| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-4137 | Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow | mlflow | mlflow/mlflow | - | - | 2026-05-18 20:26:23 | Deep Dive |
| CVE-2026-22810🧪 | Joplin: Path traversal in OneNote importer allows overwriting arbitrary files | laurent22 | joplin | High | 8.2 | 2026-05-18 20:23:58 | Deep Dive |
| CVE-2026-8838🧪 | Remote Code Execution via eval() Injection in amazon-redshift-python-driver | AWS | Amazon Redshift connector for Python | Critical | 9.8 | 2026-05-18 20:15:38 | Deep Dive |
| CVE-2026-8851🧪 | SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint | Alinto | SOGo Webmail | High | 8.1 | 2026-05-18 20:10:11 | Deep Dive |
| CVE-2025-65954 | SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout | simplesamlphp | simplesamlphp-module-casserver | - | - | 2026-05-18 19:57:07 | Deep Dive |
| CVE-2026-47092🧪 | Claude HUD 0.0.12 Arbitrary Command Execution via COMSPEC Environment Variable | jarrodwatts | claude-hud | High | 7.8 | 2026-05-18 19:46:48 | Deep Dive |
| CVE-2026-47091 | Claude HUD 0.0.12 Path Traversal via transcript_path | jarrodwatts | claude-hud | Low | 3.3 | 2026-05-18 19:45:55 | Deep Dive |
| CVE-2026-47090 | Claude HUD 0.0.12 Terminal Injection via OSC 8 Hyperlinks | jarrodwatts | claude-hud | Medium | 4.6 | 2026-05-18 19:31:33 | Deep Dive |
| CVE-2026-21789 | HCL Connections is vulnerable to broken access control | HCLSoftware | Connections | Medium | 4.6 | 2026-05-18 19:17:19 | Deep Dive |
| CVE-2026-45246 | Summarize < 0.15.1 Insecure File Permissions Information Disclosure | steipete | summarize | Medium | 5.5 | 2026-05-18 19:03:35 | Deep Dive |
| CVE-2026-45245🧪 | Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events | steipete | summarize | High | 7.4 | 2026-05-18 19:00:54 | Deep Dive |
| CVE-2026-45244 | Summarize < 0.15.1 Unapproved Browser Automation Execution | steipete | summarize | Medium | 5.4 | 2026-05-18 18:57:32 | Deep Dive |
| CVE-2026-45242🧪 | Summarize < 0.15.1 Path Traversal via slidesDir Parameter | steipete | summarize | High | 7.1 | 2026-05-18 18:52:09 | Deep Dive |
| CVE-2026-45243 | Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script | steipete | summarize | Medium | 6.1 | 2026-05-18 18:50:46 | Deep Dive |
| CVE-2026-8836🧪 | lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow | - | lwIP | Critical | 9.8 | 2026-05-18 18:45:13 | Deep Dive |
| CVE-2026-45231 | DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields | DumbWareio | DumbAssets | Medium | 6.1 | 2026-05-18 18:40:43 | Deep Dive |
| CVE-2026-45230🧪 | DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file | DumbWareio | DumbAssets | Critical | 9.1 | 2026-05-18 18:06:56 | Deep Dive |
| CVE-2026-32848 | NetBSD cryptodev Race Condition Double-Free via cryptodev_op() | NetBSD | src | Medium | 4.7 | 2026-05-18 17:52:56 | Deep Dive |
| CVE-2026-32849 | NetBSD Signed Integer Overflow in cryptodev_op via cryptodev.c | NetBSD | src | Medium | 5.5 | 2026-05-18 17:42:30 | Deep Dive |
| CVE-2026-42822 | Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability | Microsoft | Azure Local | Critical | 10.0 | 2026-05-18 17:03:25 | Deep Dive |