CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- google chromeUse after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to...8.8 High
- google chromeOut of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote...4.3 Medium
- google chromeUse after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote...8.8 High
- google chromeInappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a...4.2 Medium
- google chromeUse after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote...8.8 High
- triliumnext triliumTrilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds8.6 High
- xwiki xwiki-platformXWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}9.3 Critical
- cryptpadCryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS6.1 Medium
- mispCSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit5.1 Medium
- mispUnauthorized ShadowAttribute modification in MISP via client-supplied identifier8.3 High
- xwiki xwiki-commonsXWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash9.3 Critical
- altium enterprise serverPath Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read9.4 Critical
- wp swings gift cards for woocommerce proWordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability10.0 Critical
- esri arcgis serverUnvalidated Redirect in ArcGIS Server4.7 Medium
- altium enterprise serverPath Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File Write9.4 Critical
- esri arcgis serverImproper Authentication issue in ArcGIS Server5.3 Medium
- nvidia bionemo frameworkNVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal...8.8 High
- nvidia bionemo frameworkNVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of...7.8 High
- nvidia dgx os, dgx spark +1 moreNVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of...8.1 High
- nvidia tensorrtNVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A...8.2 High
mokutilTuxCare,shim-ia32TuxCare,shim-x64TuxCare +2 moreUpdate of shim-signedNo score- splunk ai toolkitImproper Access Control through Role Inheritance in Splunk AI Toolkit app6.5 Medium
- splunk, splunk cloud platform, enterprise +2 moreSensitive Information Disclosure through Log Files in Splunk Enterprise7.5 High
- splunk, splunk cloud platform, enterprise +2 moreDenial of Service through coldToFrozen.sh Script in Splunk Enterprise7.1 High
- pixelyoursite cost of goods by pixelyoursiteCost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import7.2 High
- hcl software compassPrototype pollution in csv parsing5.3 Medium
- cisco thousandeyes virtual appliance, thousandeyes enterprise agent +1 moreA vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could...4.7 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: cross-session email verification proof not bound to upstream identity in first-broker-login6.4 Medium
kernelTuxCare,bpftoolTuxCare,kernel-abi-stablelistsTuxCare +30 more +32 moreUpdate of kernelNo score- cisco nx-os softwareCisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vulnerability6.8 Medium
- cisco thousandeyes enterprise agentCisco ThousandEyes BrowserBot Command Injection Vulnerability6.3 Medium
- cisco secure workloadCisco Secure Workload Unauthorized API Access Vulnerability10.0 Critical
- mongodb c driverHeap memory out of bounds read and crash in C Driver legacy GridFS file reader6.0 Medium
- thorsten phpmyfaqphpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update8.8 High
- thorsten phpmyfaqphpMyFAQ - Authentication Bypass via Empty API Token8.7 High
- thorsten phpmyfaqphpMyFAQ - Insecure Direct Object Reference in User Password API8.7 High
- thorsten phpmyfaqphpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint8.8 High
- flowiseFlowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint5.3 Medium
- flowiseFlowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override6.0 Medium
- flowiseFlowise - Hardcoded CORS Wildcard in TTS Endpoint6.9 Medium
wgerPyPIwger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None8.5 Highgithub.com/opentofu/opentofuGoOpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server3.1 Low- xyproto algernonAlgernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *4.3 Medium
- xyproto algernonAlgernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS4.3 Medium
- @cap-js/db-service, cap-js @cap-js/postgres, @cap-js/sqlite +2 moreSupply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)9.3 Critical
shivammathur/setup-phpGitHub ActionsSetup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions5.9 Medium- shivammathur setup-php, setup php +1 moresetup-php: Command Injection in Repository-Derived PHP Version Resolution5.6 Medium
- huggingface diffusersDiffusers: TOCTOU Trust Remote Code Bypass7.5 High
- rtk-ai rtkRTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM6.9 Medium
kernelTuxCare,kernel-abi-stablelistsTuxCare,kernel-coreTuxCare +54 more +56 moreUpdate of kernelNo score- Show moreLoading…