CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- flowiseai flowiseFlowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover7.7 High
- flowiseai flowiseFlowise: DatasetRow create+update mass-assignment allows cross-workspace row takeover7.7 High
- flowiseai flowiseFlowise: Dataset create+update mass-assignment allows cross-workspace dataset takeover7.7 High
- flowiseai flowiseFlowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeover7.7 High
- flowiseai flowiseFlowise: Assistant create+update mass-assignment allows cross-workspace assistant takeover7.7 High
- flowiseai flowiseFlowise: Vector Store No Permission Checks8.7 High
- element synapseSynapse pagination denial of service5.1 Medium
- element synapseSynapse CPU starvation (Denial of Service)6.8 Medium
- n8nn8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints8.3 High
- n8nn8n: Source Control Pull SQL Injection8.9 High
- n8nn8n: XML Node Prototype Pollution Patch Bypass9.4 Critical
- n8nn8n: Arbitrary File Read via Git Node9.4 Critical
- hcl aionHCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions5.1 Medium
- n8nn8n: HTTP Request Node Pagination Prototype Pollution to RCE9.4 Critical
- danifus pyzipperpyzipper: Encryption bypass for small files encrypted with pyzipper6.2 Medium
- wger-project wgerwger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers8.1 High
- wger-project wgerwger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API7.5 High
- apostrophecms @apostrophecms/cli@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input6.5 Medium
- nuvoton npct7xxNuvoton - CWE-1300: Improper Protection of Physical Side Channels3.8 Low
- hcl aionHCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.2.6 Low
- hcl aionHCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed5.1 Medium
- hcl aionHCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields.2.6 Low
- hcl aionHCL AION is affected by a vulnerability where basic authorization tokens are used for authentication3.0 Low
- hcl aionHCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured2.3 Low
- cisco catalyst sd-wan managerCisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability8.6 High
- cisco catalyst sd-wan managerCisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability5.4 Medium
- cisco catalyst sd-wan managerCisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability5.4 Medium
- cisco catalyst sd-wan, catalyst sd-wan manager, catalyst sd-wan controller +2 more +4 moreCisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability10.0 Critical
- hcl aionHCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced.5.4 Medium
- hcl aionHCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels.4.3 Medium
- hcl aionHCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations5.4 Medium
- datahubDataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability4.3 Medium
- flowsintFlowsint: Stored XSS in description of node5.3 Medium
- squinky86 stigqterSTIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML8.4 High
- osc ondemandOpen OnDemand: Specially crafted filenames can execute javascript in the file browser5.3 Medium
- flowiseai flowiseFlowise: Credential Data Leak7.0 High
- flowiseai flowiseFlowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape9.4 Critical
- flowiseai flowiseFlowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- flowise, flowise components +1 moreFlowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess8.7 High
- flowiseai flowiseFlowise: Basic Auth Credentials Exposed via API7.5 High
- flowiseai flowiseFlowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- flowiseai flowiseFlowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment7.6 High
- richardhbtz soundcloud-rpcsoundcloud-rpc: Remote Code Execution via XSS in Track Title9.6 Critical
- loft-sh loftvCluster Platform: Stored XSS can lead to privilege escalation9.0 Critical
- amd athlon™ 3000 series mobile processors with radeon™ graphics, device management portal (admp), ryzen™ 3000 series desktop processors +23 more +25 moreMissing authentication in the KVM key download endpoint could allow an unauthenticated attacker...6.3 Medium
- amd athlon™ 3000 series mobile processors with radeon™ graphics, device management portal (admp), ryzen™ 3000 series desktop processors +27 more +29 moreImproper privilege management in the KVM key download component could allow an attacker to swap...6.0 Medium
- givanz vvvebVvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload8.6 High
- amd aim-t manageability service, cloud manageability service (acms), manageability api +3 more +5 moreUnsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged...7.0 High
- givanz vvvebVvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service7.1 High
- Show moreLoading…