CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API4.3 Medium
- six apart ltd. movable type, movable type advanced, movable type premium +1 more +3 moreMissing authorization vulnerability exists in Movable Type. Under certain conditions, when a user...5.3 Medium
- talend administration centerSecurity fix for Qlik Talend Administration Center URL access control vulnerability8.2 High
- talend administration centerSecurity fix for Qlik Talend Administration Center cross-site scripting vulnerability5.4 Medium
- sigmaplugin advanced database cleaner – premiumAdvanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'8.8 High
- smub all in one seo – powerful seo plugin to boost seo rankings & increase trafficAll in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data4.3 Medium
- nvidia tensorrt-llm, tensorrt llm +1 moreNVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could ...7.5 High
- nvidia tensorrt-llm, tensorrt llm +1 moreNVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an ...5.5 Medium
- nvidia tensorrt-llm, tensorrt llm +1 moreNVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized...6.3 Medium
- nvidia tensorrt-llm, tensorrt llm +1 moreNVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could...7.5 High
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker...5.7 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker...8.0 High
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker...8.0 High
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer...7.5 High
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path...7.5 High
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path...5.3 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an...9.8 Critical
- tonnet tpr7308TONNET｜E-LAN Hybrid Recording System - SQL Injection8.7 High
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an...7.3 High
- microsoft boostBoost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie9.8 Critical
- xpro addons — 140+ widgets for elementorXpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation5.3 Medium
- microsoft boostBoost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters7.5 High
- mailcow mailcow-dockerizedmailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped7.4 High
- mcinvale faces of usersFaces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute6.4 Medium
- goback2 logo manager for enamadLogo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute6.4 Medium
- winking word 2 cashWord 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page6.1 Medium
- svil4ok bottom barBottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update4.3 Medium
- helpstring child height predictor by ostheimerChild Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form4.3 Medium
- edmon.parker read more & accordionRead More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- yog2515 general optionsGeneral Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter4.4 Medium
- oliverpos oliver pos – a woocommerce point of sale (pos)Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header6.5 Medium
- jay patel remove yellow bgboxRemove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery4.3 Medium
- submone amazon scraperAmazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update4.3 Medium
- olivesystem 診断ジェネレータ作成プラグイン診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter6.4 Medium
- edmon.parker read more & accordionRead More & Accordion <= 3.5.7 - Privilege Escalation via importData8.8 High
- wpdive nexa blocks – gutenberg blocks, page builder for gutenberg editor & fseNexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter5.4 Medium
- rdbeach blogchat chat systemBLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update6.1 Medium
- beycanpress account switcherAccount Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation8.8 High
- eazyserver sentence to seo (keywords, description and tags)Sentence To SEO (keywords, description and tags) <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters6.1 Medium
- conoha typesquare webfonts for conohaTypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter4.3 Medium
- vatanyazilim vatansms wp smsVatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter6.1 Medium
- owencutajar sponsormeSponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter6.1 Medium
- javibola custom theme testJaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery4.3 Medium
- ktulhu bigfishgames syndicateBigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Update4.3 Medium
- lykich correct pricesCorrect Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter6.1 Medium
- simonholliday anomify ai – anomaly detection and alertingAnomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter4.4 Medium
- themewant easy elements for elementor – addons & website templatesEasy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register9.8 Critical
- constantcontact creative mail – easier wordpress & woocommerce email marketingCreative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter7.5 High
- infility globalInfility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter6.5 Medium
- cvmh stickySticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute6.4 Medium
- Show moreLoading…