CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
libdwarfOSS-FuzzHeap-double-free in _dwarf_load_elf_symtab_symbolsNo score- hackerone rubyAn issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in...8.1 High
symfonyDebian[Unknown description]No score- openbaoOpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens5.3 Medium
- openbaoOpenBao's Inline Auth Incorrectly Redacted Headers5.4 Medium
- openbaoOpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL7.1 High
- bestpractical rt, request tracker +1 moreRT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint9.1 Critical
- bestpractical rt, request tracker +1 moreRT: Reflected Cross-Site Scripting in search results chart6.1 Medium
- bestpractical rt, request tracker +1 moreRT: Cross-Site Scripting via inline-served uploaded content5.4 Medium
rust-sequoia-openpgpDebian[openpgp: Don't imply missing key flags from key type]No scoreuncrustifyDebianBuffer Overflow vulnerability in Uncrustify Project Affected v.Uncrustify_d-0.82.0-132-bcc41cbdc...6.2 Medium- goauthentik authentikauthentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation8.7 High
- opensuse libsolv, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreLibsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file6.5 Medium
- opensuse libsolv, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreLibsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums6.5 Medium
- siber systems, inc. android app "roboform password manager"Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents...4.6 Medium
- rrwo crypt::saltedhashCrypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts9.1 Critical
- makeplane planePlane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics6.5 Medium
- nimiq core-rs-albatrossnimiq-blockchain: network-libp2p untrusted peer can crash address book via empty peer contact addresses4.3 Medium
- rrwo crypt::saltedhashCrypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks7.5 High
- hp linux imaging and printing, hp inc linux imaging and printing software, hp, inc. hp linux imaging and printing software +15 more +17 moreHP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution8.5 High
- hp linux imaging and printing, hp inc linux imaging and printing software, hp, inc. hp linux imaging and printing software +15 more +17 moreHP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution9.3 Critical
- taiko network communications pte ltd. ag1000-01a sms alert gatewayTaiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration Interface8.4 High
- taiko network communications pte ltd. ag1000-01a sms alert gatewayTaiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web Interface9.3 Critical
- bestpractical rt, request tracker +1 moreRT: Reflected Cross-Site Scripting via URL parameters6.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter5.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter5.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter5.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng Parameters5.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter5.1 Medium
- aws rabbitmq awsArbitrary file read in rabbitmq-aws plugin8.3 High
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter5.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter5.1 Medium
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter5.1 Medium
- taiko network communications pte ltd. ag1000-01a sms alert gatewayTaiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml9.3 Critical
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter5.1 Medium
- frappe lmsFrappe has Path Transversal via SCORM9.4 Critical
- openises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter5.1 Medium
- elated-themes frappeFrappe has an Arbitrary File Read via Path Traversal in render_include8.7 High
- triliumnext triliumTrilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments6.8 Medium
- google chromeInsufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179...5.3 Medium
- google chromeHeap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0...7.5 High
- google chromeOut of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote...6.5 Medium
- google chromeUse after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to...8.8 High
- google chromeOut of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker...8.8 High
- google chromeUse after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to...8.8 High
- google chromeHeap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote...8.8 High
- google chromeUse after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote...8.8 High
- google chromeType Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a...7.5 High
- google chromeInsufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179...4.3 Medium
- google chromeInsufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179...4.3 Medium
- Show moreLoading…