CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- web-dorado contact form makerWordPress Contact Form Maker Plugin 1.12.20 SQL Injection7.1 High
- 10web form makerWordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php7.1 High
- 10-strike network scanner10-Strike Network Scanner 3.0 Local Buffer Overflow SEH8.6 High
- 10-strike network inventory explorer10-Strike Network Inventory Explorer 8.54 Buffer Overflow SEH8.6 High
- behance smartshopSmartshop 1 Cross-Site Request Forgery via editprofile.php5.3 Medium
- behance smartshopSmartshop 1 SQL Injection via search.php8.8 High
- behance smartshopSmartshop 1 SQL Injection via product.php id Parameter8.8 High
- behance smartshopSmartshop 1 SQL Injection via category.php8.8 High
- quantumnous new-apiQuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization6.3 Medium
- quantumnous new-apiQuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection5.3 Medium
- calcom cal.diycalcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery2.3 Low
- calcom cal.diycalcom cal.diy cross-site request forgery5.3 Medium
- 546669204 vps-inventory-monitoring546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection5.3 Medium
- omec-project amfomec-project amf NGReset Message memory corruption5.3 Medium
- omec-project amfomec-project amf NGSetupRequest memory corruption5.3 Medium
- omec-project amfomec-project amf handler.go PDUSessionResourceModifyIndication memory corruption5.3 Medium
- omec-project amfomec-project amf PathSwitchRequest memory corruption5.3 Medium
eximTuxCare,exim-greylistTuxCare,exim-monTuxCare +2 more +4 moreUpdate of eximNo scoreeximTuxCare,exim-greylistTuxCare,exim-monTuxCare +2 more +4 moreUpdate of eximNo score- edimax br-6428nsEdimax BR-6428NS POST Request formWlbasic command injection5.3 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formWlanM system command injection5.3 Medium
- edimax br-6428nsEdimax BR-6428NS POST Request formWirelessTbl buffer overflow8.7 High
- edimax br-6428nsEdimax BR-6428NS POST Request formWanTcpipSetup buffer overflow8.7 High
- wishlist member memberWishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action8.8 High
- woocommerce paypal paymentsWooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure8.2 High
- wishlist member memberWishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action8.8 High
- wishlist member memberWishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action8.8 High
- wishlist member memberWishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action8.8 High
- nezhahq nezhaNezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members6.5 Medium
- nezhahq nezhaNezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron9.9 Critical
- getarcaneapp arcaneArcane: Missing admin authorization on global variables endpoint8.8 High
instagrapiPyPIinstagrapi: Unsafe signup challenge path handling in instagrapi6.5 Medium- subzeroid aiograpiaiograpi: Unsafe signup challenge path handling6.5 Medium
- parse-community parse-serverParse Server: Pre-authentication denial of service via client version header regex backtracking8.7 High
- nezhahq nezhaNezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)7.1 High
- nezhahq nezhaNezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification7.7 High
- microsoft global secure access, global secure access (gsa) +1 moreMicrosoft Global Secure Access (GSA) Information Disclosure Vulnerability7.5 High
- microsoft entra id, entra +1 moreMicrosoft Entra ID Elevation of Privilege Vulnerability10.0 Critical
- microsoft planetary computer, planetary computer pro (geocatalog) +1 moreMicrosoft Planetary Computer Pro Information Disclosure Vulnerability10.0 Critical
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft entra id, entra +1 moreMicrosoft Azure Active Directory B2C Elevation of Privilege Vulnerability9.1 Critical
- microsoft 365 copilot, 365 copilot for ios +1 moreMicrosoft Copilot Tampering Vulnerability9.3 Critical
- microsoft azure stack hciAzure Stack HCI Information Disclosure Vulnerability7.7 High
- microsoft 365 copilotM365 Copilot Information Disclosure Vulnerability6.5 Medium
- microsoft azure resource managerAzure Resource Manager Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure virtual network gatewayAzure Virtual Network Gateway Remote Code Execution Vulnerability9.9 Critical
- microsoft azure privileged identity management (pim), azure privileged identity management +1 moreAzure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability8.8 High
- microsoft power pagesMicrosoft Power Pages Remote Code Execution Vulnerability10.0 Critical
- microsoft azure orbital spatioAzure Orbital Spatio Remote Code Execution Vulnerability10.0 Critical
- bestpractical rtRT: LDAP authentication bypass via empty password8.1 High
- Show moreLoading…