CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
libcoapOSS-FuzzHeap-buffer-overflow in coap_pdu_parse_headerNo scorepopplerOSS-FuzzUse-of-uninitialized-value in JBIG2Stream::readSymbolDictSegNo scorempvOSS-FuzzStack-buffer-overflow in autoload_external_filesNo scoremd4cOSS-FuzzGlobal-buffer-overflow in md_start_new_blockNo scoremd4cOSS-FuzzUse-after-poison in md_build_attributeNo score- yubico webauthn-server-coreYubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a...7.5 High
- openstack ironicOpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices4.3 Medium
- No product listedFoscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of...5.3 Medium
- northern.tech cfengineNorthern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command...7.3 High
- northern.tech cfengineNorthern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.5.3 Medium
- northern.tech cfengineNorthern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.6.1 Medium
- No product listedRemote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim,...6.3 Medium
- kddi corporation あんしんフィルター for auAndroid App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of...6.3 Medium
- evank web::passwdWeb::Passwd versions through 0.03 for Perl is vulnerable to RCE9.8 Critical
- webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 moreImproper authorization checks of team members privileges allow a team member to escalate...7.1 High
- webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 moreInsufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL...8.1 High
- webpros cpanel, wp squared +1 moreImproper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint...8.3 High
- cpanel, cpanel whm, wp squared +2 moreSSL verification is disabled in the DNS Cluster system. This could allow for a malicious server...8.2 High
- cpanel, cpanel whm, wp squared +2 moreIncorrect privileges management and insufficient path filtering allow to read arbitrary file on...8.6 High
- opnsense, opnsense core +1 moreOPNsense: Command Injection via Attacker-Controlled DHCP Config9.1 Critical
- opnsense core, opnsense +1 moreOPNsense: RCE on user managment9.1 Critical
- opnsense, opnsense core +1 moreOPNsense: Authentication lockout bypass5.3 Medium
- opnsense, opnsense core +1 moreOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method9.1 Critical
- hoppscotchhoppscotch: Unauthenticated Onboarding Config Disclosure via Empty Recovery Token7.5 High
- cvat-ai cvatCVAT: Stored XSS via annotation guides8.5 High
- dataease sqlbotSQLBot: Unauthorized Access Vulnerability8.6 High
- frappe erpnextERPNext: Unauthorised Document modification due to missing validation5.9 Medium
- frappe erpnextERPNext: Possibility of SQL Injection due to missing validation8.8 High
- frappe erpnextERPNext: Possibility of SQL Injection due to missing validation8.8 High
- frappe erpnextERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module5.3 Medium
- frappe erpnextERPNext: Possible SSRF by any authenticated user5.0 Medium
- frappe erpnextERPNext: Path Traversal Leading to Sensitive File Exposure6.5 Medium
- frappe erpnextERPNext: Unauthorised Document modification due to missing validation9.9 Critical
- phili67 ecclesiacrmIncomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm8.7 High
- mispMISP: Improper UUID validation in MISP Collections5.3 Medium
- mispMISP: Improper access control in auth key reset allows privilege escalation to site administrator8.6 High
- mispMISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings9.3 Critical
- cubecart v6CubeCart: Authenticated RCE via Invoice Template → Order Print7.2 High
- cubecart v6CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header8.1 High
- cubecart v6CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE9.1 Critical
- cubecart v6CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing4.9 Medium
- cubecart v6CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API9.1 Critical
- cubecart v6CubeCart: Reflected XSS in Store Search Bar6.1 Medium
- cubecart v6CubeCart: Stored Cross-Site Scripting (XSS)4.8 Medium
- cubecart v6CubeCart: Time-based Blind SQL Injection7.2 High
- cubecart v6CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE9.1 Critical
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreFTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address5.9 Medium
- strapi, strapi @strapi/admin, @strapi/plugin-users-permissions +2 moreStrapi: Password Reset Does Not Revoke Existing Refresh Sessions2.1 Low
- strapi, strapi @strapi/content-type-builder +1 moreStrapi Vulnerable to SQL Injection in Content Type Builder9.3 Critical
- strapi, strapi @strapi/plugin-users-permissions +1 moreStrapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying6.9 Medium
- Show moreLoading…