CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- themesuite automotive car dealership business wordpress themeAutomotive Car Dealership Business WordPress Theme <= 13.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details6.4 Medium
- flippercode wp maps proWP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action9.8 Critical
- sbthemes woocommerce infinite scroll and ajax paginationWooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- statcounter – free real time visitor stats, unknown statcounter – free real time visitor stats +1 moreStatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname6.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: libsoup: http request smuggling via unsigned to signed conversion error4.8 Medium
- cloudways breeze cacheBreeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie5.3 Medium
- No product listedSecurity update for podmanNo score
- ays-pro poll maker by ays – versus polls, anonymous polls, image pollsPoll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action4.3 Medium
- saadiqbal post snippets – custom wordpress code snippets customizerPost Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import4.4 Medium
- asus system control interfaceAn Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control...7.3 High
- asus armoury crateIncorrect permission assignment for a critical resource in Armoury Crate allows a local user to...7.3 High
openscOSS-FuzzStack-buffer-overflow in coolkey_rsa_opNo scorelibhevcOSS-FuzzHeap-buffer-overflow in ihevcd_fmt_conv_422sp_to_420pNo scorekimageformatsOSS-FuzzHeap-use-after-free in slice_segment_header::operator=No score- canon inc. pixus ix6800 series cups printer driver for macos, pixma ix6800 series cups printer driver for macos, pixma mg2500 series cups printer driver for macos +2 moreImproper handling of symbolic links in the installer of CUPS Printer Driver for macOS(*) may...5.1 Medium
- microsoft libsolv, red hat enterprise linux 10, enterprise linux 7 +6 more +8 moreLibsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service7.5 High
- jelmer dulwichDulwich doesn't sanitize commit subjects in `porcelain.format_patch`3.3 Low
- No product listedFalco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the...7.3 High
- emlogThe template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing...7.2 High
- No product listedBolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages...6.5 Medium
- No product listedSourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to...6.1 Medium
- opensuse libzyppHandcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp8.8 High
otrs2Ubuntu,znunyDebian +1 more[Unknown description]No scoreedk2Debian,edk2-hweUbuntu +1 moreseveral issues with partition table measurementsNo score- canon inc. my image garden for macosImproper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8...5.1 Medium
- drupal tfa basic plugins, tfa basic plugins project basic plugins +1 moreTFA Basic Plugins - Access Bypass5.1 Medium
- theupdateframework python-tufpython-tuf: Platform-dependent delegation path matching4.0 Medium
- getarcaneapp arcaneArcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane7.7 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGlib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain4.3 Medium
- jelmer dulwichDulwich Vulnerable to Command Injection via Merge Driver Path7.7 High
- jelmer dulwichDulwich has an arbitrary file write via NTFS-hostile tree entries on Windows8.8 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter9.8 Critical
- google chromeType Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a...7.5 High
- google chromeInsufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216...8.8 High
- google chromeInsufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0...8.3 High
- google chromeInteger overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to...6.5 Medium
- google chromeOut of bounds read in Headless in Google Chrome prior to 148.0.7778.216 allowed a remote attacker...8.3 High
- google chromeUse after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to...8.8 High
- google chromeInteger overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to...8.8 High
- google chromeUse after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 allowed a remote...8.3 High
- google chromeUse after free in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to...8.8 High
- google chromeUse after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had...8.3 High
- google chromeInappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote...3.1 Low
- google chromeInappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed...5.0 Medium
- google chromeInteger overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who...7.5 High
- google chromeUninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote...6.5 Medium
- google chromeUse after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to...8.8 High
- google chromeRace in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute...7.5 High
- google chromeUse after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote...7.5 High
- Show moreLoading…