CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-05-13 (13)

2026-05-13 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-05-13

13 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-44015 — 9.9 — Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and t…
  • CVE-2026-41050 — 9.9 — Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream clus…
  • CVE-2026-31214 — 9.8 — The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains an insecure deserialization vulnerability (CWE-502). The script uses torch.load…
  • CVE-2026-31217 — 9.8 — The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) allows arbitrary code execution. When a user supplies a directory …
  • CVE-2026-41293 — 9.8 — Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. O…
  • CVE-2026-43512 — 9.8 — DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.…
  • CVE-2026-26083 — 9.8 — A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.0 through 5.0.1, FortiSandbox Cloud 4.4.5 throug…
  • CVE-2026-31234 — 9.8 — Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component. The KVStore server, used for distributed task coordination, lacks authentication and authorization co…
  • CVE-2026-41089 — 9.8 — Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
  • CVE-2026-41096 — 9.8 — Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
  • CVE-2026-44277 — 9.8 — A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthenticator 6.4.0 through 6.4…
  • CVE-2026-40402 — 9.3 — Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
  • CVE-2026-43515 — 9.1 — Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 throug…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.