Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2026

375 records · 23 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 4 of 4

  • CVE-2026-45247
    75This week

    Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

    CriticalCVSS 9.3KEVWeaponizedEPSS 26%

    mirasvit · full page cache warmerMay 26, 2026

  • CVE-2026-46368
    36Monitor

    luci-app-https-dns-proxy Authenticated Command Injection via setInitAction

    HighCVSS 8.7Proof of conceptEPSS 6%

    mossdef-org · luci-app-https-dns-proxyMay 26, 2026

  • CVE-2026-4480
    40Plan

    Samba: samba: remote code execution in printing subsystem via unescaped job description

    CriticalCVSS 9.0Proof of conceptEPSS 13%

    samba · sambaMay 26, 2026

  • CVE-2026-40564
    26Monitor

    Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator

    MediumCVSS 6.5Proof of conceptEPSS 0%

    apache · flink kubernetes operatorMay 26, 2026

  • CVE-2026-30894
    27Monitor

    Joomla! Core - [20260503] - XSS in com_contenthistory

    MediumCVSS 6.9No exploitEPSS 0%

    joomla · joomla\!May 26, 2026

  • CVE-2026-35223
    38Monitor

    Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints

    HighCVSS 8.6Proof of conceptEPSS 12%

    joomla · joomla\!May 26, 2026

  • CVE-2026-40383
    34Monitor

    Joomla! Core - [20260509] - LFI in HTMLView layout parameter

    HighCVSS 7.5No exploitEPSS 12%

    joomla · joomla\!May 26, 2026

  • CVE-2026-44680
    30Monitor

    MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys

    HighCVSS 7.6Proof of conceptEPSS 1%

    mikro-orm · mikro-ormMay 26, 2026

  • CVE-2026-44706
    34Monitor

    Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values

    HighCVSS 8.5Proof of conceptEPSS 0%

    chatwoot · chatwootMay 26, 2026

  • CVE-2026-44707
    27Monitor

    Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts

    MediumCVSS 6.8No exploitEPSS 0%

    chatwoot · chatwootMay 26, 2026

  • CVE-2026-9560
    37Monitor

    Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands w

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    openvpn · connectMay 26, 2026

  • CVE-2026-36239
    17Monitor

    PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality

    MediumCVSS 4.3Proof of conceptEPSS 0%

    May 26, 2026

  • CVE-2026-44788
    26Monitor

    SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)

    MediumCVSS 6.5Proof of conceptEPSS 0%

    adamhathcock · sharpcompressMay 26, 2026

  • CVE-2026-45298
    34Monitor

    Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

    HighCVSS 8.6Proof of conceptEPSS 1%

    amirraminfar · dozzleMay 26, 2026

  • CVE-2026-48710
    77This week

    Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

    MediumCVSS 6.5KEVWeaponizedEPSS 70%

    encode · starletteMay 26, 2026

  • CVE-2026-48962
    29Monitor

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

    HighCVSS 7.3Proof of conceptEPSS 0%

    pmqs · io::compressMay 27, 2026

  • CVE-2026-3001
    24Monitor

    Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter

    MediumCVSS 6.1Proof of conceptEPSS 0%

    jegstudio · gutenverse – wordpress blocks, page builder & site editorMay 27, 2026

  • CVE-2026-8832
    36Monitor

    WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost

    HighCVSS 8.8Proof of conceptEPSS 1%

    smub · wpcode – insert headers and footers + custom code snippets – wordpress code managerMay 27, 2026

  • CVE-2026-8054
    40Plan

    Unauthenticated SQL Injection in dotCMS Publish Audit API

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    dotcms · dotcms coreMay 27, 2026

  • CVE-2026-36539
    29Monitor

    Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the entire router configuration as a JSON resp

    HighCVSS 7.3Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-38422
    29Monitor

    Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the tasmota/ta

    HighCVSS 7.3Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-42758
    39Monitor

    WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    saleswonder team: tobias · webinarignitionMay 27, 2026

  • CVE-2026-30498
    25Monitor

    A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.

    MediumCVSS 6.3Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-31266
    29Monitor

    Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate).

    HighCVSS 7.3Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-49053
    21Monitor

    WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    wpmet · elementskit elementor addons liteMay 27, 2026

  • CVE-2026-38945
    31Monitor

    Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path

    HighCVSS 7.8Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-45061
    30Monitor

    Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)

    HighCVSS 7.7No exploitEPSS 0%

    budibase · budibaseMay 27, 2026

  • CVE-2026-4390
    21Monitor

    TeamSpeak 3 Server Connection State Management process_resend_queue use after free

    MediumCVSS 5.3Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-38426
    29Monitor

    Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv_10_sc

    HighCVSS 7.3Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-38427
    29Monitor

    An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow.

    HighCVSS 7.3Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-44315
    37Monitor

    free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

    CriticalCVSS 9.4No exploitEPSS 0%

    free5gc · free5gcMay 27, 2026

  • CVE-2026-48027
    68This week

    Compromised Nx Console version 18.95.0

    CriticalCVSS 9.3KEVWeaponizedEPSS 1%

    nx · nx consoleMay 27, 2026

  • CVE-2025-69600
    31Monitor

    Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via getco

    HighCVSS 7.8Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-45087
    60This week

    Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

    CriticalCVSS 10.0WeaponizedEPSS 8%

    hahwul · dalfoxMay 27, 2026

  • CVE-2026-42878
    21Monitor

    FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts

    MediumCVSS 5.3Proof of conceptEPSS 0%

    neorazorx · facturascriptsMay 27, 2026

  • CVE-2026-42879
    25Monitor

    FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

    MediumCVSS 6.3Proof of conceptEPSS 0%

    neorazorx · facturascriptsMay 27, 2026

  • CVE-2026-44590
    37Monitor

    Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    sherlock-project · sherlockMay 27, 2026

  • CVE-2026-49009
    12Monitor

    Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.

