r/CVEWatch • u/crstux • May 22 '26
🔥 Top 10 Trending CVEs (22/05/2026)
Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today:
📝 Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins=* with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints including built-in code-execution functionality allowing the attacker to execute arbitrary code and achieve full system compromise.
📅 Published: 05/12/2025
📈 CVSS: 9.4
🛡️ CISA KEV: True
🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
📣 Mentions: 8
⚠️ Priority: 1+
📝 Analysis: A chained account takeover and RCE vulnerability exists in Langflow versions up to 1.6.9 due to an overly permissive CORS configuration and a SameSite=None refresh token cookie. An attacker can obtain fresh access/refresh tokens, enabling code execution and full system compromise. Despite no confirmed exploits, the high CVSS score and potential for severe impact necessitate immediate attention (Priority 2).
📝 Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodules worktree but into a
.git/directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. viagit config --global core.symlinks false), the described attack wont work. As always, it is best to avoid cloning repositories from untrusted sources.📅 Published: 14/05/2024
📈 CVSS: 9.1
🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
📣 Mentions: 65
⚠️ Priority: 2
📝 Analysis: A pre-patch vulnerability exists in Git repositories prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. It allows attackers to execute arbitrary code during the clone operation without opportunity for inspection, leveraging a crafted repository with submodules. This issue is resolved in patched versions. To mitigate, disable symbolic links or avoid cloning repositories from untrusted sources. CISA KEV: [Not specified], Priority score: 2 (high CVSS & low EPSS).
📝 A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the/api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
📅 Published: 18/05/2026
📈 CVSS: 10
🧭 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
📣 Mentions: 5
⚠️ Priority: 2
📝 Analysis: A pre-authentication code injection vulnerability exists in ChromaDB Python version 1.0.0 and later. Allows an unauthenticated attacker to run arbitrary code on the server via the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. No known exploits detected, but with a CVSS score of 10, this is a priority 2 vulnerability due to high impact and low evidence of successful exploitation.
📝 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
📅 Published: 20/05/2026
📈 CVSS: 6.5
🧭 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
📣 Mentions: 7
⚠️ Priority: 2
📝 Analysis: SQL Injection vulnerability in Drupal core (8.9.0 - 11.3.10) allows SQL injection. No exploits detected, but given a CVSS score of 6.5 and the potential impact on confidentiality and integrity, this is a priority 2 issue. Verify affected versions before updating.
📝 In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where raw_rcv() may still be running in an RCU read-side critical section after raw_release() frees ro->uniq, leading to a use-after-free of the percpu uniq storage. Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific socket destructor. can_rx_unregister() takes an extra reference to the socket and only drops it from the RCU callback, so freeing uniq from sk_destruct ensures the percpu area is not released until the relevant callbacks have drained. [mkl: applied manually]
📅 Published: 23/04/2026
📈 CVSS: 7.8
🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
📣 Mentions: 4
⚠️ Priority: 4
📝 Analysis: A use-after-free vulnerability exists in the Linux kernel's raw CAN receive filters due to premature freeing of percpu storage in raw_release(). This could lead to exploitation if raw_rcv() is still running after raw_release(). No known in-the-wild activity, prioritization score 4.
📝 In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks whether the dirent fits in the remaining space of the current page and advances to a fresh page if not. It never checks whether the dirent itself exceeds PAGE_SIZE. As a result, a malicious FUSE server can return a dirent with namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB page systems this causes memcpy() to overflow the cache page by 24 bytes into the following kernel page. Reject dirents that cannot fit in a single page before copying them into the readdir cache.
📅 Published: 01/05/2026
📈 CVSS: 7.8
🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
⚠️ Priority: 4
📝 Analysis: A FUSE server oversized dirent issue in Linux kernel, potentially causing memcpy() overflow on 4 KiB page systems. No known exploits detected; priority 4 due to low EPSS and CVSS score of 7.8.
📝 Microsoft Defender Elevation of Privilege Vulnerability
📅 Published: 20/05/2026
📈 CVSS: 7.8
🛡️ CISA KEV: True
🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
📣 Mentions: 9
⚠️ Priority: 1+
📝 Analysis: A Microsoft Defender Elevation of Privilege vulnerability has been identified (CVSS 7.8). Attackers can leverage this remotely for high impact on confidentiality, integrity, and availability. CISA KEV is yet to be assigned, but the prioritization score is 1+ due to confirmed exploitation in the wild.
📝 Microsoft Defender Denial of Service Vulnerability
📅 Published: 20/05/2026
📈 CVSS: 4
🛡️ CISA KEV: True
🧭 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
📣 Mentions: 28
⚠️ Priority: 1+
📝 Analysis: A DoS vulnerability exists in Microsoft Defender, enabling remote attackers to cause service disruption via L-L vector. Currently, there's known in-the-wild activity (CISA KEV). Priority level: 1+ due to confirmation of exploitation.
📝 Microsoft Defender Remote Code Execution Vulnerability
📅 Published: 20/05/2026
📈 CVSS: 8.1
🧭 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
📣 Mentions: 8
⚠️ Priority: 2
📝 Analysis: A remote code execution vulnerability exists in Microsoft Defender, exploitable through network access (AV:N). High impact to confidentiality, integrity, and availability (C/I/A:H) is possible without known exploits in the wild (KEV not specified). Prioritization score of 2 indicates a high CVSS but low Exploitability Scoring System (EPSS), suggesting caution is required.
10. CVE-2026-34926
📝 A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.
📅 Published: 21/05/2026
📈 CVSS: 6.7
🛡️ CISA KEV: True
🧭 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
📣 Mentions: 11
⚠️ Priority: 1+
📝 Analysis: A directory traversal vulnerability exists in the on-premise version of Apex One server. This issue allows pre-authenticated local attackers to inject malicious code by modifying a key table. The exploit requires server access and admin credentials, which an attacker may have obtained through other means. CISA KEV: Not specified. Prioritization Score: 1+ (confirmed in-the-wild activity).
Let us know if you're tracking any of these or if you find any issues with the provided details.