CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection9.3 Critical
- kenik kg-5260xxxx-il-(g)2, kg-5230das-il-g3, kg-5230tas-il-3 +5 more +7 morePath Traversal in Kenik cameras8.3 High
- founddream miniclawdFoundDream miniclawd SkillsLoader skills-loader.ts which command injection6.9 Medium
- founddream miniclawdFoundDream miniclawd exec.ts ExecTool.execute os command injection6.9 Medium
- code-projects employee management systemcode-projects Employee Management System applyleaveprocess.php sql injection5.3 Medium
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token5.3 Medium
- code-projects employee management systemcode-projects Employee Management System psubmit.php sql injection5.3 Medium
- outsystems lifetimeAuthorization Bypass Through User-Controlled Key in OutSystems Lifetime5.3 Medium
- code-projects employee management systemcode-projects Employee Management System changepassemp.php sql injection5.3 Medium
- code-projects employee management systemcode-projects Employee Management System applyleave.php cross site scripting5.3 Medium
- sourcecodester simple pos and inventory systemSourceCodester Simple POS and Inventory System search.php sql injection6.9 Medium
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)8.1 High
- sourcecodester simple pos and inventory systemSourceCodester Simple POS and Inventory System edit_customer.php sql injection5.1 Medium
- cp plus wi-fi camera cp-e38q, cp-e48q, cp-e25q, cp-e35q, cp-e45q, cp-e28q, cp-e21q, cp-e31q, cp-e41q, cp-e24q, cp-z43q, cp-e34q, cp-e44q, cp-t31q, cp-v48q, cp-v41q, cp-z45qInformation Exposure Vulnerability in CP-Plus Wi-Fi Camera5.2 Medium
- sourcecodester simple pos and inventory systemSourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted upload5.3 Medium
- sourcecodester simple pos and inventory systemSourceCodester Simple POS and Inventory System GET Parameter deleteproduct.php delete sql injection5.1 Medium
- rust project cargoCrates in third party registries can override the cached source of other crates6.5 Medium
- rust cargoCargo can be coerced to share credentials between registries2.3 Low
- edimax br-6478acEdimax BR-6478AC POST Request formL2TPSetup buffer overflow8.7 High
- edimax br-6478acEdimax BR-6478AC POST Request formiNICSiteSurvey buffer overflow8.7 High
- edimax br-6478acEdimax BR-6478AC POST Request formiNICbasic command injection5.3 Medium
- edimax br-6478acEdimax BR-6478AC POST Request formAccept command injection5.3 Medium
- edimax br-6675ndEdimax BR-6675nD stainfo command injection5.3 Medium
- apache echartsApache ECharts: XSS in Lines series tooltip rendering6.1 Medium
- yashpokharna2555 studentmanagementsystemyashpokharna2555 StudentManagementSystem courseDel.php resource injection5.3 Medium
- acer care centerAcer Care Center creates a Named Pipe with a weak Security Descriptor6.8 Medium
- dtstack taierDTStack Taier REST API Runtime.exec os command injection5.3 Medium
- mattermost, mattermost server +1 moreServer panic via outgoing webhook responses6.5 Medium
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection9.3 Critical
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreMissing Authorization Validation in mlflow/mlflow9.0 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection9.3 Critical
- spring ai, vmware spring ai +1 moreLLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API6.5 Medium
- tenda f1202Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow8.7 High
- tenda f1202Tenda F1202 GstDhcpSetSerof formGstDhcpSetSer stack-based overflow8.7 High
- gallagher command centre, active directory sync, cardholder sync utility +14 more +16 moreInsertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service...8.1 High
- tenda f1202Tenda F1202 WrlExtraSet formWrlExtraSet stack-based overflow8.7 High
- tenda f1202Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflow8.7 High
- edimax ew-7438rpnEdimax EW-7438RPn webs formWlSiteSurvey stack-based overflow8.7 High
- edimax ew-7438rpnEdimax EW-7438RPn formHwSet stack-based overflow8.7 High
- edimax ew-7438rpnEdimax EW-7438RPn formWlanMP stack-based overflow8.7 High
- edimax ew-7438rpnEdimax EW-7438RPn Content-Type formWlanMP os command injection5.3 Medium
- edimax br-6675ndEdimax BR-6675nD POST Request mp command injection5.1 Medium
- No product listedKLiK SocialMediaWebsite HTTP POST Request Parameter injection6.9 Medium
- Show moreLoading…