CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP BFD vulnerability6.3 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +21 more +23 moreBIG-IP QKView vulnerability7.1 High
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreiControl REST and tmsh vulnerability7.1 High
- f5 big-ip, big-ip domain name system +1 moreBIG-IP iControl REST vulnerability6.7 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +21 more +23 moreiControl REST and tmsh vulnerability6.9 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP httpd access control vulnerability6.9 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP Configuration utility CSRF vulnerability5.3 Medium
- mtrudel banditHTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit8.7 High
- the openthread authors openthreadImproper Input Validation in OpenThread NAT64 Translator6.0 Medium
- mtrudel banditHTTP/1 chunked body reader ignores length cap in bandit8.7 High
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining7.1 High
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification4.3 Medium
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter6.5 Medium
- leont crypt::argon2, crypt\ +1 moreCrypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input5.3 Medium
- smub custom twitter feeds – a tweets widget or x feed widgetCustom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text7.2 High
- rometheme rtmkitRTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification4.3 Medium
- rometheme rtmkitRTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'8.8 High
bashRoot,rootio-bashRoot +1 moreCVE-0000-0000 in bash - Patched by RootNo score- elecom co.,ltd. wab-be187-m, wab-be36-m, wab-be36-s +1 more +3 moreELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate...5.1 Medium
- elecom co.,ltd. wab-be187-m, wab-be36-m, wab-be36-s +1 more +3 moreELECOM wireless LAN access point devices do not check if language parameter has an appropriate...5.1 Medium
- elecom co.,ltd. wab-be187-m, wab-be36-m, wab-be36-s +1 more +3 moreStored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If...4.8 Medium
- elecom co.,ltd. wrc-be65qsd-b, wrc-be72xsd-b, wrc-be72xsd-ba +1 more +3 moreELECOM wireless LAN access point devices contain an OS command injection in processing of...9.3 Critical
- elecom co.,ltd. wrc-be65qsd-b, wrc-be72xsd-b, wrc-be72xsd-ba +1 more +3 moreELECOM wireless LAN access point devices do not require authentication to access some specific...9.3 Critical
- elecom co.,ltd. wrc-be65qsd-b, wrc-be72xsd-b, wrc-be72xsd-ba +1 more +3 moreELECOM wireless LAN access point devices contain an OS command injection vulnerability in...8.6 High
- elecom co.,ltd. wrc-x1800gs-b, wrc-x1800gsa-b, wrc-x1800gsh-b +10 more +12 moreELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups...6.9 Medium
rkyvcrates.ioInsufficient archive validation can cause out-of-bounds reads in archives containing Rc/ArcNo scoregit2crates.ioPotential undefined behavior with Signature from a buffer-created BlameHunkNo score- themefusion avada (fusion) builderAvada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter6.5 Medium
- themefusion avada (fusion) builderAvada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter7.5 High
- kde plasma-login-managerThe new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from...7.0 High
- checkmkPrivilege escalation via mk_mysql agent plugin on Windows5.2 Medium
- gnome malcontentmalcontent: Disk Space Exhaustion via Globally Accessible D-Bus API5.1 Medium
- hostinger reach – ai-powered email marketing for wordpressHostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key Update5.3 Medium
- inc2734 snow monkey blocksSnow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute6.4 Medium
- wpclever wpc badge management for woocommerceWPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute5.5 Medium
- bytello share (windows edition) installer executableBytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic...8.4 High
- hitachi vantara pentaho data integration and analytics, hitachi vantara pentaho data integration and analytics +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component9.1 Critical
- gerritImproper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"6.0 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter5.3 Medium
- ghera74 ilghera support system for woocommerceilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure5.3 Medium
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter7.5 High
- canon marketing japan inc. guardianwall mail security cloud (saas version), guardianwall mailsuite (on-premises version) +1 moreStack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail...9.3 Critical
- samsung mobile system support serviceImproper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows...6.3 Medium
- samsung android, samsung mobile devices +1 moreImproper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows...6.9 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers...5.1 Medium
- samsung android, samsung mobile devices +1 moreImproper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows...5.1 Medium
- samsung mobile devicesImproper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows...8.9 High
- samsung android, samsung mobile devices +1 moreOut-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged...6.8 Medium
- samsung android, samsung mobile devices +1 moreIncorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local...5.1 Medium
- samsung android, samsung mobile devices +1 moreIncorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local...6.8 Medium
- Show moreLoading…