CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in inmessage model7.1 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in saveObjectFromData function7.1 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in saveDashboardLayout function7.1 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in saveDashboardLayout function7.1 High
- dotcms coreUnauthenticated SQL Injection in dotCMS Publish Audit API10.0 Critical
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in getDevicegroups function7.1 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in Easy View7.1 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in UpdateParam function7.0 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in UpdateParam function7.0 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in DeleteSysLogEntry function7.0 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in _RemoveRequest function7.0 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in dsgvo_contracts view6.9 Medium
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in accountstatus view7.0 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in accountstatus view7.0 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in DevSerialReset function7.0 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in DevSerialReset function6.9 Medium
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreAuthenticated SQLi in getAccountByID function6.9 Medium
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in sync_data24 task8.7 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in _mb24confi_getDevice function function8.7 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in getAlarmProfiles function8.7 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in _mb24confi_getTagAlarm function8.7 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in _mb24api_getUserAccount function8.7 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in _mb24confi_getTagAlarm function8.7 High
- lhughes33472 metamagic seo pluginMetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page4.3 Medium
- octalmage github shortcodeGithub Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- rahulbhangale wp promoterWP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter6.1 Medium
- litespeedtech litespeed cacheLiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints7.2 High
- jegstudio gutenverse – wordpress blocks, page builder & site editorGutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter6.1 Medium
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in getLiveValues8.7 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in getLiveValues function8.7 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in ssoabstractservice8.7 High
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 moreUnauthenticated SQLi in userinfo Endpoint8.7 High
- zte zxunipos nds-lteCross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product5.3 Medium
- phoenix contact axc f 1152, axc f 1252, axc f 2000 ea +11 more +13 moreInsufficient Verification of Data Authenticity8.7 High
- phoenix contact axc f 1152, axc f 1252, axc f 2000 ea +11 more +13 moreUntrusted Search Path8.7 High
- cloud foundry foundation bosh director, cloud foundry bosh +1 moreCompromised VM can make arbitrary blobstore deletes6.8 Medium
- livemesh wpbakery page builder addons by livemeshWPBakery Page Builder Addons by Livemesh <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- omnivo booking calendar – event calendarBooking Calendar – Event Calendar <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters7.2 High
- cservit affiliate-toolkit – multi-network affiliate & amazon product displayaffiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution7.2 High
- dattateccom envíalosimple: email marketing y newslettersEnvíaloSimple: Email Marketing y Newsletters <= 2.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- livemesh siteorigin widgetsLivemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- livemesh wpbakery page builder addons by livemeshWPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- smub wpcode – insert headers and footers + custom code snippets – wordpress code managerWPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost8.8 High
- livemesh addons for beaver builderLivemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization6.4 Medium
- clorith enable jquery migrate helperEnable jQuery Migrate Helper <= 1.4.1 - Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade6.5 Medium
- cloud foundry foundation bosh director, cloud foundry bosh +1 moreLocal Blobstore may allow arbitrary reads/deletes4.3 Medium
- duogeek eventpressEventPress < 22.2 – Reflected Cross-Site Scripting7.1 High
- No product listedSecurity update for podmanNo score
- neilmccutcheon instant-quote.co quotation pageInstant-Quote.co Quotation Page <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- fides-it post categories galleryPost Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- Show moreLoading…