THREAT ALERT

ACT NOW CVE-2026-41940 9.3 Authentication bypass in cPanel & WHM allows unauthenticated remote attackers to gain unauthorized access to the control panel by exploiting a flaw in the login flow. The vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, an EPSS score of 16.52% (95th percentile), and affects multiple long-term support branches of cPanel & WHM as well as WP Squared. Given that cPanel administers shared hosting environments, successful exploitation typically grants attackers control over many downstream customer sites. | ACT NOW CVE-2026-31431 7.8 Memory corruption in Linux kernel's algif_aead cryptographic interface allows local authenticated users to achieve arbitrary kernel memory read/write, leading to privilege escalation to root. The vulnerability stems from improper handling of in-place operations introduced in commit 72548b093ee3, affecting kernel versions from 4.14 through 6.19.x. Multiple public exploit codes exist including proof-of-concept demonstrations from security researchers, with EPSS score of 0.01% indicating currently low widespread exploitation likelihood despite POC availability. | ACT NOW CVE-2026-32201 6.5 Improper input validation in Microsoft SharePoint Server enables network-based spoofing attacks without authentication, allowing attackers to forge communications and deceive users. Affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, making it a critical operational priority despite the moderate CVSS score of 6.5. | ACT NOW CVE-2026-33825 7.8 Privilege escalation in Microsoft Defender Antimalware Platform versions before 4.18.26030.3011 allows authenticated local attackers to gain elevated system privileges through insufficiently granular access controls. CVSS 7.8 (High) reflects local attack vector requiring low privileges. EPSS score of 0.04% (12th percentile) indicates low probability of widespread exploitation. Microsoft has released a patched version (4.18.26030.3011) addressing the access control deficiency. | ACT NOW CVE-2026-32202 4.3 Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a network without authentication, requiring only user interaction. This low-severity vulnerability affects multiple Windows versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. While not actively exploited in the wild, vendor patches are available across all affected versions, and the low CVSS score (4.3) reflects limited confidentiality impact and no availability impact despite the network-accessible attack vector. | ACT NOW CVE-2026-34621 8.6 Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execution in user context via malicious PDF files. Attack requires user interaction to open a crafted document. CVSS 9.6 (Critical) reflects network-deliverable code execution with scope change, though EPSS 0.24% (46th percentile) suggests moderate real-world exploitation probability. No public exploit identified at time of analysis. | ACT NOW CVE-2026-39987 9.3 Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/terminal/ws` WebSocket endpoint. The terminal handler skips authentication validation entirely, accepting connections without credential checks and spawning PTY shells directly. Attackers obtain full interactive shell access as root in default Docker deployments through a single WebSocket connection, bypassing Marimo's authentication middleware. No public exploit identified at time of analysis. | ACT NOW CVE-2026-34197 8.8 Remote code execution in Apache ActiveMQ Classic versions before 5.19.5 and 6.0.0-6.2.2 allows authenticated attackers to execute arbitrary code on the broker's JVM via Jolokia MBean operations. Attackers with low-privilege web console access can invoke BrokerService.addNetworkConnector() with a malicious discovery URI containing a VM transport brokerConfig parameter that loads remote Spring XML contexts, triggering bean instantiation and code execution through factory methods like Runtime.exec( | EMERGENCY CVE-2026-35616 9.8 Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execute arbitrary code via crafted network requests. The vulnerability stems from improper access control (CWE-284) and requires no user interaction or privileges (CVSS PR:N). With a CVSS score of 9.1 (Critical) and low attack complexity, this represents a severe exposure for organizations using affected FortiClientEMS versions. The CVSS temporal metrics indicate functional exploit code exists (E:F) with an official fix available (RL:O), making this a high-priority patching target despite no confirmed active exploitation (not present in CISA KEV). |

Daily vulnerability intelligence for defenders – fresh CVEs with exploitability signals, patch status, and action-oriented priorities from 17 sources.

