CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- webpros comet backupInsufficient character filtering in backup agent signing module on Comet Backup server allows...9.1 Critical
- veeam service provider consoleThis vulnerability in Veeam Service Provider Console allows for remote code execution.9.4 Critical
- veeam backup and replicationA vulnerability allowing an authenticated user with the Backup Administrator role to write...8.6 High
- veeam backup and replicationThis vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.7.3 High
- rocket.chatThe Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8...7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: privilege escalation via improper scope mapping enforcement7.3 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: information disclosure via saml ecp endpoint5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +2 more +4 moreKeycloak: keycloak: security policy bypass in jwe-encrypted request object processing5.9 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter8.8 High
- realmag777 fox – currency switcher professional for woocommerceFOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter4.3 Medium
- jetmonsters timetable and event schedule by motopressTimetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function4.3 Medium
- robertpeake login no captcha recaptchaLogin No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF7.2 High
- bensibley independent analytics – wordpress analytics pluginIndependent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak-rhel9: organization data leak after feature disabled in keycloak4.3 Medium
- acer nitrorsense v3NitroSense V3: Security Vulnerability Information8.5 High
- samsung escargotOut-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This...8.8 High
- struktur libheiflibheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow7.1 High
- struktur libheiflibheif has integer overflow in inline mask size calculation that causes undersized buffer allocation6.1 Medium
- struktur libheiflibheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe6.9 Medium
- canonical ubuntu linuxNULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation3.3 Low
- canonical ubuntu linuxUse of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rules3.3 Low
- canonical ubuntu linuxNULL pointer dereference in Ubuntu Linux AppArmor notification handling5.5 Medium
- canonical ubuntu linuxDeadlock or kernel panic in Ubuntu Linux AppArmor notification handling5.5 Medium
- canonical ubuntu linuxOut-of-bounds read in Ubuntu Linux AppArmor notification handling7.8 High
- canonical ubuntu linuxOut-of-bounds read in Ubuntu Linux AppArmor notification handling5.5 Medium
- canonical ubuntu linuxUse-after-free in Ubuntu Linux AppArmor notification handling7.8 High
- canonical ubuntu linuxUse of uninitialized value in Ubuntu Linux AppArmor notification handling3.3 Low
- canonical ubuntu linuxIncorrect validation of field size in Ubuntu Linux AppArmor notification responses3.3 Low
- canonical ubuntu linuxInvalid pointer deallocation in Ubuntu Linux AppArmor notification handling6.1 Medium
- canonical ubuntu linuxNULL pointer dereference in Ubuntu Linux AppArmor notification handling3.3 Low
- canonical ubuntu linuxMemory leak in Ubuntu Linux AppArmor large notification response allocation5.5 Medium
- struktur libheiflibheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access6.1 Medium
- struktur libheiflibheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data26.8 Medium
- struktur libheiflibheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation7.5 High
- struktur libheiflibheif has Heap Out Of Bounds Write in unci subsystem6.1 Medium
- oisf suricataSuricata http2: decompression bomb can cause denial of service in Suricata7.5 High
- oisf suricataSuricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock7.5 High
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 moresmb: client: validate dacloffset before building DACL pointers9.8 Critical
- oisf suricataSuricata lua: excessive flow variable registration can bypass sandbox7.5 High
- oisf suricataikev2: unbounded client transform storage can lead to resource exhaustion7.5 High
- oisf suricataSuricata ldap: unbounded responses per transaction can lead to resource exhaustion7.5 High
- oisf suricataSuricata datasets: save to absolute filename can be bypassed when combined with load command4.4 Medium
- oisf suricataSuricata nfs: unbounded stateful structures can lead to resource exhaustion7.5 High
- oisf suricataSuricata dnp3: unbounded reassembly can lead to resource exhaustion7.5 High
- oisf suricataSuricata http2: protocol-change type confusion can lead to denial of service9.1 Critical
- oisf suricataSuricata lua: sandbox allocation limit not enforced for new allocations5.9 Medium
- oisf suricataSuricata defrag: missing address-family check can lead to remote crash7.5 High
- oisf suricataSuricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load3.3 Low
- oisf suricataSuricata http1: quadratic Content-Disposition processing can lead to denial of service7.5 High
- Show moreLoading…