CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- bingos archive::tar, archive\ \, red hat enterprise linux 10 +8 more +10 moreArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory9.1 Critical
libhevcOSS-FuzzHeap-buffer-overflow in ihevcd_fmt_conv_422sp_to_420pNo score- hemant6488 codeigniter-studentmanagementsystemhemant6488 CodeIgniter-StudentManagementSystem Student Management addStudentView access control6.9 Medium
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS...7.4 High
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than...6.2 Medium
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the...8.1 High
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in...8.1 High
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via...5.5 Medium
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no...8.1 High
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH...9.8 Critical
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the...7.1 High
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in...9.8 Critical
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds reads in the BGP...7.5 High
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the...9.8 Critical
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI...9.8 Critical
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly...6.5 Medium
- pavel-odintsov fastnetmonFastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9...6.5 Medium
fastnetmonDebianFastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the...6.5 Medium- samba, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreSamba: samba: remote code execution in printing subsystem via unescaped job description9.0 Critical
- samba, red hat enterprise linux 10, enterprise linux 10.0 extended update support +26 more +28 moreSamba: remote code execution in samr9.0 Critical
- No product listedAn Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace...4.3 Medium
- No product listedPbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality4.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSamba: denial of service against ad dc wins server7.5 High
- samba, red hat enterprise linux 10, enterprise linux 10.0 extended update support +22 more +24 moreSamba: group policy certificate enrollment uses http:// without validation8.0 High
- samba, red hat enterprise linux 10, enterprise linux 10.0 extended update support +21 more +23 moreSamba: vfs_worm does not block directory modification6.5 Medium
- samba, red hat enterprise linux 10, enterprise linux 10.0 extended update support +26 more +28 moreSamba: missing access check on reparse point operations7.1 High
- No product listedAppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android...2.4 Low
- No product listedEasyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android...2.4 Low
- No product listedSailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger...5.2 Medium
- No product listedSailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with...2.4 Low
- perl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morePerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds9.8 Critical
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection5.3 Medium
- linethemes nanocareWordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerability5.4 Medium
- sepay team gatewayWordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerability6.5 Medium
- emagicone store managerWordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability9.3 Critical
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability9.3 Critical
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability6.3 Medium
- edward plainview mycryptocheckoutWordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerability7.5 High
- storeapps smart managerWordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerability8.8 High
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection5.3 Medium
- themehigh stripe payment gateway for woocommerceWordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability6.5 Medium
- melapress wp activity logWordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- webtoffee smart coupons for woocommerceWordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability7.5 High
- bgermann cformsiiWordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection5.3 Medium
- videowhisper broadcast live videoWordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability7.2 High
- unitecms unlimited elements for elementor, unlimited elements for elementor +1 moreWordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability8.5 High
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection5.3 Medium
- cornel raiu wp search analyticsWordPress WP Search Analytics plugin < 1.5.0 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…