CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...7.5 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500...7.5 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-125: Out-of-bounds Read in Waterfall WF-500 RX Host in...7.5 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in...8.7 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...9.3 Critical
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in...8.8 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.5 High
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
apache2Ubuntuapache2 regressionNo scoremautic/corePackagistMautic has Stored Cross-Site Scripting (XSS) in Project Option Selector5.4 Medium- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an...8.6 High
mautic/corePackagistMautic has Stored Cross-Site Scripting (XSS) in Projects Component7.6 Highmautic/corePackagistMautic has an Authorization Bypass in API v2 Endpoints7.1 Highmautic/corePackagistMautic vulnerable to Path Traversal via Campaign Import9.9 Criticalmautic/corePackagistMautic has Server-Side Template Injection (SSTI) in Theme Templates9.9 Critical- redhat openshift router, red hat openshift container platform 4.12, openshift container platform 4.13 +10 more +12 moreOpenshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend7.4 High
- redhat openshift router, red hat openshift container platform 4, openshift container platform 4.17 +7 more +9 moreOpenshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation7.7 High
mautic/corePackagistMautic Focus component Vulnerable to SSRF6.4 Medium- red hat quay 3Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring2.7 Low
- rankmath rank math seo – ai seo tools to dominate seo rankingsRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification5.3 Medium
- acer wave 7 router, wave 7 firmware +1 moreAcer Wave 7 router: Hardcoded Cryptographic Key10.0 Critical
- acer wave 7 router, wave 7 firmware +1 moreAcer Wave 7 router: Broken Access Control10.0 Critical
- acer predator connect w6x, predator connect w6x firmware +1 morePredator Connect W6x: RCE via MQTT10.0 Critical
- itp technology its intelligent scada systemITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site Scripting4.8 Medium
- itp technology its intelligent scada systemITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site Scripting4.8 Medium
- acer predator connect w6x, predator connect w6x firmware +1 morePredator Connect W6x: MQTT Broker Access Control8.3 High
- scott paterson contact form 7 – paypal & stripe add-onContact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)5.3 Medium
- acer predator connect w6x, predator connect w6x firmware +1 morePredator Connect W6x: Improper Authentication10.0 Critical
- acer predator connect w6x, predator connect w6x firmware +1 morePredator Connect W6x: Web Interface Command Injection8.6 High
- network optix nx witness vmsCORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin request7.5 High
- acer predator connect w6x, predator connect w6x firmware +1 morePredator Connect W6x: unauthenticated Debug Service8.7 High
- red hat quay 3Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints4.1 Medium
- david lingren media library assistantMedia Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form8.1 High
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter4.9 Medium
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchange4.1 Medium
mautic/corePackagistMautic has SQL Injection in API Contact Filtering7.1 High- linkwhspr link whisper freeLink Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting7.2 High
- posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerceThe Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter6.4 Medium
- glboy otp login with phone number, otp verificationOTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification9.8 Critical
- jqlang jqjq: stack overflow in deep structural equality6.8 Medium
- bankpro e-service technology service centerBankPro E-Service Technology｜Service Center - Insecure Direct Object Reference7.1 High
- creaweb2b simple divi shortcodeSimple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- Show moreLoading…