CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- openharmonyweb_webview has an out-of-bounds write vulnerability8.8 High
- openharmonySensors_medical_sensor has a NULL pointer dereference vulnerability3.3 Low
- openharmonyweb_webview has a Race Condition vulnerability8.1 High
- samsung walrusNULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause...5.5 Medium
- discourseDiscourse: Information Disclosure in Form Template API Due to Missing Authorization6.0 Medium
- significant-gravitas autogptAutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server5.0 Medium
- significant-gravitas autogptAutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries7.6 High
- significant-gravitas autogptAutoGPT: Unauthenticated DoS via Disk Space Exhaustion7.5 High
- mullvad vpn, mullvadvpn-app +1 moreMullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer7.3 High
md4cOSS-FuzzHeap-buffer-overflow in md_is_link_titleNo score- discourseDiscourse: Cached outdated summaries can leak removed content5.3 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreMemory safety bugs fixed in Thunderbird 140.11 and Thunderbird 1518.8 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Thunderbird 140.11 and Thunderbird 1518.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Security component8.8 High
- mozilla firefox, thunderbird +1 moreDenial-of-service due to invalid pointer in the Audio/Video: Web Codecs component7.5 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security component8.1 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Form Autofill component6.5 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Widget: Win32 component9.6 Critical
- mozilla firefox, thunderbird +1 moreInformation disclosure, sandbox escape in the Security: Process Sandboxing component8.6 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Enterprise Policies component8.8 High
- mozilla firefox, thunderbird +1 moreInteger overflow in the Networking: JAR component9.8 Critical
- mozilla firefox, thunderbird +1 morePrivilege escalation in the DOM: Workers component8.8 High
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions, integer overflow in the Audio/Video component7.5 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Disability Access APIs component9.6 Critical
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Networking: HTTP component9.3 Critical
- mozilla firefox, thunderbird +1 moreInteger overflow in the Widget: Win32 component7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreUse-after-free in the DOM: Bindings (WebIDL) component7.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreIncorrect boundary conditions in the Audio/Video: Web Codecs component7.5 High
- No product listedAn authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an...7.3 High
- No product listedAn OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin...9.8 Critical
- No product listedAn authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up...9.8 Critical
- No product listedA command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP...8.8 High
- No product listedA command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web...5.4 Medium
- No product listedAn issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell...5.3 Medium
- red hat ansible automation platform 2, openstack platform 18.0, quay 3 +1 more +3 moreAPScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization9.8 Critical
- No product listedAPI endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication...9.1 Critical
- No product listedThe LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote...9.8 Critical
billabear/billabearPackagistBillaBear is Vulnerable to SQL Injection in the EventRepository8.8 High- No product listedscalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the...9.8 Critical
- No product listedscalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the...9.8 Critical
github.com/itang/gohttpGo,govulncheck-vulndbopenSUSE +1 moregohttp is vulnerable to directory traversal via a crafted request7.3 High- red hat openshift ai (rhoai)ModelScope is vulnerable to arbitrary code injection via a crafted module7.3 High
- cephCeph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery8.9 High
- glpi-project glpiGLPI: Unauthorized export of form structure5.1 Medium
- significant-gravitas autogptAutoGPT has Authenticated Session Hijacking via IDOR7.1 High
- bigbluebutton bbb-playback, bigbluebutton, blindsidenetworks scalite +2 moreBigBlueButton has Stored XSS in bbb-playback replay6.5 Medium
- dokployDokploy has Command Injection in its Service Operations9.9 Critical
- freepbx security-reportingFree PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php8.6 High
- imagemagickImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder4.0 Medium
- imagemagickImageMagick: Stack overflow in fx operation6.2 Medium
- Show moreLoading…