CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- alloksoft allok avi divx mpeg to dvd converterAllok AVI DivX MPEG to DVD Converter 2.6.1217 Buffer Overflow SEH8.6 High
- alloksoft fast avi mpeg splitterAllok Fast AVI MPEG Splitter 1.2 Stack Based Buffer Overflow8.6 High
- tp-link tl-wr720n firmware, tl-wr720nmbps wireless n router +1 moreTP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719)5.3 Medium
- acl analyticsACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution9.3 Critical
- wende60 redaxo cms addon myeventsRedaxo CMS Addon MyEvents 2.2.1 SQL Injection via event_add.php7.1 High
- kalcaddle kodboxkalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection5.3 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control6.9 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 JAR Model.java importBinaryModel deserialization6.9 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure6.9 Medium
- No product listedZ-BlogPHP Commend Approval c_system_event.php CheckComment improper authorization5.3 Medium
- open5gsOpen5GS NRF nghttp2-server.c discover_handler use after free5.3 Medium
- open5gsOpen5GS AUSF nausf-handler.c ogs_timer_add denial of service5.3 Medium
- open5gsOpen5GS NRF context.c ogs_sbi_nf_service_add denial of service5.3 Medium
- open5gsOpen5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization5.3 Medium
- emqxEMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition2.3 Low
- sanluan publiccmsSanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine5.3 Medium
- sanluan publiccmsSanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key6.9 Medium
- sanluan publiccmsSanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error6.9 Medium
- sanluan publiccmsSanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authentication6.9 Medium
- oinone pamirsOinone Pamirs RestController LocalFileClient.java request.getParameter path traversal2.4 Low
- oinone pamirsOinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization5.3 Medium
- oinone pamirsOinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injection6.9 Medium
- investintech slimpdfreaderInvestintech SlimPDFReader SlimPDFReader.exe sub_3B4610 stack-based overflow5.3 Medium
- open5gsOpen5GS NRF client.c ogs_sbi_client_add denial of service5.3 Medium
- open5gsOpen5GS NRF context.c ogs_sbi_nf_instance_set_id denial of service5.3 Medium
- open5gsOpen5GS NRF message.c denial of service5.3 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token8.8 High
- open5gsOpen5GS NRF conv.c ogs_sbi_discovery_option_parse_plmn_list denial of service5.3 Medium
- coreworxlab caalCoreWorxLab CAAL test-hass Endpoint webhooks.py server-side request forgery6.9 Medium
- dataeaseDataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection5.1 Medium
md4cOSS-FuzzHeap-buffer-overflow in md_decode_utf8__No scorebinutilsOSS-FuzzUNKNOWN READ in bfd_getb32No scorematioOSS-FuzzHeap-buffer-overflow in Mat_VarGetStructsLinearNo score- academysoftwarefoundation opencolorioOpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser8.4 High
- processmakerProcessMaker 3.5.4 Local File Inclusion via Path Traversal6.9 Medium
- gotmls malware security and bruteforce firewallWordPress Anti-Malware Security Bruteforce Firewall <= 4.20.72 Directory Traversal8.7 High
- hacs home assistant community store, home-assistant home assistant community store (hacs) +1 moreHome Assistant Community Store 1.10.0 Path Traversal Account Takeover8.7 High
- bloofox bloofoxcmsbloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user add6.9 Medium
- opensolution quick.cmsQuick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders Form5.1 Medium
- getfuelcms fuel cmsFuel CMS 1.4.13 Blind SQL Injection via col Parameter7.1 High
- miniorange backup and restoreWordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion8.7 High
- textpattern cmsTextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin Upload8.7 High
- wplearnmanager wp learn managerWordPress Plugin WP Learn Manager 1.1.2 Stored XSS5.1 Medium
- vxsearch vx searchVX Search 13.5.28 Unquoted Service Path Privilege Escalation8.5 High
- sticky-notes sticky notes widgetSticky Notes Widget 3.0.6 Denial of Service via Buffer Overflow8.7 High
- sticky-notes-color-widgets sticky notes color widgetsSticky Notes & Color Widgets 1.4.2 Denial of Service8.7 High
- my-notes-safe my notes safeMy Notes Safe 5.3 Denial of Service via Buffer Overflow8.7 High
- macaron notes notesMacaron Notes 5.5 Denial of Service via Buffer Overflow8.7 High
- color-notes color notesColor Notes 1.4 Denial of Service via Long Character String8.7 High
- cookielawinfo cookie law barWordPress Plugin Cookie Law Bar 1.2.1 Stored XSS via clb_bar_msg5.1 Medium
- Show moreLoading…