CVEs published

Get CVEs that hit your stack — not 200/day

Pick your technologies, get a weekly digest by email. Free, no spam.

React Python Postgres +200 more

React Next.js Python Postgres AWS +200 more

Trending Now See all

Critical Watch See all

Attack Technique Trend

Prediction based on ZDI Disclosures & CVE data · 30 days

Analytics

Vendor Today – Quick Filter

Techniques

results

Sort:

Base Score

Vector String

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

Integrity (I)

Availability (A)

0 | 3.9| 6.9| 8.9| 10

NONE LOW MEDIUM HIGH CRITICAL

CVSS Filter – CVEs match

No CVEs match the selected criteria

Incoming 20

Pre-NVD – not yet scored

Browse older vulnerabilities in Archive

Live Feed auto-refresh 60s

Vulnerability Intelligence — May 03, 2026

40 CVEs tracked today. 0 Critical, 5 High, 10 Medium, 25 Low.

CVE-2026-7685 HIGH CVSS 7.4
Buffer overflow in Edimax BR-6208AC router firmware version 1.02 allows authenticated remote attackers to achieve complete system compromise via crafted pptpDfGateway parameter to /goform/setWAN endpoint. Public exploit code exists (EPSS probability unknown, not in CISA KEV). The vendor was notified but did not respond, leaving users without official remediation guidance. Attack requires only low-privilege authentication (PR:L) with network access and low complexity (AC:L), making this readily exploitable against internet-exposed management interfaces.

Buffer Overflow
CVE-2026-7684 HIGH CVSS 7.4
Buffer overflow in Edimax BR-6428nC router firmware (version 1.16 and earlier) allows authenticated remote attackers to execute arbitrary code via crafted pptpDfGateway parameter in the /goform/setWAN endpoint. A public proof-of-concept exploit exists demonstrating stack overflow exploitation. EPSS data not available, but the combination of remote attack vector, low complexity, and published exploit code indicates elevated real-world risk for exposed devices with default credentials.

Buffer Overflow
CVE-2026-7675 HIGH CVSS 7.4
Buffer overflow in Shenzhen Libituo Technology LBT-T300-HW1 router firmware versions up to 1.2.8 allows remote authenticated attackers to achieve complete system compromise via crafted Channel/ApCliSsid parameters to /apply.cgi endpoint. Publicly available exploit code exists (GitHub POC), enabling attackers to execute arbitrary code and gain full control of affected devices. EPSS data not available, but combination of public exploit (CVSS E:P) and network-accessible attack vector represents elevated risk for internet-facing router deployments. Vendor unresponsive to disclosure.

Buffer Overflow
CVE-2026-7674 HIGH CVSS 8.7
Buffer overflow in Shenzhen Libituo Technology LBT-T300-HW1 router (versions up to 1.2.8) allows authenticated remote attackers to achieve complete system compromise via crafted VPN server parameters in the web management interface. The vulnerability affects the start_single_service function when processing vpn_pptp_server or vpn_l2tp_server arguments, resulting in high impact to confidentiality, integrity, and availability. EPSS score not available; no CISA KEV listing indicates targeted rather than widespread exploitation. Public technical documentation exists on GitHub. Vendor non-responsive to disclosure, indicating no official patch likely available.

Buffer Overflow
CVE-2026-5063 HIGH CVSS 7.2
Stored Cross-Site Scripting in NEX-Forms WordPress plugin versions ≤9.1.11 allows unauthenticated remote attackers to inject malicious JavaScript through crafted POST parameter key names during form submission. Exploitation requires no authentication (CVSS PR:N) and persists across page loads, affecting any user viewing injected content. The CVSS vector indicates changed scope (S:C), meaning attackers can impact resources beyond the vulnerable component's security scope. No active exploitation confirmed via CISA KEV at time of analysis, but WordPress XSS vulnerabilities typically see rapid weaponization once disclosed.

