CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- squirrel-lang squirrelSquirrel Cnut File sqobject.cpp ReadObject heap-based overflow4.8 Medium
- hitachi energy mach hidrawA heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An...4.4 Medium
- b&r industrial automation gmbh ppt30 operating systemAllocation of Resources Without Limits or Throttling in the OPC-UA Server8.7 High
- devolutions server, mariadb, red hat enterprise linux 10 +4 more +6 moreMariaDB: FILE privilege was not checked for subqueries in the FROM clause5.0 Medium
- devolutions server, mariadb, red hat enterprise linux 10 +6 more +8 moreMariaDB: mysql_real_escape_string() incorrectly handled big56.9 Medium
- devolutions server, mariadb +1 moreMariaDB: path traversal in mbstream6.3 Medium
- devolutions server, mariadb, red hat enterprise linux 10 +5 more +7 moreMariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL6.3 Medium
- capstone-engine capstoneCapstone has a NULL Pointer Dereference with 3DNow! opcodes5.1 Medium
- devolutions server, mariadb +1 moreMariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions4.3 Medium
- devolutions server, mariadb, red hat enterprise linux 10 +4 more +6 moreMariaDB: wsrep SST unsafe parameter handling on the donor side8.0 High
- zohocorp zoho mail wordpress pluginCross-site Request Forgery5.7 Medium
- vllm-project vllmvllm-project vllm OpenAI-compatible Serving Path denial of service6.9 Medium
- f5 nginx open source, nginx gateway fabric, nginx ingress controller +6 more +8 moreNGINX Open-Source ngx_http_v3_module vulnerability9.2 Critical
- zte zxunipos nds-lteFunction Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE3.8 Low
- mediaarea mediainfolibMediaArea MediaInfoLib LXF parsing heap-based buffer overflow vulnerability7.8 High
- mediaarea mediainfolibMediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vulnerability7.8 High
shim-x64TuxCareUpdate of shimNo score- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability5.3 Medium
- ateeq rafeeq repairbuddyWordPress RepairBuddy plugin <= 4.1121 - Broken Access Control vulnerability4.3 Medium
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- spabrice nylaWordPress Nyla theme <= 1.7 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- magentech sw coreWordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability7.5 High
- teconcetheme mayosis coreWordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability5.3 Medium
- codesys control for beaglebone sl, control for empc-a/imx6 sl, control for iot2000 sl +13 more +15 moreOut-of-bounds Write in CODESYS Control8.7 High
- codesys control for beaglebone sl, control for empc-a/imx6 sl, control for iot2000 sl +13 more +15 moreIncorrect Authorization in CODESYS Control7.2 High
- codesys development systemIncorrect Default Permissions in CODESYS Development System8.5 High
- codesys development systemIncorrect Default Permissions in CODESYS Development System8.5 High
- hitachi infrastructure analytics advisor, ops center analyzer, ops center analyzer viewpoint +2 moreMissing Password Masking in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer and Hitachi Ops Center Analyzer viewpoint4.6 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection5.3 Medium
- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection5.3 Medium
pacotenpm,grafana12.4Red Hat,nodejsAlmaLinux +20 more +22 morepacote is vulnerable to Denial of Service (DoS) via the addGitSha function8.7 High@koa/routernpm@koa/router has an Access Control Bypass6.9 Medium- totolink ca750-poeTotolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection5.3 Medium
- gnu libredwgGNU LibreDWG Dwgbmp Utility decode.c read_2004_compressed_section out-of-bounds4.8 Medium
- gnu libredwgGNU LibreDWG Dwggrep Utility dwggrep.c match_BLOCK_HEADER null pointer dereference4.8 Medium
- itsourcecode electronic judging systemitsourcecode Electronic Judging System delete_judge.php sql injection6.9 Medium
- itsourcecode electronic judging systemitsourcecode Electronic Judging System judges.php cross site scripting5.3 Medium
- itsourcecode electronic judging systemitsourcecode Electronic Judging System edit_team.php sql injection6.9 Medium
- itsourcecode electronic judging systemitsourcecode Electronic Judging System edit_judge.php sql injection6.9 Medium
- xianrendzw easyreportxianrendzw EasyReport REST Endpoint execute sql injection5.3 Medium
- acrel electrical eems enterprise power operation and maintenance cloud platformAcrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform getCalcmeterDetailDayListTree sql injection6.9 Medium
- fraillt bitseryfraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of input6.3 Medium
- zyxel gs1200-10v3 firmware, gs1200-5hpv3 firmware, gs1200-5v3 firmware +2 more +4 moreA missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2...6.5 Medium
- blitz-js blitzblitz-js blitz Sign-in LoginForm.tsx cross site scripting5.3 Medium
- backdropcms gdpr cookies module for backdrop cmsThe GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect...1.8 Low
- stonith404 pingvin-sharestonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting5.3 Medium
- hemant6488 codeigniter-studentmanagementsystemhemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting5.3 Medium
- bingos archive::tar, archive\ \ +1 moreArchive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header7.5 High
- bingos archive::tar, archive\ \, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory7.5 High
- Show moreLoading…