CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- linux, linux kernel +1 morenet: remove WARN_ON_ONCE when accessing forward path array5.5 Medium
- linux, linux kernel +1 morefs/ntfs3: fix deadlock in ni_read_folio_cmpr5.5 Medium
- linux, linux kernel +1 moreaccel/amdxdna: Fix potential NULL pointer dereference in context cleanup5.5 Medium
- linux, linux kernel +1 moredrm/panthor: Fix NULL pointer dereference on panthor_fw_unplug5.5 Medium
- linux, linux kernel +1 moreima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()7.1 High
- linux, linux kernel +1 moredrm/display/dp_mst: Add protection against 0 vcpi5.5 Medium
- linux, linux kernel +1 moresmack: /smack/doi: accept previously used values5.5 Medium
- linux, linux kernel +1 moreaccel/amdxdna: Fix race condition when checking rpm_on4.7 Medium
oneringbufcrates.ioOneRingBuf has a Use After Free Vulnerability6.3 Medium- webtoffee product import export for woocommerceWordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-6044.2 Medium
- e4jvikwp vikbooking hotel booking engine & pmsWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability7.1 High
- realmag777 active products tables for woocommerceWordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability9.3 Critical
- revmakx backup and staging by wp time capsuleWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerability7.5 High
- timo affiliate super assistentWordPress Affiliate Super Assistent plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- saleswonder llc webinarignitionWordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability9.8 Critical
- saleswonder llc webinarignitionWordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnerability9.9 Critical
- ludwig you quickwebp – compress / optimize images & convert webp | seo friendlyWordPress QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly plugin <= 3.2.7 - Arbitrary File Deletion vulnerability9.9 Critical
- realmag777 tableonWordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability9.3 Critical
- phbernard faviconWordPress Favicon plugin <= 1.3.46 - Cross Site Scripting (XSS) vulnerability7.1 High
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerability7.3 High
- wpdevelop booking managerWordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nexcess wpcompleteWordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themeisle disable comments for any post types (remove comments)WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability7.1 High
- wpify woo czechWordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability9.9 Critical
- hassantafreshi easy form builderWordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability9.3 Critical
- zaytech smart online order for cloverWordPress Smart Online Order for Clover plugin <= 1.6.0 - Sensitive Data Exposure vulnerability7.3 High
- zaytech smart online order for cloverWordPress Smart Online Order for Clover plugin <= 1.6.0 - Broken Authentication vulnerability7.3 High
- ads by wpquads by wpquadsWordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerability6.5 Medium
- tainacanWordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability9.3 Critical
- inilerm advanced ip blockerWordPress Advanced IP Blocker plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- zaytech smart online order for cloverWordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- e4jvikwp vikbooking hotel booking engine & pmsWordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary File Deletion vulnerability8.6 High
- wordplus bp better messagesWordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability7.5 High
- iqonic design kivicareWordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerability8.2 High
- realmag777 wpcsWordPress WPCS plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- ads by wpquads by wpquadsWordPress Ads by WPQuads plugin <= 3.0.2 - Broken Authentication vulnerability6.5 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability8.5 High
- ht plugins contact form 7WordPress HT Contact Form 7 plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp wham checkout files upload for woocommerceWordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.19 - Cross Site Scripting (XSS) vulnerability7.1 High
- miniorange otp verificationWordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability9.8 Critical
- property hive propertyhiveWordPress PropertyHive plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- realmag777 active products tables for woocommerceWordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerability9.3 Critical
- strategy11 team awp classifiedsWordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerability6.5 Medium
- minhnhut link gatewayMinhNhut Link Gateway <= 3.6.1 - Reflected Cross-Site Scripting via 'url' Parameter6.1 Medium
- minhnhut link gatewayMinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- silvercover mylinksdumpmyLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' Parameter4.8 Medium
- larsdrasmussen rexcrawlerrexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings4.8 Medium
- wpxpro xpro elementor addons - proXpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG6.5 Medium
- Show moreLoading…