CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-05-20 (10)

2026-05-20 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-05-20

10 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-6555 — 9.8 — The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array und…
  • CVE-2026-7284 — 9.8 — The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle…
  • CVE-2026-7637 — 9.8 — The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. This makes it possible for un…
  • CVE-2008-4250 — 0.0 — Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicaliza… [KEV]
  • CVE-2009-1537 — 0.0 — Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media f… [KEV]
  • CVE-2009-3459 — 0.0 — Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption. [KEV]
  • CVE-2010-0249 — 0.0 — Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-… [KEV]
  • CVE-2010-0806 — 0.0 — Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The imp… [KEV]
  • CVE-2026-41091 — 0.0 — Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. [KEV]
  • CVE-2026-45498 — 0.0 — Microsoft Defender contains an unspecified vulnerability that allows for denial of service. [KEV]

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.