CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- talagasoft maxon erpMaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter7.1 High
- sitejo hape pkhHaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record Deletion8.7 High
- sitejo hape pkhHaPe PKH 1.1 SQL Injection via desa Parameter8.8 High
- sitejo hape pkhHaPe PKH 1.1 SQL Injection via nama_kelompok Parameter8.8 High
- sitejo hape pkhHaPe PKH 1.1 Arbitrary File Upload via aksi_foto.php8.7 High
- sitejo hape pkhHaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php6.9 Medium
- sitejo hape pkhHaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php8.8 High
- eregistrasi-kejuaraan-silat registrasi pencak silatE-Registrasi Pencak Silat 18.10 SQL Injection via id_partai8.8 High
- wikidforumWikidforum 2.20 Cross-Site Scripting via reply_text Parameter5.1 Medium
- cleanersoft software free mp3 cd ripperFree MP3 CD Ripper 2.8 Buffer Overflow SEH DEP Bypass8.6 High
- bylancer zechatZechat 1.5 SQL Injection via uname Parameter8.8 High
- trendnet tew-432brp, tew-432brp firmware +1 moreTRENDnet TEW-432BRP formSetPortTr stack-based overflow5.3 Medium
- zyddnys manga-image-translatormanga-image-translator RCE via Unsafe Pickle Deserialization in Share Model9.2 Critical
- wptravel wp travel proWP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators9.1 Critical
- trendnet tew-432brp, tew-432brp firmware +1 moreTRENDnet TEW-432BRP formWPS stack-based overflow8.7 High
- eximExim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading...5.3 Medium
- trendnet tew-432brp, tew-432brp firmware +1 moreTRENDnet TEW-432BRP formSetRoute stack-based overflow8.7 High
- openscOpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile.c1.0 Low
- home assistant companion app (android), companion app (ios), home-assistant core +2 moreHome Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection8.3 High
- trendnet tew-432brp, tew-432brp firmware +1 moreTRENDnet TEW-432BRP formWPS command injection5.3 Medium
- openscOpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c1.0 Low
- mouse07410 asn1cmouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in `INTEGER_decode_oer` via Malformed OER Payload8.2 High
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot1.0 Low
- trendnet tew-432brp, tew-432brp firmware +1 moreTRENDnet TEW-432BRP formSetRoute command injection5.3 Medium
- wwbn avideoWWBN AVideo: Stored XSS via unescaped Gallery category description5.4 Medium
- wwbn avideoWWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint7.1 High
- marcelroozekrans roslyn-codelens-mcpRoslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get_diagnostics Leads to Arbitrary Code Execution7.8 High
- interinfo dreammakerInterinfo｜DreamMaker - Path Traversal6.9 Medium
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module7.6 High
- interinfo dreammakerInterinfo｜DreamMaker - Arbitrary File Read6.9 Medium
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports8.5 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Local File Inclusion in Dashboard Module7.6 High
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot1.0 Low
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface9.3 Critical
- interinfo dreammakerInterinfo｜DreamMaker - Arbitrary File Read8.7 High
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown4.1 Medium
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 WCM voltage-based shutdown4.1 Medium
- interinfo dreammakerInterinfo｜DreamMaker - Arbitrary File Upload8.6 High
- intermesh groupofficeGroup-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write5.1 Medium
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 WCM brute-force4.1 Medium
- interinfo dreammakerInterinfo｜DreamMaker - Arbitrary File Upload9.3 Critical
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 WCM-to-ECM weak authentication4.1 Medium
- haxtheweb haxcms-nodejs, haxcms-php +1 moreHaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint8.7 High
- rustfsRustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root9.3 Critical
- infiniflow ragflowRAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution9.9 Critical
- suprema biostar 2 (server)Uncaught exception vulnerability in Suprema's BioStar8.7 High
- suprema biostar 2 (server)Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStar10.0 Critical
- tirr-c jxl-grid, jxl-oxide +1 morejxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms7.3 High
- eugeny russhRussh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets7.5 High
- remote spark (https://www.remotespark.com/) sparkviewRemote Spark SparkView Path Traversal in RDP Drive Redirection leading to RCE10.0 Critical
- Show moreLoading…