Critical vulnerability intelligence.

1478

CVE-2026-31072

APScheduler’s JSONSerializer and CBORSerializer can run arbitrary code when they deserialize data that an attacker controls. By sending a specially crafted JSON or CBOR payload, a remote attacker can execute any code on the server. This flaw exists in all released versions up to 4.0.0a5.

1479

CVE-2026-31071

The LalanaChami Pharmacy Management System has a critical flaw: its API endpoints do not require authentication. This allows anyone on the network to read all user data, change drug inventory, and view private prescriptions.

Critical· 9.1<1% likely

1480

CVE-2026-31070

The LalanaChami Pharmacy Management System allows anyone to create an account and assign themselves an administrative role. Because the signup API does not validate the role field, attackers can become administrators without authentication. This can give them full control over the system.

1481

CVE-2026-30118

Scalar/astro v0.1.13 contains a critical Server‑Side Request Forgery (SSRF) that lets attackers make the backend server send HTTP requests to any URL, potentially exposing authentication cookies and escalating privileges.

1482

CVE-2026-30117

An arbitrary file upload flaw exists in scalar/astro v0.1.13, where the scalar_url query parameter of the Scalar Proxy endpoint accepts any file. Attackers can upload a specially crafted SVG file that is executed on the server, giving them full control over the system.

published May 19, 2026deletes in 33d

1483

CVE-2026-8711

F5 Njs

NGINX JavaScript can crash when the js_fetch_proxy directive is set with client‑controlled variables such as $http_*, $arg_*, or $cookie_*. An attacker can send crafted requests that trigger a heap buffer overflow, causing the NGINX worker process to restart. If Address Space Layout Randomization is disabled or bypassed, the attacker may also execute arbitrary code.

Critical· 9.2<1% likely

1484

CVE-2026-44159

Tyler Identity Local (TID‑L) ships with default administrative credentials that users are not required to change before deployment. Because the product has not been distributed or supported since 2020, the vulnerability is largely historical but still poses a risk if the software is in use.

Critical· 9.6<1% likelyfix available

1485

CVE-2026-2587

Eclipse Glassfish

A critical flaw in Eclipse GlassFish lets attackers run arbitrary code on the server by injecting unsanitized Expression Language expressions into XML files. The vulnerability is triggered when the server processes user‑supplied data without proper escaping, allowing remote code execution. It can be fully mitigated by updating to a patched version.

published May 19, 2026deletes in 20d

1486

CVE-2026-2586

Eclipse Glassfish

An authenticated attacker who can access GlassFish’s Administration Console can run arbitrary operating‑system commands with the privileges of the application service user. The flaw exists in several older GlassFish releases and has been fixed in newer versions.

Critical· 9.1<1% likelyfix available

published May 19, 2026deletes in 20d

1487

CVE-2026-4885

The Piotnet Addons for Elementor Pro plugin for WordPress allows attackers to upload files without proper type checks. Because the plugin only blocks a few extensions, dangerous files such as .phar or .phtml can be uploaded, potentially letting an attacker run code on the server. This flaw exists in all versions up to 7.1.70.

Critical· 9.3<1% likelyfix available

1488

CVE-2026-8838

The Amazon Redshift Python driver before version 2.1.14 uses Python's eval() on data received from the server, allowing attackers to run arbitrary code on the client. This flaw can be exploited by a rogue server or a man‑in‑the‑middle attacker. The issue is fixed in driver version 2.1.14 and later.

published May 18, 2026deletes in 20d

1489

CVE-2026-27130

Dokploy, a free self‑hosted Platform as a Service, has a critical OS command injection flaw in versions 0.26.6 and earlier. The flaw lets an authenticated user inject shell commands through the appName field when creating an application, and the commands run with server‑level privileges during service operations.

Critical· 9.9<1% likelyfix available

published May 18, 2026deletes in 20d

1490

CVE-2026-25244

Openjsf Webdriverio

WebdriverIO versions older than 9.24.0 allow attackers to inject shell commands via branch names, enabling remote code execution on CI/CD servers and developer machines. The flaw can expose credentials, source code, and SSH keys, and can be used for supply chain attacks.

Critical· 9.83% likelyfix available

published May 18, 2026deletes in 20d

1491

CVE-2026-44221

ArcadeDB Multi‑Model DBMS versions 21.10.1 through 26.4.1 allow an authenticated user or API token scoped to one database to read, write, and change the schema of any other database on the same server. The flaw is caused by an uninitialized file access map and a missing security factory setting. It has been fixed in version 26.4.2.

Critical· 9<1% likelyfix available

published May 12, 2026deletes in 29d

1492

CVE-2021-47940

WordPress Plugin Download From Files versions 1.48 and earlier allow attackers to upload arbitrary files without authentication. By sending a crafted POST request to the plugin’s AJAX endpoint, an attacker can bypass file type checks and place executable files such as PHP shells on the web server. This flaw can lead to full control over the affected site.

published May 10, 2026deletes in 34d

1493

CVE-2021-47936

OpenCATS 0.9.4 has a critical remote code execution flaw that lets anyone upload a PHP file disguised as a resume and run arbitrary commands on the server. The vulnerability is exploitable without authentication and can be triggered through the careers job application endpoint.

published May 10, 2026deletes in 34d

1494

CVE-2021-47933

WordPress MStore API 2.0.6 lets anyone upload files to the server without needing to log in. An attacker can upload a PHP file and run it, giving them full control over the site. This is a serious flaw that can be exploited by anyone on the internet.