WordPress XSS
CVE-2026-40561 MEDIUM CVSS 5.3
HTTP request smuggling in Starlet through version 0.31 allows remote unauthenticated attackers to bypass header validation by exploiting incorrect precedence of Content-Length over Transfer-Encoding headers. The vulnerability violates RFC 7230 section 3.3.3, which mandates that Transfer-Encoding must take precedence when both headers are present. An attacker positioned between a client and Starlet-based backend can craft malicious requests that are interpreted differently by a front-end reverse proxy and the Starlet server, enabling request smuggling attacks with integrity impact.

Information Disclosure Request Smuggling
CVE-2026-7703 MEDIUM CVSS 5.5
Code injection via Websocket API in AV Stumpfl Pixera Two Media Server ≤25.2 R2 allows unauthenticated remote attackers to execute arbitrary code with low complexity. Publicly available exploit code (GitHub Gist) enables network-based compromise with partial impact to confidentiality, integrity, and availability (CVSS:3.1/C:L/I:L/A:L). Vendor-released patch version 25.2 R3 addresses the vulnerability. Despite network vector and proof-of-concept availability, no CISA KEV listing or EPSS data indicates limited observed exploitation at time of analysis.

RCE Code Injection
CVE-2026-7702 MEDIUM CVSS 5.5
Authorization bypass in AFFiNE up to version 0.26.3 allows remote unauthenticated attackers to access restricted document previews through the Public Markdown Preview Endpoint (/workspace/:workspaceId/:docId). The allowDocPreview function fails to properly validate access permissions, enabling attackers to retrieve sensitive document content without authentication. Public exploit code is available, and the vendor has not responded to early disclosure attempts.

Authentication Bypass
CVE-2026-7698 MEDIUM CVSS 5.5
OS command injection in Tiandy Easy7 Integrated Management Platform 7.17.0 allows remote unauthenticated attackers to execute arbitrary system commands via the 'week' parameter in the /Easy7/rest/systemInfo/updateDbBackupInfo endpoint. The vulnerability has publicly available exploit code and is being actively tracked; the vendor has not responded to disclosure attempts.

Command Injection
CVE-2026-7695 MEDIUM CVSS 5.5
SQL injection in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 allows remote unauthenticated attackers to read, modify, or delete database contents via the fCircuitids parameter in /SubstationWEBV2/main/elecMaxMinAvgValue endpoint. Publicly available exploit code exists (VulDB 360864) with low attack complexity (CVSS AC:L), enabling attackers to compromise confidentiality, integrity, and availability of backend data. EPSS data unavailable; not listed in CISA KEV. Vendor was notified but remains unresponsive, suggesting no official patch timeline.

SQLi
CVE-2026-7694 MEDIUM CVSS 5.5
SQL injection in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0 allows remote unauthenticated attackers to manipulate the fCircuitids parameter in the /SubstationWEBV2/main/elecMaxMinAvgValue endpoint, leading to unauthorized database queries and potential information disclosure. Publicly available exploit code exists and the vulnerability affects a widely used industrial energy management system with no vendor response or patch confirmation.

SQLi
CVE-2026-7686 MEDIUM CVSS 5.5
Improper access controls in Adblock Plus up to version 4.36.2 on Chrome allow unauthenticated remote attackers to bypass Premium activation controls via manipulation of the postMessage function in premium.preload.js, granting temporary trial access to Premium features. The vulnerability affects a deprecated legacy activation flow and has publicly available exploit code; however, vendor analysis indicates the practical impact is limited because the licensing server issues only short-lived trial licenses (approximately 24 hours) that expire on next validation against real subscriptions, and the exploit has not been weaponized at scale.

Authentication Bypass Google
CVE-2026-7681 MEDIUM CVSS 5.5
Authorization bypass in jsbroks COCO Annotator up to version 0.11.1 allows remote unauthenticated attackers to modify dataset parameters via manipulation of the DatasetId argument in the Dataset API endpoint backend/webserver/api/datasets.py, enabling unauthorized access to and modification of annotation datasets. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications.

