CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- givanz vvvebVvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals7.5 High
- podcastgenerator podcast generatorPodcast Generator 3.1 Persistent Cross-Site Scripting via long_description5.1 Medium
- timeclock php timeclockPHP Timeclock 1.04 Multiple Cross-Site Scripting via Parameters5.1 Medium
- timeclock php timeclockPHP Timeclock 1.04 SQL Injection via login.php8.8 High
- wp-super-edit wp super editWordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload9.3 Critical
- schlix cmsSchlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager8.7 High
- anothernote anoteAnote 1.0 Persistent Cross-Site Scripting Leading to Code Execution5.1 Medium
- savsofts savsoft quizSavsoft Quiz 5.0 Persistent Cross-Site Scripting via User Settings5.1 Medium
- wpgraphqlWordPress Plugin WPGraphQL 1.3.5 Denial of Service8.7 High
- couchcmsCouchCMS 2.2.1 Server-Side Request Forgery via SVG upload5.3 Medium
- wwbn avideoAVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post6.5 Medium
- wwbn avideoWWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA5.7 Medium
- wwbn avideoWWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute5.4 Medium
- givanz vvvebVvveb: Stored XSS via Comment Author Field6.1 Medium
- mattermost, mattermost server +1 moreSVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service4.3 Medium
- wwbn avideoWWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL8.8 High
- com.oviva.telematik epa4all-clientepa4all-client: Improper Verification of Cryptographic Signature7.4 High
- com.oviva.telematik epa4all-clientepa4all-client: TLS Certificate Validation Disabled in Production8.1 High
- mathesar-foundation mathesarMathesar: Missing collaborator checks allowed access to database-scoped Mathesar metadata5.3 Medium
- mathesar-foundation mathesarMathesar: Missing collaborator checks allowed access to saved explorations in other databases5.3 Medium
- avideoAVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint9.2 Critical
github.com/arnika-project/arnikaGoarnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS6.3 Medium- simplesamlphp simplesamlphp-module-casserverSimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion8.6 High
- code16 sharpAuthenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint7.7 High
- budibaseBudibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters…8.8 High
- budibaseBudibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration7.7 High
- budibaseBudibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation7.7 High
- better-authBetter Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation7.3 High
- teodesian trog::totpTrog::TOTP versions before 1.006 for Perl generate secrets using rand7.5 High
- better-authbetter-auth before 1.6.2 OAuth State Validation Bypass6.0 Medium
goshs.de/goshsGo,goshs.de/goshs/v2Go +1 moregoshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request7.4 High- weblateorg weblateWeblate: Stored HTML injection in editor search preview4.6 Medium
- php frankenphpFrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files8.1 High
- radare radare2radare2 6.1.5 Use-After-Free via gdbr_threads_list()8.7 High
- 611711dark mcp calculate serverMCP Calculate Server: Prompt Injection to RCE9.8 Critical
- pipecatPipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator7.5 High
- eugeny tabbyTabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution8.4 High
- eugeny tabbyTabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh7.0 High
- nukevietNukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class8.7 High
- eugeny tabbyTabby: RCE via `tabby://run` URL Scheme9.4 Critical
- eugeny tabbyTabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation7.1 High
- cockpit-hq cockpitCockpit CMS 2.14.0 Stored XSS via Set Field Display Template5.1 Medium
- nimiq core-rs-albatrossnimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT7.5 High
- joplinapp joplin, msiemens one2html +1 moreJoplin: Path traversal in OneNote importer allows overwriting arbitrary files8.2 High
- simplesamlphp simplesamlphp-module-casserverSimpleSAMLphp-casserver has an Open Redirect vulnerability via logout4.7 Medium
- benmcollins libjwtLibJWT: Algorithm confusion allows JWT forgery with RSA JWK as empty-key HMAC9.1 Critical
- microsoft apmMicrosoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`5.5 Medium
- microsoft apmMicrosoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree7.4 High
- vercel turborepoTurborepo: Login callback CSRF/session fixation5.1 Medium
- vercel turborepo, turborepo language server protocol +1 moreTurborepo: VSCode Extension command injection8.4 High
- Show moreLoading…