CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- pftool alfie – feed pluginAlfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter4.3 Medium
- wpxpo fastxFastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation4.3 Medium
- burlingtonbytes wp blockade – visual page builderWP Blockade <= 0.9.14 - Reflected Cross-Site Scripting via 'shortcode' Parameter6.1 Medium
- zte mu5250, mu5250 firmware +1 moreInformation disclosure vulnerability in ZTE MU52505.7 Medium
- shapedplugin location weather – wordpress weather forecast, aqi, temperature and weather widgetLocation Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging4.3 Medium
- helgatheviking kia subtitleKIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]6.4 Medium
- manchumahara cbx 5 star rating & reviewCBX 5 Star Rating & Review <= 1.0.7 - Reflected Cross-Site Scripting via 'page' Parameter6.1 Medium
- dartiss draft listDraft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title6.4 Medium
- 9frontInvalid IP packets cause a kernel panic9.2 Critical
- 9frontMothra would respect a default value given by a website for HTML file upload forms. An attacker...6.9 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking duplicate attributes can cause XSS in golang.org/x/net/html6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html6.1 Medium
- golang net, golang.org/x/net golang.org/x/net/html +1 moreInvoking denial of service when parsing arbitrary HTML in golang.org/x/net/html6.5 Medium
- wedevs wp erp proWP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter7.5 High
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent +1 moreInvoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent5.3 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 moreInvoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh7.5 High
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +54 more +56 moreInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh10.0 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 moreInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +62 more +64 moreInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh5.3 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 moreInvoking infinite loop on large channel writes in golang.org/x/crypto/ssh9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent +1 moreInvoking key constraints not enforced in golang.org/x/crypto/ssh/agent9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent, red hat assisted installer for red hat openshift container platform 2 +46 more +48 moreInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 moreInvoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +68 more +70 moreInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +74 more +76 moreInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh7.5 High
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +64 more +66 moreInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh6.3 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 moreInvoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh6.5 Medium
- trimble sketchupCross-Site Scripting in SketchUp Dynamic Components9.3 Critical
- free5gc udm, udr, ubiquiti inc efg +58 more +60 moreA malicious actor with access to the network and low privileges could exploit a Path Traversal...7.7 High
- ubiquiti unifi os, free5gc udm, udr +59 more +61 moreA malicious actor with access to the network could exploit an Improper Input Validation...10.0 Critical
- ubiquiti unifi os, @clerk express, free5gc udm +61 more +63 moreA malicious actor with access to the network could exploit a Path Traversal vulnerability found...10.0 Critical
- ubiquiti unifi os, free5gc udm, udr +59 more +61 moreA malicious actor with access to the network could exploit an Improper Access Control...10.0 Critical
- ubiquiti inc unifi os serverA malicious actor with access to the network and high privileges could exploit an Improper Input...9.1 Critical
gpacOSS-FuzzHeap-use-after-free in ReplaceDEFNodeNo scoregpsdOSS-FuzzUNKNOWN READ in processXDRNo scoreutil-linuxOSS-FuzzStack-buffer-underflow in probe_dasd_ptNo scoregpsdOSS-FuzzSegv on unknown address in ___interceptor_strtolNo scorematioOSS-FuzzUNKNOWN READ in Mat_VarGetStructsLinearNo scorearmnnDebianIn Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn...6.2 Medium- No product listedHP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP...5.9 Medium
- No product listedAn issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the...7.3 High
- No product listedBuffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain...7.3 High
- No product listedDirectory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain...6.5 Medium
- No product listedCross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote...6.1 Medium
- No product listedDirectory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5...7.5 High
- jovancoding network-aiNetwork-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret7.6 High
- drupal term reference tree, taxonomy term reference tree widget project term reference tree widget +1 moreStored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)5.1 Medium
- imagemagickImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage6.3 Medium
- Show moreLoading…