Authentication Bypass
CVE-2026-7679 MEDIUM CVSS 5.5
Authentication bypass in YunaiV yudao-cloud (versions up to 2026.01) allows remote unauthenticated attackers to obtain unauthorized access tokens via manipulation of the getAccessToken function in OAuth2TokenServiceImpl.java. Public exploit code exists (GitHub PoC available), enabling attackers to bypass authentication controls and gain low-level access to confidential data, integrity, and availability. EPSS risk assessment unavailable, but the combination of network attack vector, low complexity (AC:L), no authentication requirement (PR:N), and publicly available exploit creates immediate exploitation risk. Vendor was notified but did not respond, leaving no official patch timeline.

Authentication Bypass Java
CVE-2026-5337 MEDIUM CVSS 6.5
Frontend File Manager Plugin for WordPress through version 23.6 allows authenticated Subscriber-level users and higher to read arbitrary files belonging to other users via insecure direct object reference (IDOR) in the download endpoint. By manipulating the 'file_id' parameter, attackers can bypass authorization checks and access sensitive data stored by administrators and other privileged users. Publicly available exploit code exists for this vulnerability, though EPSS scoring (0.02%) suggests limited real-world exploitation relative to its high CVSS rating.

WordPress Authentication Bypass Information Disclosure
CVE-2026-7709 LOW CVSS 2.1
Improper authorization in Calibre-Web up to version 0.6.26 allows authenticated remote attackers to manipulate the user_id parameter in the generate_auth_token function (cps/kobo_auth.py) to access or disclose information belonging to other users. The CVSS score of 2.1 reflects the requirement for prior authentication and limited impact scope, though publicly available exploit code exists.

Information Disclosure
CVE-2026-7708 LOW CVSS 2.1
Denial of service in Open5GS UDR component up to version 2.7.7 allows authenticated remote attackers to crash the subscription data service by manipulating the supi_id argument to the ogs_dbi_subscription_data function. Publicly available exploit code exists, and the vendor has been notified via issue report but has not yet released a patch.

Denial Of Service
CVE-2026-7707 LOW CVSS 2.1
Denial of service in Open5GS UDR component (versions up to 2.7.7) via malformed pei argument in udr_nudr_dr_handle_subscription_context function allows authenticated remote attackers to crash the User Data Repository service with low complexity. Publicly available exploit code exists; vendor has not responded to early notification.

Denial Of Service
CVE-2026-7706 LOW CVSS 2.1
Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the AMF (Access and Mobility Management Function) component by exploiting improper error handling in the gmm_handle_service_request function. The vulnerability requires low-privilege authentication to trigger and results in service unavailability. A public exploit has been disclosed via GitHub issue tracker, though the vendor has not yet released a patch despite early notification.

Denial Of Service
CVE-2026-7705 LOW CVSS 2.1
Command injection in JD Cloud JDCOS 4.5.1.r4518 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the vid parameter in the set_iptv_info function of the /jdcap service interface. The vulnerability has a CVSS score of 6.3 (Medium) with low attack complexity and is actively weaponized with publicly available exploit code. The vendor has not responded to early disclosure notifications.

Command Injection
CVE-2026-7704 LOW CVSS 2.1
Path traversal vulnerability in AV Stumpfl Pixera Two Media Server up to version 25.1 R2 allows adjacent network attackers to access arbitrary files via manipulation of an unknown function on Service Port 1338. The vulnerability has a low CVSS score of 2.1 due to adjacency requirement (AV:A) and confidentiality-only impact, but publicly available exploit code exists and the vendor has released a patch in version 25.2 R3.

