CVEs published in May 2026
7,396 vulnerabilities, 722 critical, 21 exploited.
- agnoagno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()8.7 High
- dokployDokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement9.0 Critical
- macrozheng mallmacrozheng mall Super Admin Password update improper authorization5.1 Medium
- dokployDokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret10.0 Critical
- No product listedSecurity update for kernel-livepatch-MICRO-6-0_Update_23No score
- No product listedSecurity update for kernel-livepatch-MICRO-6-0_Update_23No score
- No product listedSecurity update for kernel-livepatch-MICRO-6-0-RT_Update_24No score
- No product listedSecurity update for kernel-livepatch-MICRO-6-0-RT_Update_24No score
- dokployDokploy: Schedule Authorization Bypass Enables Host/Server Command Execution9.9 Critical
- dokployDokploy: Command Injection in /docker-container-logs Endpoint9.9 Critical
- dokployDokploy: Remote Code Execution through Path Traversal9.9 Critical
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge7.0 High
- dokployDokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)8.8 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`8.7 High
- dokployDokploy: Remote Code Execution via destinationPath in Container File Upload9.9 Critical
- shibby tomatoShibby Tomato miniupnpd resource consumption8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)8.6 High
- xx-netXX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py5.1 Medium
- axiosAxios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions4.8 Medium
- axiosAxios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix3.7 Low
- froxlorFroxlor has an incomplete fix for CVE-2026-309328.6 High
- shibby tomatoShibby Tomato SUBSCRIBE Call miniupnpd send server-side request forgery6.9 Medium
- pleskPlesk contains an XPath injection vulnerability in the APS Application Catalog search...9.9 Critical
- froxlorFroxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path8.8 High
- froxlorFroxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement8.6 High
- shibby tomatoShibby Tomato multimon.cgi sub_90F0 stack-based overflow8.7 High
- red hat multicluster engine for kubernetesAssisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users6.3 Medium
- shibby tomatoShibby Tomato UPS Service tomatoups.cgi sub_9068 stack-based overflow8.7 High
- cliGitHub CLI tokens leak via `gh attestation` commands7.4 High
- opensolution quickcmsXSS in QuickCMS2.3 Low
- opensolution quickcmsSession Fixation in QuickCMS4.8 Medium
- openclawOpenClaw < 2026.5.18 - Scope Bypass via Inherited chat.send Route8.7 High
- openclawOpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes5.9 Medium
- openclawOpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons7.5 High
- openclawOpenClaw < 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks2.3 Low
- openclawOpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver Gate2.3 Low
- openclawOpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command8.7 High
- shibby tomatoShibby Tomato tomatodata.cgi get_ups_field stack-based overflow8.7 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via add_facnote.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via city_graph.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via inc_types_graph.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via sever_graph.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via form_post.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via nearby.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via main.php8.8 High
- joeyrush php-shop masterPHP-SHOP 1.0 Cross-Site Request Forgery via users.php6.9 Medium
- heatmiser wifi thermostatHeatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htm8.7 High
- kados r10 greenbeeKados R10 GreenBee SQL Injection via update_feature.php8.8 High
- kados r10 greenbeeKados R10 GreenBee SQL Injection via update_release.php8.8 High
- navigate cms, navigatecms navigate cms +1 moreNavigate CMS 2.8.5 Path Traversal via navigate_download.php7.1 High
- Show moreLoading…