CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
sulu/suluPackagistSulu: Used API Keys may be available via Admin API2.3 Low- suluSulu: Weak Cryptographical usage for API Key generation and Reset Tokens6.9 Medium
- jwt ruby-jwt`jwt` (Ruby gem) - empty-key HMAC bypass9.1 Critical
- verbb formieFormie: Pre-authenticated server-side template injection in Hidden fields9.8 Critical
- datanoisetv tinyiceTinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection8.2 High
- ecies goGestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath8.2 High
- microsoft azure local, azure resource manager +1 moreAzure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability10.0 Critical
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.8 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability5.4 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability5.4 Medium
- milamer parse-nested-form-dataPrototype Pollution in parse-nested-form-data via `__proto__` in FormData field names8.2 High
- asynchttpclient async-http-clientasync-http-client: Cookie header not stripped on cross-origin redirect7.4 High
- amir20 dozzleDozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)8.6 High
- shopperdotcom shopperShopper: Race condition on Discount.usage_limit allows silent over-redemption5.9 Medium
- shopperdotcom shopperShopper: Authorization bypass in multiple Livewire admin components8.1 High
- hamba avro, red hat cryostat 4 on rhel 9, multicluster global hub 1.4.5 +11 more +13 moreiskorotkov/avro: CPU Exhaustion in Avro Decoder8.7 High
- ci4-cms-erp ci4msCI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule8.7 High
- hamba avro, red hat cryostat 4 on rhel 9, multicluster global hub 1.4.5 +11 more +13 moreiskorotkov/avro: Integer Overflow in Avro Decoder8.7 High
- ci4-cms-erp ci4msCI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations6.5 Medium
- chroma chromadb, red hat enterprise linux ai (rhel ai) 3 +1 moreChromaDB Python project has a pre-authentication code injection vulnerability10.0 Critical
- mongodb, mongodb, inc. mongodb server +1 moreCalling createIndex with certain index types can crash mongod7.1 High
- ci4-cms-erp ci4msCI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule5.4 Medium
directxtk12_desktop_win10NuGet,directxtk12_uwpNuGet +1 moreMicrosoft DirectX12: .spritefont multiply overflow only in 32-bit builds6.9 Mediumdirectxtk_desktop_win10NuGet,directxtk_uwpNuGet +1 moreMicrosoft DirectX: .spritefont multiply overflow only in 32-bit builds6.9 MediumedumfaPyPIeduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges8.7 HighedumfaPyPIeduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage7.1 HighedumfaPyPIeduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check6.5 Medium- statamic cmsStatamic: Server-Side Request Forgery via Glide5.4 Medium
- imagemagickImageMagick: Heap Buffer Over-Read in IPTC encoder5.1 Medium
- apple private cloud compute server software, private cloud compute +1 moreAn attacker in a privileged network position may be able to leak sensitive information. A path...6.5 Medium
- faraday project faradayFaraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)0.0 None
- markmhendrickson neotomaNeotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass6.9 Medium
- getarcaneapp arcaneArcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover8.2 High
- getarcaneapp arcaneArcane: OS Command Injection in Volume Browser ListDirectory via path query parameter6.3 Medium
- difyDify < 1.14.2 Authorization Bypass via File Preview Endpoint8.2 High
- difyDify v1.14.1 Path Traversal via Plugin Daemon Internal API Access9.3 Critical
- difyDify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints9.3 Critical
- getarcaneapp arcaneArcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs9.9 Critical
@sveltia/cmsnpmSveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML2.3 Low- caddyserver caddyCaddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files8.1 High
- wwbn avideoAVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration5.3 Medium
- spring-ai-community mcp-security, springaicommunity mcp security +1 moremcp-security: Unvalidated URL Fetching (SSRF)7.2 High
- kaspernj form-data-objectizerPrototype pollution in form-data-objectizer via bracket-notation form keys8.2 High
graphitedbPyPIGraphite Has a Pickle Deserialization Vulnerability7.8 High- czlonkowski n8n-mcpn8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters6.5 Medium
github.com/hamba/avro/v2Go,github.com/iskorotkov/avro/v2Go +1 moreiskorotkov/avro: Denial-of-Service Vulnerability in Decoder8.7 Highastral-tokio-tarcrates.ioastral-tokio-tar has a PAX Header Desynchronization issue6.9 Medium- opensourcepos open source point of saleopensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash6.3 Medium
- vim, red hat enterprise linux 10, enterprise linux 10.2 extended update support +9 more +11 moreVim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution7.8 High
- m-files corporation serverDenial of service vulnerability in M-Files Server7.1 High
- Show moreLoading…