CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- mcdope pam usbpam_usb: Command injection via $TMUX environment variable leads to RCE as root8.8 High
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification2.3 Low
- mcdope pam usbpam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local7.4 High
- mcdope pam usbpam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote result6.3 Medium
- mcdope pam usbpam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash5.1 Medium
- mcdope pam usbpam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer7.1 High
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing2.3 Low
- mcdope pam usbpam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries6.5 Medium
- mcdope pam usbpam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulation6.3 Medium
- mcdope pam usbpam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass8.1 High
- mcdope pam usbpam_usb: Unchecked integer multiplication before xmalloc() in conf.c allows heap-based buffer overflow on 32-bit targets6.7 Medium
- crowdsecurity crowdsecCrowdSec AppSec silently drops request body for chunked / HTTP-2 requests7.2 High
- mcdope pam usbpam_usb: Thread-unsafe static pointer in log.c causes data race under concurrent PAM authentication5.7 Medium
- crowdsecurity crowdsecCrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression8.2 High
- mcdope pam usbpam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution4.4 Medium
- denoDeno: TLS retry copies stale upgrade hook, risking plaintext traffic7.4 High
- gladinet triofoxGladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoS7.5 High
- gladinet triofoxGladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS7.5 High
- gladinet triofoxGladinet Triofox Path Traversal in WOSDefaultHttpModule.dll7.5 High
- gladinet triofoxGladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dll9.8 Critical
- gladinet triofoxGladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dll9.8 Critical
- langroidLangroid has Prompt to SQL Injection, Leading to RCE9.8 Critical
- gladinet triofoxGladinet Triofox Missing Authentication for Critical Functions9.8 Critical
- sherlock-project sherlockSherlock: Command Injection via pull_request_target in validate_modified_targets.yml9.3 Critical
- leiweibau pi.alertPi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection8.7 High
- leiweibau pi.alertUnauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)9.8 Critical
- leiweibau pi.alertUnauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)9.8 Critical
- himmelblau-idm himmelblauHimmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow8.4 High
- oneuptimeOneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion9.9 Critical
- mapserverMapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`7.5 High
- wiresharkNULL Pointer Dereference in Wireshark5.5 Medium
- alternativecommerce, drupal alternativecommerce (basket) +1 moreDrupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-0389.8 Critical
- inducer relateRELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization8.7 High
- inducer relateRELATE Vulnerable to Stored XSS via Unprivileged User Profile8.7 High
- harttle liquidjsLiquidJS is Vulnerable to Remote Code Execution10.0 Critical
- harttle liquidjsLiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLab6.5 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab8.2 High
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab5.3 Medium
- gitlabUse of Incorrectly-Resolved Name or Reference in GitLab4.3 Medium
- getkirby kirbyKirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend8.4 High
- harttle liquidjsLiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)7.5 High
- tp-link systems inc. archer be450 v1, tp-link archer be450 firmware, archer be7200 firmware +1 more +3 moreArbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE72008.5 High
- getkirby kirbyKirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions5.3 Medium
- frappe hrmsFrappe HR: Permission Bypass in HRMS Leave Details API6.5 Medium
- pimcorePimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling8.1 High
- budibaseBudibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker6.5 Medium
- budibaseBudibase: Unvalidated VectorDB Host Parameter Enables SSRF5.3 Medium
- Show moreLoading…