CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- egavilanmedia phpcrudEgavilanMedia PHPCRUD 1.0 SQL Injection via firstname8.8 High
- couchcmsCouchCMS 2.2.1 Cross-Site Scripting via SVG File Upload5.1 Medium
- layerbbLayerBB 1.1.4 SQL Injection via search_query Parameter8.8 High
- jsonpickle python jsonpickle, red hat ansible automation platform 2 +1 morepython jsonpickle 2.0.0 Remote Code Execution via py/repr9.3 Critical
- mybb timeline pluginMyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF6.9 Medium
- kiteKite 4.2.0.1 U1 Unquoted Service Path Privilege Escalation8.5 High
- supsystic backupWordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion6.9 Medium
- supsystic digital publicationsWordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSS8.7 High
- supsystic membershipWordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx8.8 High
- supsystic pricing tableWordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS8.8 High
- supsystic ultimate mapsWordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx8.8 High
- codekernel queue management systemQueue Management System 4.0.0 Stored XSS via Add User5.1 Medium
- gegl libbabllibbabl 0.1.62 Broken Double Free Detection Memory Safety9.3 Critical
- cmsmadesimple cms made simpleCMS Made Simple 2.2.15 Stored XSS via SVG File Upload5.1 Medium
- compo composr cmsComposr CMS 10.0.34 Persistent Cross-Site Scripting via banners5.1 Medium
- netartmedia newslisterNewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel5.1 Medium
- themeftc theme wibarWordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component5.1 Medium
- internetdownloadmanager internet download managerInternet Download Manager 6.38.12 Scheduler Buffer Overflow6.9 Medium
- wordpress buddypressWordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting5.1 Medium
- iobit advanced system care serviceAdvanced System Care Service 13.0.0.157 Unquoted Service Path Privilege Escalation8.5 High
- cybertronsoft privacy drivePrivacy Drive 3.17.0 Unquoted Service Path Privilege Escalation8.5 High
- syncplify syncplify.me server!Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation8.5 High
- oki spsv port managerOKI sPSV Port Manager 1.0.41 Unquoted Service Path Privilege Escalation8.5 High
- yerootech ids6 dsspro digital signage systemiDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass9.3 Critical
- heliossolutions hs brand logo sliderWordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload8.7 High
- rrwo net::statsd::liteNet::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections6.5 Medium
- multicollab multicollab: content team collaboration and editorial workflowMulticollab: Content Team Collaboration and Editorial Workflow <= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration Comment4.3 Medium
- boxlite-ai boxliteBoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host9.6 Critical
- boxlite-ai boxliteBoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files10.0 Critical
- rust-openssl, sfackler openssl +1 morerust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers5.1 Medium
jsondiffpatchnpm,@rootio/jsondiffpatchRoot +1 morejsondiffpatch patch APIs are vulnerable to prototype pollution8.8 High- No product listedVersions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS)...5.1 Medium
- essentialplugin essential chat supportEssential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter5.3 Medium
wolfmqttOSS-FuzzHeap-buffer-overflow in MqttDecode_PropsNo scorep11-kitOSS-FuzzHeap-buffer-overflow in p11_lexer_nextNo scorelibcoapOSS-FuzzHeap-buffer-overflow in coap_persist_startup_lkdNo scorelibdwarfOSS-FuzzHeap-double-free in _dwarf_destruct_elf_nlaccessNo scorelibcoapOSS-FuzzUNKNOWN READ in persist_target.cNo scorep11-kitOSS-FuzzHeap-buffer-overflow in p11_lexer_nextNo score- lldpdlldpd: Heap OOB Read in VLAN Decapsulation memmove6.5 Medium
- timlegge crypt::dsaCrypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified6.5 Medium
- timlegge crypt::dsaCrypt::DSA versions before 1.20 for Perl generate seeds using rand7.3 High
- radare radare2radare2 6.1.5 Use-After-Free via gdbr_pids_list()8.7 High
- givanz vvvebVvveb: checkout IDOR allows unauthorized reuse of another user's cart7.6 High
- givanz vvvebVvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens8.1 High
- givanz vvvebVvveb: Authenticated SQL injection in /user/orders via order_by and direction8.7 High
- mattermost, mattermost server +1 morepost edit time limit is not enforced on some post update operations3.1 Low
- givanz vvvebVvveb: Unauthenticated reflected XSS in public product return form via customer_order_id5.3 Medium
- givanz vvvebVvveb: Stored XSS in Posts allows privilege escalation via post editor5.1 Medium
- freertos coremqttDoS from MQTT v5.0 Deserialization Fault in core MQTT8.7 High
- Show moreLoading…