CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- hitachi vantara pentaho data integration and analytics, hitachi vantara pentaho data integration and analytics +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource6.3 Medium
- pmqs io::compressIO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID7.3 High
- pmqs io::uncompress::unzip, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreIO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward7.5 High
- dkjensen splide carousel blockSplide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute6.4 Medium
- pmqs io::uncompress::unzip, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreIO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date5.5 Medium
- zte zxunipos nds-lteStored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE product5.7 Medium
- openstack swiftOpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body7.1 High
- gdalGDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow7.4 High
- utt hiper 1250gwUTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow8.7 High
- analogwp style kits for elementorStyle Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title6.4 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service5.3 Medium
- tanium connectTanium addressed an unauthorized code execution vulnerability in Connect.8.8 High
- tanium serverTanium addressed a denial of service vulnerability in Tanium Server.6.5 Medium
- utt hiper 1250gwUTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based overflow8.7 High
- utt hiper 1200gwUTT HiPER 1200GW Web Management formPptpClientConfig stack-based overflow8.7 High
- utt hiper 1200gwUTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflow8.7 High
- hapijs wreck@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects6.3 Medium
- hapijs contentParameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters7.7 High
- pimcorePimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter8.8 High
- pimcorePimcore: SQL Injection in Custom Reports Column Configuration8.7 High
- raszi tmp, node-tmp +1 moretmp: Path Traversal via unsanitized prefix/postfix enables directory escape7.7 High
- qianfox foxcmsQianFox FoxCMS Admin.php edit password recovery5.1 Medium
- harttle liquidjsLiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`5.3 Medium
- qianfox foxcmsQianFox FoxCMS Administrator Backend edit cross site scripting4.8 Medium
- harttle liquidjsLiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body6.5 Medium
- harttle liquidjsLiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS6.1 Medium
- spaceapplications yamcsYamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`9.1 Critical
md4cOSS-FuzzHeap-buffer-overflow in md_process_all_blocksNo scorelibhevcOSS-FuzzHeap-buffer-overflow in ihevcd_sao_shift_ctbNo score- spaceapplications yamcsYamcs: No Rate Limiting on Authentication Endpoint6.5 Medium
- spaceapplications yamcsYamcs: Unauthorized user enumeration via IAM API endpoints4.3 Medium
- carrierwave project carrierwaveCarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters4.7 Medium
- github enterprise serverServer-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint9.2 Critical
- itsourcecode courier management systemitsourcecode Courier Management System parcel_list.php sql injection5.3 Medium
- No product listedNorthern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows...3.1 Low
- linux, linux kernel +1 morecrypto: algif_aead - snapshot IV for async AEAD requests5.5 Medium
- linux, linux kernel +1 morerxrpc: Fix conn-level packet handling to unshare RESPONSE packets5.5 Medium
- linux, linux kernel, red hat enterprise linux 10 +8 more +10 morerxrpc: Fix potential UAF after skb_unshare() failure7.8 High
- linux, linux kernel +1 moreapparmor: fix NULL pointer dereference in __unix_needs_revalidation5.5 Medium
- No product listedCommand injection in Raynet rvia version 12.6.4392.49-amd64.deb allows adversaries to execute...7.8 High
- No product listedA stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of...5.4 Medium
- No product listedOpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template...6.5 Medium
- No product listedSQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive...5.3 Medium
- No product listedInsecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate...8.8 High
- No product listedAn issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote...7.3 High
- No product listedBuffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker...7.3 High
- No product listedBuffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker...7.3 High
dolibarrUbuntuAn issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote...7.3 HighdolibarrUbuntuAn issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote...7.3 HighdolibarrUbuntuAn issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote...7.3 High- Show moreLoading…