CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- lmsys sglangCVE-2026-73049.8 Critical
- lmsys sglangCVE-2026-73029.1 Critical
- lmsys sglangCVE-2026-73019.8 Critical
- creartia internet consulting icms content managementAuthorization Bypass in ICMS Content Management by Creartia Internet Consulting9.3 Critical
- opensourcepos open source point of saleopensourcepos Open Source Point of Sale Items.php getPicThumb path traversal5.3 Medium
- dell live opticsDell Live Optics Windows and Personal Edition collectors contain an improper certificate...6.8 Medium
- basamak information technology consulting and organization trade ltd. co. dernekwebStored XSS in Basamak Informatics' DernekWeb8.8 High
- mattermost, mattermost desktop +1 moreOpening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App6.5 Medium
- mattermost, mattermost desktop +1 moreCalling window.close() from server-side content causes crash in the Mattermost Desktop App3.5 Low
- mattermost, mattermost server +1 moreSSRF via Host Header Spoofing in Custom Slash Commands3.5 Low
- mattermost, mattermost server +1 morePrevent password disclosure and force reset during Slack import6.5 Medium
- mattermost, mattermost server +1 moreSensitive credentials exposed in plaintext in Mattermost support packets8.7 High
- mattermost, mattermost server +1 moreSlash command trigger-word update allowed command hijacking4.3 Medium
- mattermost, mattermost server +1 moreMattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks4.3 Medium
- mattermost, mattermost server +1 moreMattermost Calls plugin exposes TURN server credentials in plaintext in support packets7.6 High
- mattermost, mattermost server +1 moreMissing authorization check in AI message rewrite endpoint allows access to private thread content6.5 Medium
- mattermost, mattermost server +1 moreInstance and webhook GitLab plugin commands were able to be run by non-admin users6.5 Medium
- mattermost, mattermost server +1 morePlaybooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update3.1 Low
- mattermost, mattermost server +1 moreMissing request origin validation on burn-on-read reveal endpoint4.3 Medium
- perforce p4 (helix core)Code Injection in Perforce P4 (Helix Core)7.7 High
- No product listedSecurity update for podmanNo score
- mattermost, mattermost server +1 moreMemory Exhaustion via Malicious 7zip File Upload4.3 Medium
- mattermost, mattermost server +1 moreIncomplete group locking implementation4.3 Medium
- mattermost, mattermost server +1 moreGroup prefix matching bypass for subscriptions4.3 Medium
- mattermost, mattermost server +1 moreUnescaped variables during error page composition3.8 Low
- mattermost, mattermost server +1 moreInsufficient token rotation validation in remote cluster invite confirmation3.7 Low
- mattermost, mattermost server +1 moreMattermost fails to enforce create_post permission when editing posts4.3 Medium
- mattermost, mattermost server +1 moreImproper Input Validation in MS Teams Meetings API Handler4.3 Medium
- mattermost, mattermost server +1 moreInsufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels4.3 Medium
- rrwo net::statsd::liteNet::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections7.3 High
- mattermost, mattermost server +1 moreOAuth authorization code client binding not enforced during token redemption in Mattermost3.1 Low
- darren cooney ajax load moreAjax Load More < 7.8.4 - Reflected XSS7.1 High
- unknown wp mapsWP Maps < 4.9.3 - Subscriber+ Local File Inclusion7.5 High
- opajaap wp photo album plusWP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter8.6 High
- creative motion clearfy cache, optimizingmatters autoptimize, siteground speed optimizer +2 moreMultiple Plugins - Unauthenticated Stored XSS via Minify Library8.8 High
- smub feeds for youtube (youtube video, channel, and gallery plugin)Feeds for YouTube < 2.6.4 - Subscriber+ License Data Deletion5.4 Medium
- tencent weknoraTencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization5.3 Medium
- projectworlds hospital-management-system-in-phpprojectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection6.9 Medium
- npitre cramfs-toolsnpitre cramfs-tools cramfsck.c change_file_status symlink4.6 Medium
- omec-project amfomec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference5.3 Medium
- omec-project amfomec-project amf NGAP Message handler.go null pointer dereference5.3 Medium
- omec-project amfomec-project amf handler.go RANConfiguration null pointer dereference5.3 Medium
- omec-project amfomec-project amf NGAP Message dispatcher.go memory corruption5.3 Medium
- omec-project amfomec-project amf handler.go NGSetupRequest memory corruption5.3 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formStaDrvSetup command injection5.3 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formPPTPSetup buffer overflow8.7 High
- edimax br-6428nsEdimax BR-6428NS POST Request formL2TPSetup buffer overflow8.7 High
gpacOSS-FuzzHeap-use-after-free in gf_sg_resetNo scorepopplerOSS-FuzzUse-of-uninitialized-value in Splash::compositeBackgroundNo score- edimax br-6228ncEdimax BR-6228NC POST Request mp command injection5.3 Medium
- Show moreLoading…