CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- mediaarea mediainfolibMediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability7.8 High
- honeywell international inc. control network module (cnm)Improper storage of sensitive information5.9 Medium
- freebsdStack buffer overflow via setcred(2)7.8 High
- honeywell international inc. control network module (cnm)Improper sanitization9.1 Critical
- saleswonder team tobias cf7 wow stylerWordPress CF7 WOW Styler plugin <= 1.7.6 - Broken Access Control vulnerability5.3 Medium
- mattermost, mattermost mobile +1 moreMobile SSO authentication flow allows credential theft via malicious server6.1 Medium
- unknown mail mintWordPress Mail Mint plugin <= 1.19.5 - Sensitive Data Exposure vulnerability4.3 Medium
- netatalkTOCTOU with root privilege in ad_flush3.7 Low
- netatalkMissing break in DSI OpenSession3.7 Low
- netatalkBitwise OR of errno values3.7 Low
- netatalkFORTIFY_SOURCE disabled3.7 Low
- netatalkDead bounds check in Spotlight RPC unmarshaller3.1 Low
- mattermost, mattermost server +1 morePath traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.8.0 High
- gmission web faxRemote Code Execution in Gmission Web FAX8.6 High
- netatalkhextoint macro uppercase bug3.1 Low
- netatalkFormat string argument mismatch3.1 Low
- netatalkShell injection via volume path6.7 Medium
- netatalkseteuid failure ignored in auth modules4.0 Medium
- netatalksystem() after failed chdir()2.5 Low
- netatalkUnbounded realloc in charset conversion3.1 Low
- netatalkInteger underflow in volxlate3.4 Low
- netatalkEA path traversal via incomplete sanitization7.6 High
- netatalkEA header parsing heap over-read3.7 Low
- netatalkHeap out-of-bounds reads in Spotlight RPC unmarshalling7.1 High
- netatalkOff-by-two in papd lp_write()3.7 Low
- netatalkASP session ID out-of-bounds access7.1 High
- netatalkLDAP filter injection4.2 Medium
- netatalkMissing o_len bounds check in pull_charset_flags()7.5 High
- netatalkDES-ECB auth with timing side channel5.9 Medium
- netatalkInteger underflow in dsi_writeinit() leads to denial of service7.5 High
- netatalkNon-reentrant privilege toggle3.9 Low
- netatalkAuthentication bypass via admin auth user6.4 Medium
- netatalkStack buffer overflow in desktop.c6.0 Medium
- netatalkBitwise OR logic bug enables shell injection7.5 High
- netatalkPredictable afpd session token6.5 Medium
- netatalkWeak cryptography in DHCAST128 UAM7.4 High
- netatalkLDAP simple-bind password exposure in log output7.5 High
- netatalkArbitrary file read via attacker-controlled symlink creation8.1 High
- netatalkHeap buffer overflow in CNID daemon comm_rcv()9.9 Critical
- netatalkOut-of-bounds write in convert_charset() null termination7.5 High
- netatalkStack buffer overflow via UCS-2 type confusion in convert_charset()8.8 High
- netatalkSQL injection in MySQL CNID backend8.8 High
- mattermost, mattermost server +1 moreInsufficient permission validation on cross-team playbook run creation4.3 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler9.8 Critical
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreAuthorization Bypass in SearchModelVersions in mlflow/mlflow6.5 Medium
- wpbean wpb floating menu or categories – sticky floating side menu & categories with iconsWPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category Field4.9 Medium
- broadstreetads broadstreetBroadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta4.3 Medium
- altium 365Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction10.0 Critical
- litespeed cpanel plugin, litespeed technologies whm plugin, litespeedtech litespeed cpanel plugin +1 more +3 moreLiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as...10.0 Critical
- Show moreLoading…