CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- tiny tinymceTinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs8.7 High
- jpadilla pyjwtPyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS5.3 Medium
- jpadilla pyjwtPyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys5.4 Medium
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +37 more +39 morePyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed7.4 High
- jpadilla pyjwtPyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)3.7 Low
- jpadilla pyjwtPyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes4.2 Medium
- py-pdf pypdfpypdf: Possible large memory usage for large offsets for layout mode text4.8 Medium
- py-pdf pypdfpypdf: Possible long runtimes for zero-only width values in cross-reference streams5.1 Medium
- py-pdf pypdfpypdf: Manipulated XMP metadata streams can exhaust RAM6.9 Medium
- espressif shared-github-dangerjsEspressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint8.2 High
- mik cryptxCryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers7.5 High
- view concept kidsviewAuthentication Bypass in Kidsview5.3 Medium
- canonical multipassLocal Privilege Escalation in Canonical Multipass7.8 High
- canonical multipassSFTP Server VM Escape in Canonical Multipass8.4 High
- bzip2Off-by-One Leading to Out-of-Bounds Write in bzip24.8 Medium
- mennekes amtronPrivilege Escalation9.3 Critical
- mennekes amtronAuthentication Bypass9.3 Critical
- qos.ch sarl logbackLogback deserialization whitelist bypass for java.lang and java.util2.9 Low
- apache artemis, apache software foundation activemq artemis stomp protocol, artemis stomp protocol +2 moreApache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission4.3 Medium
solana_rbpfcrates.io`EbpfVm::invoke_function` performs out-of-bounds pointer arithmeticNo score- rrwo plack::middleware::security::commonPlack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths7.3 High
- containers cruncrun follows rootfs /dev symlink while creating default devices5.1 Medium
- microsoft .net, asp.net core, .net 10.0 runtime +14 more +16 moreASP.NET Core Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 +2 more +4 more.NET Tampering Vulnerability6.2 Medium
- linux, linux kernel +1 morespi: mpc52xx: fix use-after-free on registration failure7.8 High
- linux, linux kernel +1 moremedia: iris: Fix use-after-free in iris_release_internal_buffers()7.8 High
- linux, linux kernel +1 moremedia: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl5.5 Medium
- linux, linux kernel +1 morebatman-adv: stop caching unowned originator pointers in BAT IV8.8 High
- linux, linux kernel +1 moremedia: rc: xbox_remote: heed DMA restrictions5.5 Medium
- linux, linux kernel +1 moremedia: saa7164: add ioremap return checks and cleanups5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morevsock: fix buffer size clamping order7.8 High
- linux, linux kernel +1 morebatman-adv: bla: only purge non-released claims5.5 Medium
- linux, linux kernel +1 moreHID: playstation: Clamp num_touch_reports8.1 High
- linux, linux kernel +1 morebatman-adv: bla: put backbone reference on failed claim hash insert5.5 Medium
- linux, linux kernel +1 moredrm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg7.1 High
- linux, linux kernel +1 moredrm/amdkfd: Clear VRAM on allocation to prevent stale data exposure5.5 Medium
- linux, linux kernel +1 morespi: ch341: fix devres lifetime5.5 Medium
- linux, linux kernel, red hat enterprise linux 10 +15 more +17 moresctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL7.8 High
- linux, linux kernel +1 morespi: fsl: fix controller deregistration5.5 Medium
- linux, linux kernel +1 morespi: rspi: fix controller deregistration5.5 Medium
- linux, linux kernel +1 moredrm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure5.5 Medium
- linux, linux kernel +1 morecgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated5.5 Medium
- linux, linux kernel +1 moremedia: rockchip: rkcif: Add missing MUST_CONNECT flag to pads5.5 Medium
- linux, linux kernel +1 moreEDAC/versalnet: Fix device name memory leak5.5 Medium
- linux, linux kernel +1 moredrm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission5.5 Medium
- linux, linux kernel +1 morespi: mpc52xx: fix use-after-free on unbind7.8 High
- linux, linux kernel +1 moredrm/amdgpu: Add bounds checking to ib_{get,set}_value7.1 High
- linux, linux kernel +1 moredrm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()5.5 Medium
- linux, linux kernel +1 moredrm: Set old handle to NULL before prime swap in change_handle7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morevsock/virtio: fix accept queue count leak on transport mismatch5.5 Medium
- Show moreLoading…