Critical vulnerability intelligence.

1462

CVE-2026-22314

Mesalvo Meona’s Client Launcher and Server components allow attackers to inject and run arbitrary code on other users’ machines. The flaw is exploitable over the network and requires only low effort and minimal privileges. It can compromise confidentiality, integrity, and availability of affected systems.

Critical· 9<1% likely

Critical· 9.11% likelyfix available

1463

CVE-2026-33278

Nlnetlabs Unbound

Unbound, a DNS resolver, has a bug that can crash the service or let an attacker run code when it processes certain DNSSEC queries. The flaw occurs when Unbound copies data structures during validation, accidentally pointing to freed memory. A malicious zone can trigger this by sending specially crafted DNS responses.

Critical· 9.3<1% likelyfix available

1464

CVE-2026-9065

SureCart versions before 4.2.1 are vulnerable to a serious SQL injection attack that can let an authenticated attacker extract or modify database data. The flaw is caused by a flaw in the query builder that bypasses escaping when a dot is present in input. This allows attackers to run arbitrary SQL queries.

Critical· 9.3<1% likelyfix available

1465

CVE-2026-9059

NextGEN Gallery versions before 4.2.1 are vulnerable to a critical SQL injection attack that can be triggered by an authenticated user with the 'NextGEN Gallery overview' capability. The flaw lies in the 'orderby' parameter of the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums', which fails to properly sanitize input. An attacker could inject arbitrary SQL into the ORDER BY clause, potentially compromising the database.

1466

CVE-2026-7637

The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to 2.0.3 via a cookie. This flaw allows attackers to inject arbitrary PHP objects, but it only becomes dangerous if another plugin or theme provides a vulnerable chain. The vulnerability is rated critical due to the potential for complete compromise if a POP chain exists.

Critical· 9.8<1% likely

Nvidia Triton Inference Server +1 more

1467

CVE-2026-24207

NVIDIA Triton Inference Server has a critical authentication bypass that allows unauthenticated users to access privileged functions. The flaw could enable attackers to run code, modify data, or disrupt service. It is rated CVSS 9.8.

Critical· 9.83% likely

1468

CVE-2026-7284

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress allows attackers to register as an administrator without authentication. By specifying the administrator role during user registration, an attacker can gain full control of the site. This flaw exists in all versions up to 1.4.4.

Critical· 9.8<1% likely

1469

CVE-2026-6555

The ProSolution WP Client plugin for WordPress allows unauthenticated users to upload arbitrary files. By sending a valid first file followed by a malicious PHP file, an attacker can place code in a web‑accessible directory and run it. This can lead to full control of the site.

Critical· 9.8<1% likely

Date Ical Project Date Ical

1470

CVE-2026-8495

This vulnerability is a missing authorization flaw in the Drupal Date iCal module that lets attackers view any data without permission. It can be exploited remotely with no user interaction. The flaw is present in all versions before 4.0.15.

Critical· 9.8<1% likelyfix available

published May 19, 2026deletes in 20d

1471

CVE-2026-34234

CtrlPanel, an open‑source billing platform for hosting providers, had a critical flaw that let anyone run arbitrary commands on the server. The bug was in the installer, which executed user input before checking if the software was already installed. The issue was fixed in version 1.2.0.

Critical· 10<1% likelyfix available

published May 19, 2026deletes in 20d

1472

CVE-2026-33642

Kovidgoyal Kitty

Kitty, a GPU‑based terminal, had a critical bug in versions 0.46.2 and earlier that allowed attackers to send crafted escape sequences to cause a heap buffer over‑read or over‑write. The flaw was fixed in version 0.47.0. Users should update to the patched release to eliminate the risk.

Critical· 9.9<1% likelyfix available

published May 19, 2026deletes in 20d

1473

CVE-2026-47358

Tenable Terrascan

Terrascan versions 1.18.3 and earlier are vulnerable to a Server‑Side Request Forgery (SSRF) flaw when running in server mode. An unauthenticated attacker can upload an infrastructure‑as‑code template that points to an attacker‑controlled URL, causing Terrascan to fetch that URL on the server. The fetched content can be a remote file or a local file via a file:// URL, potentially exposing sensitive data or allowing code execution.

Critical· 9.2<1% likely

1474

CVE-2026-47357

Tenable Terrascan

Terrascan versions 1.18.3 and earlier are vulnerable to a Server‑Side Request Forgery (SSRF) flaw when running in server mode. An unauthenticated attacker can supply a malicious HTTP URL that is passed directly to the underlying Go‑getter library, allowing the attacker to read local files and send stored credentials to an external host.

Critical· 9.2<1% likely

1475

CVE-2026-36829

Panabit PAP-XM320 routers running firmware version 7.7 or earlier have a flaw that lets attackers bypass the login screen. By sending a specially crafted cookie, an attacker can trick the device into thinking they are already logged in and gain full control. This flaw is serious because it gives attackers unrestricted access to the router.

Critical· 9.81% likely

1476

CVE-2026-37281

This vulnerability is an OS command injection in the /stream-to-vlc route of hitarth-gg Zenshin. It lets attackers run any command on the server by manipulating the url parameter. The flaw is critical because it requires no authentication and can be triggered over the network.

Critical· 9.82% likely