CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter5.4 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute6.4 Medium
- broadstreetads broadstreetBroadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- wpcodefactory cost of goods: product cost & profit calculator for woocommerceCost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- broadstreetads broadstreetBroadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure5.3 Medium
- gdragon coreactivity: activity logging for wordpresscoreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field8.1 High
- smub charitable – donation plugin for wordpress – fundraising with recurring donations & moreCharitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter6.5 Medium
- broadstreetads broadstreetBroadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation4.3 Medium
- stylemix cost calculator builderCost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference5.3 Medium
- advantech ecowatch saas-composer, iot edge linux docker, iot edge windows +5 more +7 moreSQL Injection Vulnerability7.2 High
- amd epyc™ 8004 series processors, epyc™ embedded 8004 series processors, epyc™ embedded 9004 series processors (formerly codenamed "bergamo") +14 more +16 moreImproper enforcement of the LFENCE serialization property may allow an attacker to bypass...5.7 Medium
- amd epyc™ 8004 series processors, epyc™ 9004 series processors, epyc™ 9005 series processors +4 more +6 moreMissing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Management Network (SMN) access, potentially resulting in arbitrary code execution…8.5 High
- amd epyc™ 7003 series processors, epyc™ 8004 series processors, epyc™ 9004 series processors +6 more +8 moreMissing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing configurations, potentially resulting in loss of SEV-SNP guest integrity.5.9 Medium
- amd esxi 8.x and esxi 9.x hosts using amd-pensando dpu productsAn untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an...7.2 High
- amd esxi 8.x and esxi 9.x hosts using amd-pensando dpu productsA heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to...8.8 High
- amd esxi 8.x and esxi 9.x hosts using amd-pensando dpu productsA heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to...8.8 High
- th30d4y openlearnxOpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover6.9 Medium
- astroAstro: Server island encrypted parameters vulnerable to cross-component replay2.9 Low
- klever-io klever-goKlever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload8.6 High
- authlibAuthlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization6.1 Medium
- mapfish mapfish-print, camptocamp mapfish print, org.mapfish print.print-lib +1 more +3 moremapfish-print: Remote Code Injection (RCE) in Dynamic table9.3 Critical
- mongodb, mongodb, inc. mongodb server +1 morePost-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators5.3 Medium
- mongodb, mongodb, inc. mongodb server +1 morePost-authentication use-after-free error in $_internalJsEmit and mapreduce commands7.7 High
- mongodb, mongodb, inc. mongodb server +1 moreUse-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields6.1 Medium
matioOSS-FuzzHeap-buffer-overflow in H5D__scatter_memNo score- mongodb, mongodb, inc. mongodb server +1 moreSchema validation log messages may not redact user data4.8 Medium
- mongodb, mongodb, inc. mongodb server +1 morePost-auth memory exhaustion via bitwise match expressions7.1 High
libcoapOSS-FuzzHeap-buffer-overflow in coap_persist_startup_lkdNo score- No product listedAn arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang...7.3 High
- No product listedqihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the...6.5 Medium
- No product listedqihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the...6.5 Medium
- No product listedHiseeu C90 v5.7.15 is vulnerable to Insecure Permissions. The UART bootloader is accessible when...6.8 Medium
- u-speed t18-21k firmwareU-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection. The...7.2 High
- u-speed t18-21k firmwareU-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access...6.8 Medium
- openplcproject openplc v3 firmwareA path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as...6.5 Medium
- No product listedNXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was...5.6 Medium
- No product listedstriso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function AuxJack.7.5 High
- No product listedstriso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function ThreadReadButtons.7.5 High
- garmin empirbus wireless display unit firmwareThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to...7.3 High
- garmin empirbus wireless display unit firmwareThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site...5.0 Medium
- garmin empirbus wireless display unit firmwareThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin...9.3 Critical
- garmin empirbus wireless display unit firmwareThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a...7.5 High
- No product listedFirmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via...7.3 High
- No product listedBuffer Overflow vulnerability in Ardupiot Copter Latest commit...6.2 Medium
- No product listedBuffer Overflow vulnerability in Ardupiot Copter Latest commit...5.5 Medium
- No product listedBuffer Overflow vulnerability in Ardupilot rover commit v...6.2 Medium
- mongodb, mongodb, inc. mongodb server +1 moreFlatBSON Duplicate Field Index Drift8.7 High
- reconurge flowsintFlowsint: Broken Access Control allows modification of investigation metadata from any user2.3 Low
- reconurge flowsintFlowsint: Cypher query injection in node type on node creation7.1 High
- reconurge flowsintFlowsint: Stored XSS on map node marker in map page5.1 Medium
- Show moreLoading…