CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- rustfsRustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source7.1 High
- rustfsRustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers8.8 High
- rustfsRustFS: Unauthenticated RustFS console license endpoint exposes license metadata6.9 Medium
- oscal-compass compliance-trestlecompliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem6.7 Medium
- vllm-project vllm-project/vllmHardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control8.8 High
- learningcircuit local-deep-researchLocal Deep Research: SSRF bypass in `safe_get`5.0 Medium
- murtaza-nasir speakrSpeakr: Open redirect in is_safe_url via parser mismatch on next parameter6.1 Medium
- oscal-compass compliance-trestlecompliance-trestle - jinja has an Arbitrary File Write via Path Traversal8.4 High
- oscal-compass compliance-trestlecompliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal6.9 Medium
- sensiolabs symfony, symfony json-path +1 moreSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS8.2 High
- sensiolabs symfony, /mailtrap-mailer mailtrap-mailer +1 moreSymfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection6.9 Medium
- sensiolabs symfony, symfony lox24-notifier, mailjet-mailer +2 moreSymfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection6.9 Medium
- open-telemetry go.opentelemetry.io/otel/schema/v1.0, go.opentelemetry.io/otel/schema/v1.1, opentelemetry telemetry schema files +2 moreOpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse2.1 Low
- opentelemetry, open-telemetry go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation +2 moreOpenTelemetry-Go's baggage parsing no longer caps raw header length5.3 Medium
- projectcapsule capsuleCapsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability6.9 Medium
- projectcapsule capsuleCapsule Namespace Hijacking via subresource3.9 Low
- jpettitt meshcore-card, meshcore card +1 moreMeshCore Card: XSS vulnerability through meshcore node name9.6 Critical
- openreplayOpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding7.7 High
- openreplayCross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch5.3 Medium
- tp link systems inc. tapo d100c v1.0, tp-link systems inc. tapo p300 v1.0, tp-link tapo d100c firmware +3 more +5 moreBluetooth Communication Uses Unencrypted Transmission During Initial Setup on TP-Link's Tapo L535E, P300 and D100C7.3 High
- sensiolabs symfony, symfony html-sanitizer +1 moreSymfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)2.1 Low
- casdoorCVE-2026-90989.1 Critical
- casdoorCVE-2026-90979.8 Critical
- casdoorCVE-2026-90967.5 High
- casdoorCVE-2026-90958.1 High
- casdoorCVE-2026-90949.8 Critical
- espocrmEspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup6.5 Medium
- espocrmEspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes4.3 Medium
- casdoorCVE-2026-90939.8 Critical
- gitbutlerapp gitbutlerGitButler: Link injection via forge integration enables arbitrary script execution9.3 Critical
- casdoorCVE-2026-90929.1 Critical
- casdoorCVE-2026-90915.3 Medium
- casdoorCVE-2026-90909.1 Critical
- zedZed: Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions8.6 High
- zedZed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions8.6 High
- zedZed: Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions6.4 Medium
- zedZed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config8.6 High
- zedZed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote)8.6 High
- tigera calico, calico cloud, calico enterprise +2 moreCalicoctl leaks cluster credentials to stderr when verbose logging is enabled7.2 High
- tigera calico, calico cloud, calico enterprise +2 moreServiceAccount token disclosure via Azure IPAM CNI plugin logs6.0 Medium
- tigera calicoServiceAccount token disclosure via install-cni container logs6.0 Medium
- tp-link archer c64 firmware, tp-link systems inc. archer c64 v1.0 +1 moreImproper Authentication Rate Limiting on TP-Link's Archer C648.7 High
- sdmc ne6037SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php9.3 Critical
- honoHono: JWT middleware accepts any Authorization scheme, not only Bearer4.8 Medium
- honoHono: IP Restriction bypasses static deny rules for non-canonical IPv65.3 Medium
- honoHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection4.3 Medium
- honoHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths5.3 Medium
- tiny tinymceTinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments8.7 High
- tiny tinymceTinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection8.7 High
- tiny tinymceTinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes8.7 High
- Show moreLoading…