CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- wp chill rsvp and event managementWordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerability5.3 Medium
- kings plugins b2bkingWordPress B2BKing plugin < 5.2.10 - Broken Access Control vulnerability4.9 Medium
- convers lab wpsubscriptionWordPress WPSubscription plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- patterns in the cloud autoship cloud for woocommerce subscription productsWordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.14.0 - Broken Access Control vulnerability4.3 Medium
- pickplugins team showcaseWordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeansar newsesWordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability5.4 Medium
- lucian apostol auto affiliate linksWordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerability5.3 Medium
- gnu libredwgGNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds4.8 Medium
- unknown flextableWordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerability4.3 Medium
- nikki blight qr redirectorWordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerability4.3 Medium
- recorp export wp page to static html/cssWordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- wpdevart organization chartWordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- gnu libredwgGNU LibreDWG DWG File decode.c dwg_next_entity null pointer dereference4.8 Medium
- gnu libredwgGNU LibreDWG Dwgread Utility decode.c decompress_R2004_section heap-based overflow4.8 Medium
- gnu libredwgGNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion4.8 Medium
- apache shiroApache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow0.0 None
- apache shiro, apache software foundation shiro jakarta ee module +1 moreApache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)5.1 Medium
- apache shiroApache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default5.9 Medium
- puttyPuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.3.7 Low
- apache shiroApache Shiro: Session fixation: new session is not created after login by default5.9 Medium
- puttyPuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but...3.1 Low
- gnu libredwgGNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow4.8 Medium
- puttyPuTTY 0.72 before 0.84 has a double free in RSA KEX.3.7 Low
- dromara lamp-cloudDromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine5.3 Medium
- changmingxie tcc-transactionchangmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization5.3 Medium
- bulwarkmail webmailIn Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in...4.4 Medium
- sourcecodester student grades management systemSourceCodester Student Grades Management System cross-site request forgery5.3 Medium
- bulwarkmail webmailRoundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization...7.2 High
- ruben garcia gamipressWordPress GamiPress plugin <= 7.6.3 - Broken Access Control vulnerability5.3 Medium
- bulwarkmail webmailRoundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary...3.7 Low
- bulwarkmail webmailIn Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking...6.5 Medium
- bulwarkmail webmailIn Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image...6.5 Medium
- sourcecodester student grades management systemSourceCodester Student Grades Management System students.php cross site scripting5.1 Medium
- bulwarkmail webmailRoundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic...7.5 High
- bulwarkmail webmailRoundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient...7.2 High
- bulwarkmail webmailRoundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection...8.1 High
- sourcecodester student grades management systemSourceCodester Student Grades Management System classroom.php removeStudentFromClassroom improper authorization5.3 Medium
- sourcecodester student grades management systemSourceCodester Student Grades Management System grades.php improper authorization5.3 Medium
- edimax ew-7438rpnEdimax EW-7438RPn formSDHCP stack-based overflow8.7 High
- edimax ew-7438rpnEdimax EW-7438RPn formStats stack-based overflow8.7 High
- edimax ew-7438rpnEdimax EW-7438RPn formrefresh stack-based overflow8.7 High
- edimax ew-7438rpnEdimax EW-7438RPn formLogout stack-based overflow8.7 High
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection9.3 Critical
- totolink a8000ruTotolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection9.3 Critical
- yashpokharna2555 studentmanagementsystemyashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection6.9 Medium
- c-rick jimeng-mcpc-rick jimeng-mcp api.ts generateVideo path traversal5.3 Medium
- dazeb markdown-downloaderdazeb markdown-downloader index.ts create_subdirectory path traversal5.3 Medium
- yashpokharna2555 studentmanagementsystemyashpokharna2555 StudentManagementSystem student.php cross site scripting5.1 Medium
- Show moreLoading…