Actively exploited

Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen

Oracle Fusion Middleware: Mehrere Schwachstellen

Oracle Communications: Mehrere Schwachstellen

Metabase Metabase — Metabase SQL Injection Vulnerability

Widget Factory Joomla Content Editor — Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Cisco Secure Firewall Management Center: Mehrere Schwachstellen

Microsoft Internet Key Exchange (IKE) Service Extensions — Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Oracle JD Edwards: Mehrere Schwachstellen

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in — Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI

Dell ECS: Mehrere Schwachstellen

Oracle Communications: Mehrere Schwachstellen

Security update for the Linux Kernel

Oracle Communications: Mehrere Schwachstellen

Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen

Progress LoadMaster — Progress LoadMaster Command Injection Vulnerability

IBM QRadar SIEM: Mehrere Schwachstellen

LiteLLM has SQL Injection in Proxy API key verification

Splunk Enterprise — Splunk Enterprise Missing Authentication for Critical Function Vulnerability

JetBrains TeamCity — JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Gitea: Remote Code Execution via diffpatch Git Hook Installation

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

ownCloud: Mehrere Schwachstellen

Microsoft Windows: Mehrere Schwachstellen

Broadcom VMware vCenter — Broadcom VMware vCenter Path Traversal Vulnerability

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

ownCloud ownCloud — ownCloud Improper Authentication Vulnerability

WordPress Core — WordPress Core Interpretation Conflict Vulnerability

IBM Langflow — IBM Langflow Code Injection Vulnerability

Microsoft SharePoint — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done vi…

Citrix Systems NetScaler ADC und Gateway: Mehrere Schwachstellen

Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

Google Chrome: Mehrere Schwachstellen

Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

Dell Avamar und NetWorker: Mehrere Schwachstellen

Check Point SmartConsole — Check Point SmartConsole Improper Authentication Vulnerability

Apple macOS — Apple macOS Improper Authentication Vulnerability

SonicWall SMA1000 Appliances — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability

Langflow Langflow — Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Apple macOS Sequoia, Sonoma und Ventura: Mehrere Schwachstellen

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in Febru…

Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release

JFrog Artifactory — JFrog Artifactory Improper Authentication Vulnerability

Oracle Fusion Middleware: Mehrere Schwachstellen

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security r…

Fortinet FortiSandbox — Fortinet FortiSandbox OS Command Injection Vulnerability

Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (CUDA)

Microsoft Windows Produkte: Mehrere Schwachstellen

Google Chrome: Schwachstelle ermöglicht nicht spezifizierten Angriff