Path Traversal
CVE-2026-7701 LOW CVSS 2.1
Null pointer dereference in Telegram Desktop up to version 6.7.5 allows remote attackers without authentication to cause denial of service by crafting a malicious login_url argument in the Bot API RequestButton function. The vulnerability requires user interaction to click a malicious link and has a public exploit disclosure, though vendor response to early disclosure notification was not forthcoming.

Denial Of Service Null Pointer Dereference
CVE-2026-7700 LOW CVSS 2.1
Code injection via the eval function in Langflow's LambdaFilterComponent allows remote authenticated attackers to execute arbitrary code with low-to-medium integrity and confidentiality impact. The vulnerability affects Langflow up to version 1.8.4, requires user login (PR:L), and has publicly available exploit code. The vendor did not respond to early disclosure notification.

RCE Code Injection
CVE-2026-7699 LOW CVSS 2.1
SQL injection in Dromara MaxKey up to version 3.5.13 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the filtersfields argument in the StrUtils.checkSqlInjection function, potentially leading to unauthorized data access, modification, or deletion. The vulnerability requires low-privilege authentication and has publicly available exploit code; the vendor has not responded to early disclosure notifications.

SQLi
CVE-2026-7697 LOW CVSS 2.0
SQL injection in AMTT Hotel Broadband Operation System 1.0 allows authenticated remote attackers with high privileges to manipulate the ID argument in /manager/card/cardhand_submit.php, potentially extracting or modifying database contents. Publicly available exploit code exists, though the CVSS score of 4.7 reflects the requirement for authenticated administrative access, limiting real-world impact compared to unauthenticated SQL injection vulnerabilities.

PHP SQLi
CVE-2026-7696 LOW CVSS 2.1
Unrestricted file upload vulnerability in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 allows authenticated remote attackers to upload arbitrary files via the /SubstationWEBV2/main/uploadH5Files endpoint, potentially leading to remote code execution or system compromise. The vulnerability is tracked with CVSS 6.3 (moderate severity), publicly available exploit code exists, and the vendor has not responded to early disclosure attempts.

File Upload
CVE-2026-7692 LOW CVSS 2.1
Command injection in Wavlink WL-WN570HA1 firmware version R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the DDNS argument in the ping_ddns function of /cgi-bin/adm.cgi. The vulnerability affects only unsupported end-of-life firmware that the vendor has removed from distribution; publicly available exploit code exists but real-world impact is limited due to end-of-support status and authentication requirement.

Command Injection
CVE-2026-7691 LOW CVSS 2.1
Command injection in Wavlink WL-WN570HA1 firmware version R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the command argument in the set_sys_cmd function of /cgi-bin/adm.cgi. The vulnerability has publicly available exploit code and affects only discontinued products no longer maintained by the vendor.

Command Injection
CVE-2026-7690 LOW CVSS 2.1
Command injection in Wavlink WL-WN570HA1 firmware R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary commands via the Username parameter in the set_sys_adm function of /cgi-bin/adm.cgi. Publicly available exploit code exists for this vulnerability affecting end-of-life hardware no longer supported by the vendor.

Command Injection
CVE-2026-7689 LOW CVSS 2.9
Improper cryptographic signature verification in Dolibarr ERP CRM up to version 23.0.2 allows remote attackers to bypass signature validation in the Online Signature Module, potentially forging or manipulating signed transactions. The vulnerability affects the dol_verifyHash function and has been publicly disclosed with exploit code available, though exploitation requires high technical complexity and is not confirmed as actively exploited in production environments.

PHP Information Disclosure Jwt Attack
CVE-2026-7688 LOW CVSS 1.3
SQL injection in Dolibarr ERP CRM up to version 23.0.2 allows authenticated remote attackers to execute arbitrary SQL queries via the fields parameter in the Shipments API Endpoint (_checkValForAPI function). Exploitation requires high attack complexity and authenticated access, with publicly available exploit code confirmed but no active exploitation reported in CISA KEV at time of analysis.

