CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- etspring lj comments import: reloadedLJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameter6.1 Medium
- prosolution wp clientProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'9.8 Critical
- askywhale games catalogGames Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion4.3 Medium
- isc bind, bind 9 +1 moreUnbounded resend loop in BIND 9 resolver5.3 Medium
- isc bind, bind 9, red hat enterprise linux 10 +6 more +8 moreSIG(0) validation during query flood may lead to undefined behavior7.5 High
- isc bind, bind 9, red hat enterprise linux 10 +9 more +11 moreInvalid handling of CLASS != IN7.5 High
- mate-desktop atril, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +11 more +13 morePDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen8.4 High
- rsyncproject rsyncRsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy2.1 Low
- suse opensuse, linux enterprise +1 morePath Traversal in Plugin Loading in libzypp8.5 High
- No product listedInfoScale CmdServer before 7.4.2 mishandles access control.8.8 High
- veritas infoscale operations managerCross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM)...8.8 High
- veritas infoscale operations managerInfoScale VIOM 9.1.3 allows XSS.5.4 Medium
- veritas infoscale operations managerSQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.6.5 Medium
- nlnet labs unboundUse after free and crash under special conditions in RPZ code4.6 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreUnbounded name compression in certain cases causes degradation of service6.9 Medium
- rsyncproject rsyncRsync < 3.4.3 Out-of-Bounds Array Read via recv_files()6.9 Medium
- rsyncproject rsyncRsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls7.2 High
- rsyncproject rsync, red hat discovery 2, enterprise linux 10 +5 more +7 moreRsync < 3.4.3 Integer Overflow Information Disclosure6.1 Medium
- rsyncproject rsyncRsync < 3.4.3 Authorization Bypass via Hostname Resolution6.3 Medium
- linux, linux kernel, red hat nvidia for rhel 10 +28 more +30 morenet: skbuff: propagate shared-frag marker through frag-transfer helpers8.8 High
- nlnet labs unboundPossible cache poisoning via promiscuous records for the authority section5.7 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreCrash during DNSSEC validation of malicious content8.7 High
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreHeap overflow with multiple NSID, COOKIE, PADDING EDNS options8.7 High
- nlnet labs unboundDegradation of service with unbounded NSEC3 hash calculations6.9 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreJostle logic bypass degrades resolution performance6.9 Medium
- nlnet labs unbound, red hat data grid 8, enterprise linux 10 +10 more +12 moreLong list of incoming EDNS options degrades performance6.6 Medium
- nlnet labs unboundAnother 'ghost domain names' attack variant6.6 Medium
- No product listedBuffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute...7.5 High
- isc bind, bind 9, red hat enterprise linux 10 +6 more +8 moreHeap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation7.4 High
- isc bind, bind 9 +1 moreAmplification vulnerabilities via self-pointed glue records5.3 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 morePossible arbitrary code execution during DNSSEC validation9.1 Critical
- nlnet labs unboundPacket of death with DNSCrypt4.6 Medium
@cyntler/react-doc-viewernpm@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode6.1 Medium- isc bind, bind 9, red hat enterprise linux 10 +9 more +11 moreBIND 9 server memory exhaustion during GSS-API TKEY negotiation7.5 High
- rsyncproject rsync, red hat discovery 2, enterprise linux 10 +5 more +7 moreRsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write7.3 High
- triliumnext triliumTrilium Notes: macOS TCC Bypass via Prompt Spoofing5.5 Medium
- triliumnext triliumTrilium Notes has Local File Inclusion via upload modified file API endpoint6.8 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +5 more +7 moreWindows BitLocker Security Feature Bypass Vulnerability6.8 Medium
- laurent22 joplinJoplin Server delta API returns note content after share access is revoked5.7 Medium
- ledger live, ledgerhq/hw-app-eth +1 moreLedger Live hw-app-eth EIP-712 Message Parsing Integer Truncation6.9 Medium
- ledger flex, nano x, stax +2 moreLedger Nano X, Flex, Stax MCU Firmware Update Denial of Service5.1 Medium
- convoypanel panelCtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass8.1 High
libtemplate-perlDebian,perl-Template-ToolkitMageia +1 moreTemplate::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected6.1 Medium- convoypanel panelCtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output4.8 Medium
- convoypanel panelCtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking8.7 High
- amd epyc™ 4004, epyc™ 4005, ryzen™ 6000 series processors with radeon™ graphics +14 more +16 moreImproper input validation in the System Management Mode (SMM) communications buffer could allow a...4.6 Medium
- convoypanel panelCtrlPanel: Unauthenticated RCE using installer script10.0 Critical
- convoypanel panelCtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints6.5 Medium
- convoypanel panelCtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php6.6 Medium
- angular, red hat enterprise linux 8, fuse 7 +2 moreAngular: SSRF via Hostname Hijacking in @angular/platform-server8.8 High
- Show moreLoading…