CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- apache ofbizApache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs6.5 Medium
- apache ofbizApache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction9.1 Critical
- apache ofbizApache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services6.5 Medium
- apache ofbizApache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection9.1 Critical
- apache ofbizApache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access7.5 High
- apache ofbizApache OFBiz: Unauthenticated Shipment Label Image Disclosure7.5 High
- apache ofbizApache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters6.1 Medium
- apache ofbizApache OFBiz: Cross-Tenant Data Exposure via Program Export Feature5.3 Medium
- apache ofbizApache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation5.3 Medium
- typo3 extension "content element selector"Remote Code Execution in extension "Content Element Selector" (ceselector)9.2 Critical
- typo3 extension "address list"SQL Injection in extension "Address List" (tt_address)8.2 High
- apache ofbizApache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass6.5 Medium
- typo3 extension "faceted search"Path Traversal in extension "Faceted Search" (ke_search)5.9 Medium
- typo3 extension "faceted search"Information Disclosure in extension "Faceted Search" (ke_search)5.9 Medium
- typo3 extension "faceted search"XML External Entity Injection in extension "Faceted Search" (ke_search)5.9 Medium
- apache ofbizApache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager6.1 Medium
- typo3 extension "news system"SQL Injection in extension "News system" (news)8.2 High
- apache ofbizApache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution6.5 Medium
- apache ofbizApache OFBiz: Low-Privilege SSRF in Content Component7.3 High
- typo3 extension "frontend user registration"Broken Access Control in extension "Frontend User Registration" (sf_register)6.9 Medium
- apache ofbizApache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component6.5 Medium
- apache ofbizApache OFBiz: Low-Privilege LFI in Content Component6.5 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreImproper Origin Validation in mlflow/mlflow9.6 Critical
- typo3 extension "site crawler"Remote Code Execution in extension "Site Crawler" (crawler)7.1 High
opensslTuxCare,openssl-develTuxCare,openssl-libsTuxCare +1 more +3 moreUpdate of opensslNo score- zte mu5250Unauthorized access vulnerability in ZTE MU52506.3 Medium
- piotnet addons for elementor proPiotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload9.8 Critical
- samsung escargotUncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation....5.5 Medium
- samsung escargotImproper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source...5.5 Medium
- samsung escargotImproper Check for Unusual or Exceptional Conditions vulnerability in Samsung Open Source...5.5 Medium
- samsung escargotOut-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This...7.8 High
- samsung escargotMemory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows...5.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services5.4 Medium
- samsung escargotRelease of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows...5.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation4.3 Medium
- fortispay fortis for woocommerceFortis For WooCommerce < 1.3.1 - Sensitive API Key Disclosure7.5 High
exifreadernpmExifReader is vulnerable to denial of service via unbounded decompression of image metadata6.9 MediumexifreadernpmExifReader is vulnerable to denial of service via crafted ICC `mluc` tag8.7 High- samsung escargotHeap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers....7.8 High
- samsung escargotUse after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This...7.8 High
- samsung escargotUncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized...5.5 Medium
- rocket.chatThe /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, ...5.3 Medium
- samsung walrusNULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation....5.5 Medium
- openharmonykernel_linux_common_modules has a Race Condition vulnerability3.3 Low
- openharmonyfilemanagement_storage_service has an use after free vulnerability6.5 Medium
- openharmonymultimedia_audio_framework has a Race Condition vulnerability5.5 Medium
- openharmonyfilemanagement_storage_service has an improper preservation of permissions vulnerability5.5 Medium
- openharmonykernel_liteos_a has an out-of-bounds write vulnerability8.4 High
- openharmonyfilemanagement_storage_service has an improper input validation vulnerability3.3 Low
- openharmonykernel_liteos_a has an integer overflow vulnerability3.3 Low
- Show moreLoading…