PHP SQLi
CVE-2026-7687 LOW CVSS 2.1
Command injection in Langflow up to version 1.8.4 allows authenticated remote attackers to execute arbitrary commands through the CodeParser.parse_callable_details function in the Full Builtins Module Handler component. The vulnerability has been publicly disclosed with exploit code available, affecting the code parsing functionality with limited confidentiality, integrity, and availability impact. The vendor did not respond to early disclosure notification.

Command Injection
CVE-2026-7683 LOW CVSS 2.1
Command injection in Edimax BR-6428nC router web interface through the /goform/setWAN endpoint allows authenticated remote attackers to execute arbitrary system commands via unsanitized pppUserName or pptpUserName parameters. Affected firmware versions up to 1.16 contain this vulnerability; publicly available exploit code exists. The vendor was contacted but did not respond, indicating no security fix is anticipated.

Command Injection
CVE-2026-7682 LOW CVSS 2.1
Command injection in Edimax BR-6208AC 1.02 allows authenticated remote attackers to execute arbitrary system commands via the L2TPUserName parameter in the /goform/setWAN endpoint when L2TP Mode is configured. The vulnerability requires valid credentials but carries moderate risk (CVSS 6.3) with publicly available exploit code and vendor non-responsiveness to disclosure.

Command Injection
CVE-2026-7680 LOW CVSS 2.1
Path traversal in jsbroks COCO Annotator up to version 0.11.1 allows authenticated remote attackers to access arbitrary files on the server by manipulating the folder argument in the Data Endpoint (backend/webserver/api/datasets.py). The vulnerability requires valid user credentials and an attacker can only read files with limited technical impact, but publicly available exploit code exists and the vendor has not responded to disclosure attempts.

Path Traversal
CVE-2026-7678 LOW CVSS 2.1
SQL injection in YunaiV yudao-cloud up to version 2026.01 allows authenticated remote attackers to execute arbitrary SQL queries via the getDataBySQL function in GoViewDataServiceImpl.java, potentially compromising confidentiality, integrity, and availability of the application database. Publicly available exploit code exists, and the vendor did not respond to early disclosure notifications.

Java SQLi
CVE-2026-7677 LOW CVSS 2.0
Stored cross-site scripting (XSS) in kerwincui FastBee up to version 1.2.1 allows authenticated remote attackers to inject malicious scripts via the noticeContent parameter in the System Notice Handler component, which are then executed in the browsers of other users viewing notices. The vulnerability requires user interaction (victims must view the injected notice) and authenticated access, limiting immediate attack scope, though publicly available exploit code and vendor non-responsiveness increase real-world risk.

XSS Java
CVE-2026-7676 LOW CVSS 2.1
Path traversal vulnerability in kerwincui FastBee up to version 1.2.1 allows authenticated remote attackers to read arbitrary files on the server via manipulation of the fileName parameter in the ToolController.download endpoint. The vulnerability has publicly available exploit code and affects the Tool Download functionality, enabling unauthorized file disclosure with low CVSS impact (4.3) due to authentication requirements and limited scope.

Java Path Traversal
CVE-2026-7673 LOW CVSS 2.0
Unrestricted file upload in crmeb_java Admin Upload component (versions up to 1.3.4) allows high-privileged remote attackers to upload arbitrary files by manipulating the model argument in UploadServiceImpl.java, resulting in potential code execution or system compromise. Publicly available exploit code exists and the vendor has not responded to disclosure attempts.

Java File Upload
CVE-2026-7672 LOW CVSS 2.1
SQL injection in youlai-boot up to version 2.21.1 via argument order manipulation in the getUserList endpoint allows authenticated remote attackers to execute arbitrary SQL queries with limited data access impact. The vulnerability affects the Users Endpoint component, has publicly available exploit code, and the vendor has not responded to disclosure attempts despite early notification.

Java SQLi

Track CVEs for your stack Sign up free →

Today's Vulnerabilities Vulnerabilities