CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions...10.0 Critical
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Core). Supported versions that are...9.9 Critical
- oracle e-business suite, flow manufacturing +1 moreVulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component:...8.8 High
- oracle database serverVulnerability in the Net Service component of Oracle Database Server. Supported versions that...7.5 High
- oracle database serverVulnerability in the Net Service component of Oracle Database Server. Supported versions that...7.5 High
- oracle database serverVulnerability in the Net Service component of Oracle Database Server. Supported versions that...9.0 Critical
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are...5.3 Medium
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are...7.5 High
- oracle e-business suite, oracle corporation payroll +1 moreVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal...8.1 High
- oracle e-business suite, oracle corporation payroll +1 moreVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service...8.8 High
- oracle e-business suite, oracle corporation payroll +1 moreVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal...8.8 High
- oracle universal work queueVulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component:...9.9 Critical
- oracle public sector financials, oracle corporation public sector financials (international) +1 moreVulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business...7.7 High
- oracle iassetsVulnerability in the Oracle iAssets product of Oracle E-Business Suite (component: Internal...9.9 Critical
- oracle financials common modulesVulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite ...7.7 High
- oracle financials common modulesVulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite ...8.5 High
- oracle e-business suite, oracle corporation internet procurement connector +1 moreVulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite ...9.1 Critical
- oracle e-business suite, oracle corporation payments +1 moreVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File...7.4 High
- oracle e-business suite, oracle corporation payments +1 moreVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File...9.8 Critical
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Core). Supported versions that are...9.9 Critical
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Core). Supported versions that are...8.1 High
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Core). Supported versions that are...7.9 High
- oracle hospitality opera 5 property servicesVulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality...9.8 Critical
- bkddfs shamefileShamefile has an arbitrary file read via shamefile.yaml in shame next5.5 Medium
- always-further nononono: Sandbox escape on Linux via D-Bus: `systemd-run --user`6.1 Medium
- symfony polyfill, polyfill-intl-idn +1 moresymfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence6.9 Medium
- elastic kibanaServer-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access6.3 Medium
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaImproper Input Validation in Kibana Fleet Leading to Privilege Escalation7.2 High
- elastic kibanaServer-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access7.7 High
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaImproper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection4.1 Medium
- elastic kibanaOperation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access5.3 Medium
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to Denial of Service6.5 Medium
- elastic kibanaPath Traversal in Kibana Leading to Unauthorized Deletion of User Accounts4.6 Medium
- hkuds deepcodeDeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py8.7 High
- portainer community editionInsecure default permissions in Portainer CE8.5 High
- musicplayerdaemon mpdMusic Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx6.9 Medium
- musicplayerdaemon mpdMusic Player Daemon < 0.24.11 SSRF via CurlInputPlugin6.9 Medium
- xcharge c6Initialization of a resource with an insecure default in XCharge C68.6 High
- xcharge c6Stack-based buffer overflow in XCharge C68.6 High
- xcharge c6Download of code without integrity check in XCharge C69.3 Critical
- musicplayerdaemon mpdMusic Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling8.7 High
- oscal-compass compliance-trestlecompliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)7.8 High
- musicplayerdaemon mpdMusic Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be8.8 High
- rustfsRustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console6.0 Medium
- rustfsRustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation9.8 Critical
- rustfsRustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]5.3 Medium
- rustfsRustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery8.7 High
- Show moreLoading…