Vendor: github

OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

2026-05-19 CVE-2026-44992

OpenClaw's ACP child sessions inherit subagent security envelope constraints

2026-05-19 CVE-2026-44997

OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload

2026-05-19 CVE-2026-45005

OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle

2026-05-19 CVE-2026-45785

OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices

2026-05-19 CVE-2026-44919

OpenStack Nova Information leak in libvirt LVM-backed instances

2026-05-19 CVE-2012-5625

ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

2026-05-19 GHSA-XM96-GFJX-JCRC

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

2026-05-19 CVE-2026-45805

podman kube play symlink traversal vulnerability

2026-05-19 CVE-2025-9566

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

2026-05-19 CVE-2026-45740

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

2026-05-19 CVE-2026-46338

rmcp Streamable HTTP server transport has a DNS rebinding vulnerability

2026-05-19 CVE-2026-42559

rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

2026-05-19 CVE-2026-45568

criticalGitHub GitHub 2026-W21

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

2026-05-19 CVE-2026-45784

SaltStack Salt Directory traversal vulnerability in minion id validation

2026-05-19 CVE-2017-12791

criticalGitHub GitHub 2026-W21

scim_proton and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion

2026-05-19 CVE-2026-46689

Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString

2026-05-19 GHSA-24C8-4792-22HX

SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

2026-05-19 CVE-2026-46372

SimpleSAMLphp casserver: Open Redirect in logout

2026-05-19 CVE-2025-65954

SQL injection in Django

2026-05-19 CVE-2020-9402

SQLFluff: Recursive Stack Overflow in Parser

2026-05-19 CVE-2026-46373

SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser

2026-05-19 CVE-2026-46374

Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover

2026-05-19 CVE-2026-46396

Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

2026-05-19 CVE-2026-45739

tar-rs incorrectly ignores PAX size headers if header size is nonzero

2026-05-19 CVE-2026-33055

Trubo: Login callback CSRF/session fixation

2026-05-19 CVE-2026-45773

Turbo: Unexpected local code execution during Yarn Berry detection

2026-05-19 CVE-2026-45772

Use of Hard-coded Cryptographic Key in Netmaker

2026-05-19 CVE-2022-23650

WebdriverIO BrowserStack Service has a Command Injection issue

2026-05-19 CVE-2026-25244

criticalGitHub GitHub 2026-W21

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

2026-05-19 CVE-2026-45799

Apache Tomcat - Digest authenticator will authenticate any unknown user

2026-05-18 CVE-2026-43512

criticalGitHub GitHub 2026-W21

Apache Tomcat - HTTP/2 request headers not validated

2026-05-18 CVE-2026-41293

criticalGitHub GitHub 2026-W21

Apache Tomcat - WebSocket authentication header exposure

2026-05-18 CVE-2026-42498

Apache Tomcat: LockOutRealm treats user names as case-sensitive

2026-05-18 CVE-2026-43513

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

2026-05-18 CVE-2026-41284

AVideo: Authenticated Arbitrary File Read in view/update.php

2026-05-18 CVE-2026-45731

Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

2026-05-18 GHSA-JGG6-4RPR-WFH7

Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration

2026-05-18 CVE-2026-45716

Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

2026-05-18 CVE-2026-45719

Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

2026-05-18 CVE-2026-45718

CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

2026-05-18 CVE-2026-45727

cowlib: Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

2026-05-18 CVE-2026-43969

Docker: `PUT /containers/{id}/archive` executes container binary on the host

2026-05-18 CVE-2026-41567

Docker: Race condition in docker cp allows bind mount redirection to host path

2026-05-18 CVE-2026-42306

Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

2026-05-18 CVE-2026-41568

Formie: Pre-authenticated server-side template injection in Hidden fields

2026-05-18 CVE-2026-45697

criticalGitHub GitHub 2026-W21

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

2026-05-18 CVE-2026-45367

ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

2026-05-18 CVE-2026-45624

ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

2026-05-18 CVE-2026-46520

ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

2026-05-18 CVE-2026-46521

ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.

2026-05-18 CVE-2026-46559

ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

2026-05-18 CVE-2026-46522

ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

2026-05-18 CVE-2026-45359

ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

2026-05-18 CVE-2026-45358

ImageMagick: Policy Bypass in MNG coder could

2026-05-18 CVE-2026-45664

ImageMagick: Policy Bypass in PSD decoder

2026-05-18 CVE-2026-45031

ImageMagick: Stack overflow in fx operation

2026-05-18 CVE-2026-46557

ImageMagick: Use-After-Free in MSL decoder.

2026-05-18 CVE-2026-46523