CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- jasonlovesdoggo caddy-defenderCaddy Defender trusted proxy client IP bypass8.2 High
- beproduct beproduct-org-nestjs-authMalicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm10.0 Critical
- laurent22 joplinJoplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input5.5 Medium
- gtsteffaniak filebrowserFileBrowser Quantum: unauthenticated user share share info8.7 High
camofox-mcpnpmCamoFox MCP: Unauthenticated HTTP MCP browser-control surface7.0 High- sqlfluffSQLFluff: Uncontrolled Resource Consumption in Parser7.5 High
- sqlfluffSQLFluff: Recursive Stack Overflow in Parser7.5 High
- sillytavernSillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl8.5 High
- tomwright daselDasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal6.2 Medium
- tomwright daselDasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string6.2 Medium
- libp2p js-libp2plibp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes7.5 High
- strukturag libheif, red hat enterprise linux 10 +1 morelibheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride7.1 High
- coderCoder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft9.1 Critical
- @clerk nuxt, nuxt nuxt\/nitro-server +1 moreNuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning2.3 Low
- facelessuser pymdown extensions, pymdown-extensions +1 morePyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path4.3 Medium
- penpotPenpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE8.8 High
- strukturag libheif, red hat enterprise linux 10 +1 morelibheif has a heap buffer overflow in decode_mask_image()7.1 High
- setasign fpdiFPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service6.0 Medium
- square wireWire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service7.5 High
- coderCoder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint6.5 Medium
- haxtheweb haxcms-nodejsHAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request6.5 Medium
- ironfede openmcdfOpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle6.2 Medium
- strukturag libheiflibheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles6.5 Medium
github.com/Kuadrant/mcp-gatewayGoMCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path9.3 Criticalgithub.com/caddyserver/caddy/v2GoCaddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching4.3 Mediumgithub.com/caddyserver/caddy/v2GoCaddy CVE-2026-30852 Fix Bypass5.5 Mediumgithub.com/kong/kubernetes-ingress-controllerGo,github.com/kong/kubernetes-ingress-controller/v2Go,github.com/kong/kubernetes-ingress-controller/v3Go +2 moreKong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation5.6 Mediumgithub.com/kong/kubernetes-ingress-controllerGo,github.com/kong/kubernetes-ingress-controller/v2Go,github.com/kong/kubernetes-ingress-controller/v3Go +2 moreKong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint4.9 Medium- struktur libheif, red hat enterprise linux 10 +1 morelibheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing8.8 High
- decolua 9router9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes10.0 Critical
- apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +1 moreApache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments8.7 High
- kopiaKopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used9.8 Critical
- apache apache-airflow-providers-amazon, apache software foundation airflow amazon provider +1 moreApache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends5.3 Medium
- struktur libheiflibheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup6.5 Medium
- struktur libheiflibheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk6.5 Medium
- live networks, inc. live555LIVE555 < 2026.04.22 RTSP Server Authorization Bypass via Session Token8.2 High
- broadcom automic automationAutomic Automation Agent Unix privilege escalation8.5 High
- discourseDiscourse has a subscription access bypass in its discourse-subscriptions plugin2.1 Low
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP7.5 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action6.5 Medium
- espocrmEspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript6.8 Medium
- kitty project kittyKitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check9.9 Critical
- kitty project kittyKitty has a Heap Buffer Overflow in its Graphics Protocol Handler7.5 High
- jaspersoft jasperreports io at-scale, jasperreports io professional, jasperreports library community edition +5 more +7 moreJaspersoft Library Deserialisation Vulnerability8.7 High
- nanomq, nanomq nanonng +1 moreNanoMQ: NULL Pointer Dereference Crash in tcptran_pipe_peer During Session Restore5.9 Medium
- scadabrUse of Hard-coded Credentials in ScadaBR5.1 Medium
- scadabrCross-Site request forgery (CSRF) in ScadaBR8.6 High
- scadabrImproper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR8.7 High
- scadabrMissing authentication for critical function in ScadaBR8.8 High
- windmill-labs windmillWindmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration8.6 High
- Show moreLoading…