CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- No product listedSecurity update for kernel-livepatch-MICRO-6-0_Update_22No score
- No product listedSecurity update for kernel-livepatch-MICRO-6-0_Update_22No score
- apify apify-mcp-serverApify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching6.1 Medium
- budibaseBudibase: Unrestricted Upload of File with Dangerous Type7.6 High
- budibaseBudibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour4.2 Medium
- wwbn avideoWWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`6.9 Medium
github.com/envoyproxy/ai-gatewayGoEnvoy AI Proxy - MCP Message Smuggling Vulnerability6.3 Medium- composerComposer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs7.5 High
- n8nn8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint5.3 Medium
- tp-link archer ax72 firmware, tp-link systems inc. archer ax72 (sg) v1.0 +1 moreInformation Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX724.6 Medium
- n8nn8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter5.3 Medium
- strawberry graphql, strawberry-graphql strawberry +1 moreStrawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs3.1 Low
- argoproj argo cd, argo-cd +1 moreArgo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation7.3 High
- argoproj argo cd, argo-cd +1 moreArgo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations6.3 Medium
- axllent mailpitMailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes7.5 High
- axllent mailpitMailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)5.9 Medium
- tenable terrascanTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL...9.3 Critical
- axllent mailpitMailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs5.9 Medium
- tenable terrascanTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the...9.3 Critical
- tenable terrascanTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the...8.7 High
- axllent mailpitMailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer5.8 Medium
- caddyserver caddyCaddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization5.4 Medium
- @clerk nuxt, nuxt nuxt\/rspack-builder, nuxt\/webpack-builder +2 moreNuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)5.9 Medium
- @clerk nuxtNuxt: Reflected XSS in `navigateTo()` external redirect5.3 Medium
land.oras:oras-java-sdkMavenORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation8.1 Highauth-fetch-mcpnpmauth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs8.2 High- guardrails ai guardrails, guardrailsai guardrails ai +1 moreMalicious code in guardrails-ai 0.10.1 (supply chain compromise)9.6 Critical
- hyperledger fabric-chaincode-javafabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode5.5 Medium
- netfoundry zrokzrok copy writes attacker-controlled WebDAV paths outside the destination root8.3 High
- go-gitgo-git: Crafted repositories may modify main and submodule .git directories5.4 Medium
- go-gitgo-git: Improper single-quote escaping in go-git SSH transport2.3 Low
- netfoundry zrokzrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths9.9 Critical
- haxtheweb haxcms-nodejs, haxcms-php +1 moreHAXcms: Mass Token Exfiltration and Cross-Tenant Hijack8.7 High
- haxtheweb haxcms-nodejs, iframe-loader, video-player +2 moreHAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover9.3 Critical
- haxtheweb haxcms-nodejsHAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation9.3 Critical
- haxtheweb @haxtheweb/open-apisHAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis8.7 High
- haxtheweb video-player, haxcms-nodejs +1 moreHAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft9.3 Critical
- haxtheweb haxcms-nodejs, haxcms-php +1 moreHAXcms createSite SSRF Enables Arbitrary File Read7.1 High
- motorola phonesAn improper authentication vulnerability was discovered in the Motorola Factory Test component ...8.4 High
github.com/xyproto/algernonGoAlgernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication5.3 Medium- xyproto algernonAlgernon: handler.lua discovery walks parent directories above the server root9.0 Critical
- xyproto algernonAlgernon: Single-file mode unconditionally enables debug mode7.5 High
- scribanScriban before 7.2.0 Denial of Service via array.insert_at8.7 High
- kjd idna, internationalized domain names in applications +1 moreInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix6.9 Medium
- mozilla firefox, firefox for ios +1 moreSensitive user data could be leaked to other applications through Reader mode6.5 Medium
- eclipse glassfishGlassFish's Administration Console is Vulnerable to RCE9.1 Critical
- f5 nginx javascript, njs +1 moreNGINX JavaScript vulnerability9.2 Critical
- eclipse glassfishGlassFish's gadget handler is vulnerable to RCE9.6 Critical
- funnelkit funnel builder for woocommerce checkoutFunnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX8.7 High
- synology dns serverTechnitium DNS Server excessive DNSSEC requests6.9 Medium
- Show moreLoading…