CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- xyproto algernonAlgernon: Path traversal file write via savein()8.7 High
- bugsinkBugsink: Issue bulk actions can affect another project’s issue if its UUID is known3.1 Low
- bugsinkBugsink: Issue event views can show an event from another project if its UUID is known3.1 Low
- bugsinkBugsink: Project scoping missing in sourcemap and debug-file lookup4.3 Medium
- opensuse libsolv, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +37 more +39 moreLibsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreBluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreBluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreBluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()5.5 Medium
- nvidia transformers4rec, merlin transformers4rec +1 moreNVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper...7.8 High
- nvidia isaac launchableNVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is...7.5 High
- traccarTraccar: Missing edit authorization on device image upload allows read-only users to write files5.3 Medium
- ibm cloud pak for data system - cyclopsVulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.5.3 Medium
- ibm cloud pak for data system - cyclopsVulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.4.3 Medium
- ibm cognos analytics, cognos transformer +1 moreIBM Cognos Analytics is affected by Cross-site scripting.6.4 Medium
- ibm financial transaction manager for swift services for multiplatforms, financial transaction manager for multiplatform +1 moreIBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.5.4 Medium
- ibm watsonx.dataMultiple Vulnerabilities in watsonx.data5.4 Medium
- ibm webmethods integration (on prem) -integration server, webmethods integration server +1 moreIBM webMethods Integration Sever is vulnerable to server-side request forgery5.4 Medium
- vowpalwabbit vowpal wabbitVowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner5.0 Medium
- ibm db2IBM® Db2® is vulnerable to credential exposure in db2diag when executing specific testcase buckets5.5 Medium
- cyber-iii student-management-systemsambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard access control6.9 Medium
- e107inc e107e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()6.5 Medium
- e107inc e107e107: Host Header Injection in e107 password reset enables phishing8.1 High
- e107inc e107e107: Broken Access Control in e107 comment edit allows cross-user comment modification6.5 Medium
- genetec inc. rabbitmq, airport operational manager, industrial iot +4 more +6 moreA high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege...7.8 High
- e107inc e107e107: Server-Side Request Forgery (SSRF) in the remote file fetcher4.3 Medium
- apache flink kubernetes operatorApache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator6.5 Medium
- mirasvit full page cache warmer for magento 2, full page cache warmer +1 moreMirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection9.3 Critical
- mossdef-org luci-app-https-dns-proxyluci-app-https-dns-proxy Authenticated Command Injection via setInitAction8.7 High
- openkm community edition, professional edition +1 moreOpenKM 6.3.12 Remote Code Execution via Administrative Scripting8.6 High
- openkm community edition, professional edition +1 moreOpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery8.6 High
- openkm community edition, professional edition +1 moreOpenKM 6.3.12 Local File Inclusion via Admin Scripting6.9 Medium
- cesnet libyanglibyang - Heap Use-After-Free Write in XML Metadata Parsing6.9 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreFreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass8.8 High
- freerdp, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreFreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass8.6 High
- das parking management system 停车场管理系统Das Parking Management System 停车场管理系统 Search API Endpoint sql injection6.9 Medium
- das parking management system 停车场管理系统Das Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell sql injection6.9 Medium
- karakeep-app karakeepKarakeep has a SSRF Protection Bypass via Redirect Handling7.6 High
- acrel electrical eems enterprise power operation and maintenance cloud platformAcrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform upfile path traversal6.9 Medium
- red hat container native virtualization 4.12, container native virtualization 4.13, container native virtualization 4.14 +7 more +9 moreKubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability9.9 Critical
- checkpoint quantum security managementAuthenticated Administrator Role-Based Access Control Bypass in Compliance4.1 Medium
- checkpoint quantum security gatewayHTTP service can incorrectly process malformed HTTP requests5.3 Medium
- checkpoint quantum security gatewaySQL injection issue in UserCheck Portal when DLP Software Blade is active5.6 Medium
- checkpoint quantum security gatewayIdentity Awareness Captive Portal - Unauthenticated Local File Inclusion7.5 High
- checkpoint quantum security gatewayVPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP8.1 High
- checkpoint quantum security gatewayVPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero8.1 High
- shenzhen sixun software sixun shanghui group business management systemShenzhen Sixun Software Sixun Shanghui Group Business Management System PayConfig sql injection6.9 Medium
- totolink n300rhTotolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection9.3 Critical
- codeastro leave management systemCodeAstro Leave Management System add_staff.php sql injection5.3 Medium
libcrux-secretscrates.ioPotentially Incorrect Output of Constant-Time Swap/Select on Aarch648.2 High- hitachi energy rtu500 series cmu firmwareIEC 60870-5-104 used in bidirectional mode is vulnerable for a NULL pointer dereferencing, if a...6.9 Medium
- Show moreLoading…