CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- @turbo codemod, vercel turborepo, @turbo workspaces +2 moreTurborepo: Unexpected local code execution during Yarn Berry detection0.0 None
- google cloud internal integration platform apisGoogle Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.10.0 Critical
- apache flinkApache Flink: Remote code execution via SQL injection in code generation8.1 High
- cligh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection3.5 Low
- vimVim: Command injection in tar#Vimuntar via missing shellescape {special} flag3.6 Low
- silabs.com simplicity sdkInsufficient DPA countermeasure reseeding4.1 Medium
- tonyc imagerImager versions through 1.030 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files6.5 Medium
- debian linux, linux kernel, red hat nvidia for rhel 10 +25 more +27 moreptrace: slightly saner 'get_dumpable()' logic7.1 High
- dhtmlx pdf export moduleRemote Code Execution in PDF Export Module10.0 Critical
- dhtmlx pdf export modulePath Traversal in PDF Export Module9.2 Critical
- dhtmlx diagramPath Traversal in Diagram9.2 Critical
- eugeny russhRussh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases7.5 High
- guimard apache::session::generate::sha256, apache\ +1 moreApache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids6.5 Medium
- tonyc imager::file::gif, imager\ +1 moreImager::File::GIF versions through 1.002 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files5.3 Medium
- No product listedSecurity update for kernel-livepatch-MICRO-6-0_Update_21No score
- No product listedSecurity update for kernel-livepatch-MICRO-6-0_Update_21No score
- huawei emui, harmonyos +1 moreOut-of-bounds write vulnerability in the distributed file system module. Impact: Successful...6.8 Medium
- huawei emui, harmonyos +1 morePermission control vulnerability in the projection module. Impact: Successful exploitation of...6.2 Medium
- huawei harmonyosPermission control vulnerability in the manufacturability design module. Impact: Successful...5.9 Medium
- huawei harmonyosPermission control vulnerability in the manufacturability design module. Impact: Successful...5.9 Medium
- huawei harmonyosPermission control vulnerability in the smart sensing service. Impact: Successful exploitation of...5.6 Medium
- huawei harmonyosPermission control vulnerability in the app management and control module. Impact: Successful...3.6 Low
- huawei harmonyosPermission control vulnerability in contacts. Impact: Successful exploitation of this...5.9 Medium
- huawei emui, harmonyos +1 morePermission control vulnerability in calls. Impact: Successful exploitation of this vulnerability...5.8 Medium
- huawei harmonyosPermission control vulnerability in the security control module. Impact: Successful exploitation...5.5 Medium
- huawei harmonyosUse-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this...5.6 Medium
- huawei harmonyosStack overflow vulnerability in the media platform. Impact: Successful exploitation of this...2.8 Low
- huawei harmonyosPermission control vulnerability in the web. Impact: Successful exploitation of this...8.4 High
- krajowa izba rozliczeniowa szafirhostRemote Code Execution in SzafirHost8.6 High
- techlabpro1 classified listing – ai-powered classified ads & business directory pluginClassified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions4.3 Medium
- pektsekye notify odooNotify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update4.3 Medium
- justinkruit advanced custom fields: font awesome fieldAdvanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field6.4 Medium
- davidfcarr quick playgroundQuick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter7.5 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter4.9 Medium
- smartcatai smartcat translator for wpmlSmartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update6.5 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form8.8 High
- m615926 receive notifications after form submitting – form notify for any formsReceive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback9.8 Critical
- avb disc soft daemon tools lite, daemon tools lite, disc-soft daemon tools +2 moreA supply chain attack compromised the official installation packages of DAEMON Tools Lite ...9.3 Critical
- realmag777 fox – currency switcher professional for woocommerceFOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion8.1 High
- dream-theme the7 — website and ecommerce builder for wordpressThe7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter6.4 Medium
- vmware fusionTOCTOU local privilege escalation vulnerability7.8 High
- delphix continuous data cassandra connector, cockroachdb connector, couchbase connector +9 more +11 moreImproper input validation in Delphix Continuous Data connectors allows an authenticated user to...8.7 High
- fujitsu japan limited musetheque v4 information disclosure for ipknowledgeCross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for...8.5 High
- fujitsu japan limited musetheque v4 information disclosure for ipknowledgeCross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE...4.8 Medium
- linux, linux kernel +1 moreksmbd: validate inherited ACE SID length8.8 High
- amd epyc™ 7002 series processors, epyc™ embedded 7002 series processors, ryzen embedded v2000a series processors +31 more +33 moreImproper isolation of shared resources within the CPU operation cache on Zen 2-based products...7.3 High
- amd instinct™ mi210, instinct™ mi250, instinct™ mi250x +6 more +8 moreUnrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a...9.2 Critical
- amd instinct™ mi300a, instinct™ mi300x, instinct™ mi308x +1 more +3 moreAn out of bounds read in the remote management firmware could allow a privileged attacker read a...1.8 Low
- amd instinct™ mi210, instinct™ mi250, instinct™ mi300a +5 more +7 moreA race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent...2.0 Low
- amd instinct™ mi300a, instinct™ mi300x, instinct™ mi308x +3 more +5 moreImproper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine ...8.8 High
- Show moreLoading…