CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- tyler technologies tid-lTyler Identity Local (TID-L) default administrative credentials9.3 Critical
- hestiacpHestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header8.7 High
- hestiacpHestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal9.5 Critical
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreHTML injection in Smart Polling in Guardian/CMC before 26.1.05.1 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreHTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.04.8 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreHTML injection in Users in Guardian/CMC before 26.1.04.8 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreHTML injection in Credentials Manager in Guardian/CMC before 26.1.04.8 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreAngular template injection in Reports in Guardian/CMC before 26.1.05.1 Medium
- qtUncontrolled Search Path Element in Qt Network OpenSSL TLS backend allows rogue CA certificate loading1.8 Low
- sparx systems pro cloud serverDoS in Sparx Pro Cloud Server7.1 High
- sparx systems pro cloud serverRace Condition in Sparx Pro Cloud Server7.7 High
- sparx systems enterprise architectAuthorization Bypass in Sparx Enterprise Architect8.7 High
- sparx systems pro cloud serverAuthentication Bypass in Sparx Pro Cloud Server9.3 Critical
- sparx systems pro cloud serverBroken Access Control in Sparx Pro Cloud Server8.7 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Thunderbird 1518.8 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the WebRTC: Audio/Video component8.8 High
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Networking: JAR component6.5 Medium
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security component8.1 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Graphics: WebGPU component7.5 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the IP Protection component7.5 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the DOM: Security component7.5 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Popup Blocker component7.5 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Web Speech component7.5 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in WebExtensions7.5 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Application Update component8.8 High
- mozilla firefoxSpoofing issue in the Toolbar component in Firefox for Android6.5 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreSame-origin policy bypass in the DOM: Networking component9.1 Critical
- mozilla firefox, firefox focus, red hat enterprise linux 10 +4 more +6 moreSandbox escape in Firefox and Firefox Focus for Android7.5 High
- apache camel, red hat openshift serverless, build of apache camel 4 for quarkus 3 +4 more +6 moreApache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering9.8 Critical
- suse container suse/sle-micro-rancher/5.3:latest, container suse/sle-micro-rancher/5.4:latest, container suse/sle-micro/5.5:latest +31 more +33 moreMissing exit out of permission check in haveged could lead to root exploit7.8 High
- pnggroup libpng, libpng-apng +1 moreLIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body5.4 Medium
- piotnet forms, piotnetdotcom piotnet forms +1 morePiotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload9.8 Critical
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 28.1.6 - Unauthenticated SQL Injection7.5 High
- nextcloud flowPossible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build1.6 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: access token disclosure and implicit flow bypass via forged client data7.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +2 more +4 moreOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak8.1 High
- brainstorm force presto player, presto made, inc player +1 moreWordPress Presto Player plugin <= 4.1.3 - Broken Access Control vulnerability4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api4.9 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via specially crafted saml input7.5 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morecrypto: pcrypt - Fix handling of MAY_BACKLOG requests9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morelib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()5.5 Medium
- linux, linux kernel +1 morenet: qrtr: ns: Limit the maximum server registration per node5.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference6.8 Medium
- apache tomcatApache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind7.3 High
- apache ofbizApache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution8.8 High
- apache ofbizApache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE9.8 Critical
- Show moreLoading…