CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- f5 nginx open source, nginx plus, debian linux +15 more +17 moreNGINX ngx_http_rewrite_module vulnerability9.2 Critical
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog2.3 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion2.3 Low
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive...5.5 Medium
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic...3.6 Low
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An...6.1 Medium
- vifmHeap Buffer Overflow in vifm4.8 Medium
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation...4.2 Medium
- shell-quote, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 moreshell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`9.2 Critical
- avantraPassword re-initialization mechanism sends passwords in plain text5.9 Medium
- avantraDefault credentials for internal DB5.1 Medium
cpioTuxCareUpdate of cpioNo score- avantraLog Files contain encrypted secrets7.5 High
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive...4.0 Medium
- avantraInsecure session handling on metrics web server9.6 Critical
- encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 moreStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks6.5 Medium
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment...5.3 Medium
- dell powerflex manager, powerflex manager (appliance), powerflex manager (rack) +2 more +4 moreDell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through...5.3 Medium
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +4 more +6 moreApache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)7.5 High
- apache cxfApache CXF: XXE vulnerability in WS-Transfer functionality5.3 Medium
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +1 more +3 moreApache CXF: LDAP Injection vulnerability in XKMS LDAP Repository9.8 Critical
- imagemagickImageMagick: Heap Buffer Over-Read in distributed pixel cache server5.7 Medium
- imagemagickImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model4.1 Medium
- imagemagickImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking4.1 Medium
- imagemagickImageMagick: Heap Buffer Over-Write in distributed pixel cache server4.1 Medium
- mattermost, mattermost server +1 morePersistent notification timing attack causing server denial of service6.5 Medium
- mattermost, mattermost server +1 moreImproper file ownership validation in the Boards API allows unauthorised file access5.9 Medium
- mattermost, mattermost server +1 moreInsufficient input validation in GitHub plugin API causes denial of service4.3 Medium
- mattermost, mattermost server +1 moreSanitize team member data returned by API4.3 Medium
- mattermost, mattermost server +1 moreUnauthenticated WebSocket binary frame causes denial of service in Mattermost Server7.5 High
- mattermost, mattermost server +1 moreMissing request body size limits on Zoom plugin HTTP endpoints4.9 Medium
- mattermost, mattermost server +1 moreDenial of service via crafted TIFF file upload6.5 Medium
- centralny instytut ochrony pracy - państwowy instytut badawczy sterLack of traffic encryption in STER2.3 Low
- centralny instytut ochrony pracy - państwowy instytut badawczy sterWeak password encoding in STER5.7 Medium
- centralny instytut ochrony pracy - państwowy instytut badawczy sterSQL Injection in STER8.7 High
- teamviewer dex (on-premises)Broken Access Control in TeamViewer DEX Platform (On Premises)5.4 Medium
- cssigniterteam audioigniter music playerAudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter7.5 High
- jetmonsters motopress hotel bookingMotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action5.3 Medium
- techjewel fluentcrm – email newsletter, automation, email marketing, email campaigns, optins, leads, and crm solutionFluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter5.4 Medium
- metaphorcreations ditty – responsive news tickers, sliders, and listsDitty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action7.5 High
- smub slider by soliloquy – responsive image slider for wordpressSlider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint4.3 Medium
- kasparsd widget contextWidget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter4.3 Medium
- registrationformbuilder vedrixa forms – user registration form, signup form & drag & drop form builderVedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action4.3 Medium
aesonHackage,text-iso8601Hackage +1 moreDenial of Service and Memory Exhaustion in aesonNo score- zephyrproject zephyrptp: Potential Denial of Service via PTP Interval Shift6.5 Medium
- No product listedSecurity update for rootlesskitNo score
- No product listedSecurity update for rootlesskitNo score
- No product listedSecurity update for rekorNo score
- No product listedSecurity update for container-suseconnectNo score
- themewant easy elements for elementor – addons & website templatesEasy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter8.8 High
- Show moreLoading…