CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- tchatzi authen::totpAuthen::TOTP versions before 0.1.1 for Perl generate secrets using rand7.5 High
- svelte sveltekit, sveltejs kit +1 moreSvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch5.9 Medium
- commenthol md-fileservermd-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)7.2 High
- internlm lmdeployLMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization7.8 High
- samlify project samlifysamlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions8.7 High
github.com/mvt-project/androidqfGoandroidqf: APK download Path Traversal in device APK paths1.1 Low- open ises ticketsOpen ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in rm/incs/mobile_login.inc.php8.2 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/login.inc.php8.2 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/functions.inc.php8.2 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in ajax/reports.php8.2 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in tables.php6.9 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.php6.9 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.php6.9 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.php9.2 Critical
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php9.2 Critical
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/reports.php tick_id Parameter7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/mobile_main.php id Parameter7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via message.php frm_ticket_id and frm_resp_id Parameters7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via db_loader.php Multiple Parameters7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker Data8.8 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via portal/ajax/list_requests.php sort and dir Parameters7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/sit_incidents.php offset Parameter7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/fullsit_incidents.php offset Parameter7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via tables.php Multiple Parameters7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via ticketsmdb_import.php Multiple POST Parameters5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via delete_module.php Multiple POST Parameters5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via db_loader.php Multiple POST Parameters5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter5.1 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter5.1 Medium
github.com/mvt-project/androidqfGoandroidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers)1.1 Low- mvt-project mvtMobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing5.3 Medium
- villatheme happyWordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability6.5 Medium
- klever-io klever-goKlever-Go KVM read-only execution can commit contract delete and upgrade side effects6.3 Medium
- cursortouch windows-mcpWindows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS8.9 High
- open-metadata openmetadataOpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users8.3 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Reflected XSS via add.php ticket_id Parameter5.1 Medium
- apache foryApache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement9.8 Critical
- Show moreLoading…