CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- No product listedNetis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the ...7.3 High
- No product listedNetis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the...7.3 High
- No product listedNetis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow...7.3 High
github.com/sipeed/picoclawGo,govulncheck-vulndbopenSUSE +1 morepicoclaw is vulnerable to OS command injection via the ExecTool component7.3 High- No product listed@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. The...8.8 High
- No product listedNorthern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.3.7 Low
- No product listedCraft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate...7.3 High
- No product listedA Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of...6.3 Medium
gpacDebianA NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown...4.3 MediumlibjxlMageia,jpeg-xlDebian,jpegxlopenEuler +4 more +6 moreHeap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras:...7.3 High- No product listedCommand injection in Raynet rvia 12.6.4392.49-amd64.deb allows adversaries to execute commands...7.8 High
- No product listedSpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical...5.5 Medium
- No product listedNorthern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.5.3 Medium
- github enterprise serverServer-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint7.0 High
- katacontainers kata containers, kata-containers +1 moreKata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations5.8 Medium
- getkirby kirbyKirby: Pre-authentication path traversal and PHP file inclusion during user lookup8.8 High
- getkirby kirbyKirby: `pages.access` permission is not checked during rendering of page drafts6.0 Medium
- getkirby kirbyKirby: Cross-site scripting (XSS) from list field content in the site frontend8.5 High
- getkirby kirbyKirby: Arbitrary Method Call via REST API search and collection query endpoints8.7 High
- frangoteam fuxaFUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass8.9 High
- frangoteam fuxaFUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue7.7 High
- frangoteam fuxaFUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection8.9 High
- yamcsYamcs Vulnerable to LDAP Injection in LdapAuthModule4.3 Medium
- @fedify fedifyFedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring7.0 High
- itsourcecode courier management systemitsourcecode Courier Management System manage_user.php sql injection6.9 Medium
- gnu libredwgGNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow6.9 Medium
- yeoman environmentyeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation8.6 High
- netty netty-incubator-codec-ohttpnetty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures6.9 Medium
- mik crypt::scryptkdfCrypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available4.8 Medium
- rrwo mojolicious::plugin::statsdMojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections5.3 Medium
- No product listedJeecgBoot AiragModelController access control5.3 Medium
- sourcecodester edoc doctor appointment systemSourceCodester eDoc Doctor Appointment System delete-session.php authorization6.9 Medium
- apple macosA permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS...5.5 Medium
- apple macosA logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26. An...5.5 Medium
- apple macosAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS...5.5 Medium
- apple macosA logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7,...5.5 Medium
- apple macosA permissions issue was addressed with additional restrictions. This issue is fixed in macOS...5.5 Medium
- apple macosA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia...7.0 High
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7,...7.8 High
- riebl vanetzaVanetza: Remote Denial of Service via Uncaught OER Encoding Exception in Cryptographic Verification7.5 High
- riebl vanetzaVanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER Parsing7.5 High
- code-projects project management systemcode-projects Project Management System Login chk.php sql injection6.9 Medium
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposure5.3 Medium
- oviva-ag epa4all-clientepa4all-client: Unauthenticated REST API for Patient Record Writes6.5 Medium
- aa-team woocommerce envato affiliatesWordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Settings Change vulnerability7.1 High
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery5.3 Medium
- No product listedJeecgBoot add access control5.3 Medium
- 1panel-dev maxkbMaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch5.1 Medium
- 1panel-dev maxkbMaxKB: Broken Access Control in MaxKB OSS URL Fetch API5.3 Medium
- xwiki xwiki-platformXWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests7.5 High
- Show moreLoading…