CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
gpacOSS-FuzzHeap-use-after-free in gf_node_get_idNo scorequickjsOSS-FuzzHeap-use-after-free in JS_DefinePropertyNo scorelibcoapOSS-FuzzHeap-buffer-overflow in coap_pdu_parse_headerNo score- linlinjava litemalllinlinjava litemall Database Setting DbUtil.java load argument injection5.1 Medium
- No product listedThermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability...8.8 High
- No product listedAn issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker...7.5 High
- No product listedOpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format...6.2 Medium
- No product listedAn issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain...5.3 Medium
- hsclabs mailinspectorHSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police...6.1 Medium
- hsclabs mailinspectorHSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap...6.1 Medium
- hsclabs mailinspectorHSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user...7.5 High
- hsclabs mailinspectorHSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper...7.5 High
- No product listedOffline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron...7.3 High
ngroknpmngrok is Vulnerable to Command Injection8.8 High- No product listedIn tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles...7.5 High
- No product listedIncorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows...9.1 Critical
- linlinjava litemalllinlinjava litemall Admin Endpoint sql injection5.1 Medium
- linlinjava litemalllinlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection6.9 Medium
- continuecontinuedev continue JSON-RPC Server lsTool.ts lsTool path traversal4.8 Medium
- vercel aivercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption5.3 Medium
- vercel aivercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery6.9 Medium
- vercel aivercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection2.3 Low
- kilo-org kilocode, kilo code cli +1 moreKilo-Org kilocode Environment Variable config.ts load information disclosure5.3 Medium
- kilo code, kilo-org kilocode +1 moreKilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal5.3 Medium
- h3c magic b3H3C Magic B3 aspForm UpdateWanParams buffer overflow8.6 High
- jonasbn crypt::openssl::pkcs12Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs9.8 Critical
- jonasbn crypt::openssl::pkcs12Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws9.8 Critical
- rrwo net::statsd::tinyNet::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections8.2 High
- xiandafu beetlxiandafu beetl SpELFunction SpELFunction.java expression language injection6.9 Medium
- metasoft 美特软件 metacrmMetasoft 美特软件 MetaCRM upload3.jsp unrestricted upload6.9 Medium
- adenhq hiveadenhq hive Delete Request routes_sessions.py _read_events_tail path traversal6.9 Medium
- fishaudio bert-vits2fishaudio Bert-VITS2 Gradio webui_preprocess.py generate_config path traversal6.9 Medium
- fishaudio bert-vits2fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal6.9 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot File Upload chat.py post_file path traversal5.3 Medium
- bylancer zechatZechat 1.5 Cross-Site Request Forgery (CSRF) via hashtag parameter5.3 Medium
- bylancer zechatZechat 1.5 SQL Injection via v parameter (time-based blind)8.8 High
- bylancer zechatZechat 1.5 SQL Injection via hashtag parameter8.8 High
- joomlaextensions joomla! extension joomocshopJoomla JoomOCShop 1.0 Cross-Site Request Forgery5.3 Medium
- jcart for opencartjCart for OpenCart 2.3.0.2 Cross-Site Request Forgery6.9 Medium
- peugeot-music-plugin peugeot musicWordPress Plugin Peugeot Music 1.0 Arbitrary File Upload9.3 Critical
- nordex-online n149 wind turbine web serverNordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection8.8 High
- gitbucketGitBucket 4.23.1 Unauthenticated Remote Code Execution9.3 Critical
- zenar content management systemZenar Content Management System Cross-Site Scripting via ajax.php5.1 Medium
- joomlaextensions joomla! extension ekrishtaJoomla! EkRishta 2.10 Persistent XSS and SQL Injection8.8 High
- wp-with-spritz wp with spritzWordPress Plugin WP with Spritz 1.0 Remote File Inclusion8.7 High
- vxsearch vx searchVX Search 10.6.18 Local Buffer Overflow via Directory Field8.6 High
- joomsky js jobsJoomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery6.9 Medium
- wp-google-drive google driveGoogle Drive for WordPress 2.2 Path Traversal RCE via gdrive-ajaxs.php8.7 High
- woocommerce-csvimport woocommerce csv-importerWoocommerce CSV Importer 3.3.6 Path Traversal File Deletion8.7 High
- simple-fields simple fieldsSimple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath6.9 Medium
- Show moreLoading…