    LowCVSS 3.1Proof of conceptEPSS 0%

    May 27, 2026

  • CVE-2026-9789
    34Monitor

    NitroSense V3: Security Vulnerability Information

    HighCVSS 8.5Proof of conceptEPSS 0%

    acer · nitrorsense v3May 28, 2026

  • CVE-2026-9618
    17Monitor

    PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink

    MediumCVSS 4.3Proof of conceptEPSS 0%

    peachpay · peachpay — payments & express checkout for woocommerce (supports stripe, paypal, square, authorize.net, nmi)May 28, 2026

  • CVE-2026-32996
    29Monitor

    This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

    HighCVSS 7.3Proof of conceptEPSS 0%

    veeam · backup and replicationMay 28, 2026

  • CVE-2026-9794
    21Monitor

    Keycloak: keycloak: information disclosure via saml ecp endpoint

    MediumCVSS 5.3Proof of conceptEPSS 0%

    redhat · build of keycloakMay 28, 2026

  • CVE-2026-46215
    31Monitor

    drm: Set old handle to NULL before prime swap in change_handle

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelMay 28, 2026

  • CVE-2026-9806
    25Monitor

    Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names

    MediumCVSS 6.3Proof of conceptEPSS 0%

    misp · cti-transmuteMay 28, 2026

  • CVE-2026-4408
    40Plan

    Samba: remote code execution in samr

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    samba · sambaMay 28, 2026

  • CVE-2026-9090
    36Monitor

    Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary sign

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    casdoor · casdoorMay 28, 2026

  • CVE-2026-47761
    21Monitor

    TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

    MediumCVSS 5.4Proof of conceptEPSS 0%

    tiny · tinymceMay 28, 2026

  • CVE-2026-46817
    73This week

    Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

    CriticalCVSS 9.8KEVWeaponizedEPSS 12%

    oracle · e-business suiteMay 28, 2026

  • CVE-2026-8697
    34Monitor

    Improper Authentication Rate Limiting on TP-Link's Archer C64

    HighCVSS 8.7Proof of conceptEPSS 0%

    tp-link · archer c64 firmwareMay 28, 2026

  • CVE-2026-9645
    39Monitor

    ScadaBR Authenticated Remote Code Execution

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    scadabr · scadabrMay 28, 2026

  • CVE-2026-44848
    37Monitor

    Portainer: Missing authorization on Docker plugin endpoints allows host RCE

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    portainer · portainerMay 28, 2026

  • CVE-2026-44881
    34Monitor

    Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

    HighCVSS 8.5Proof of conceptEPSS 0%

    portainer · portainerMay 28, 2026

  • CVE-2026-44883
    30Monitor

    Portainer: JWT accepted in URL query leaks tokens to logs and referers

    HighCVSS 7.7No exploitEPSS 0%

    portainer · portainerMay 28, 2026

  • CVE-2026-45332
    30Monitor

    Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

    HighCVSS 7.5Proof of conceptEPSS 1%

    marcantondahmen · automadMay 28, 2026

  • CVE-2026-8809
    39Monitor

    Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    hwk-fr · advanced custom fields: extendedMay 28, 2026

  • CVE-2026-9973
    35Monitor

    Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeMay 28, 2026

  • CVE-2026-9997
    33Monitor

    Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poten

    HighCVSS 8.3Proof of conceptEPSS 0%

    google · chromeMay 28, 2026

  • CVE-2026-9998
    33Monitor

    Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to pote

    HighCVSS 8.3Proof of conceptEPSS 0%

    google · chromeMay 28, 2026

  • CVE-2026-9999
    35Monitor

    Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code in

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeMay 28, 2026

  • CVE-2026-8732
    45Plan

    WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    flippercode · wp maps proMay 29, 2026

  • CVE-2025-11262
    28Monitor

    Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting

    HighCVSS 7.2Proof of conceptEPSS 0%

    linkwhspr · link whisper freeMay 29, 2026

  • CVE-2026-9558
    39Monitor

    A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    May 29, 2026

  • CVE-2026-9809
    30Monitor

    A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7.

    HighCVSS 7.6Proof of conceptEPSS 0%

    May 29, 2026

  • CVE-2026-9811
    21Monitor

    A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    May 29, 2026

  • CVE-2026-46376
    37Monitor

    FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    sangoma · freepbxMay 29, 2026

  • CVE-2026-39292
    29Monitor

    Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module that allows

    HighCVSS 7.3Proof of conceptEPSS 0%

    May 29, 2026

  • CVE-2026-44648
    30Monitor

    SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

    HighCVSS 7.5Proof of conceptEPSS 0%

    sillytavern · sillytavernMay 29, 2026

  • CVE-2026-46372
    34Monitor

    SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

    HighCVSS 8.5Proof of conceptEPSS 0%

    sillytavern · sillytavernMay 29, 2026

  • CVE-2026-49373
    42Plan

    In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

    HighCVSS 8.8No exploitEPSS 24%

    jetbrains · teamcityMay 29, 2026

  • CVE-2026-10110
    22Monitor

    code-projects Student Details Management System index.php sql injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · student details management systemMay 30, 2026

  • CVE-2026-7459
    30Monitor

    Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction En

    HighCVSS 7.5Proof of conceptEPSS 0%

    eskapism · simple history – track, log, and audit wordpress changesMay 30, 2026

  • CVE-2026-7465
    35Monitor

    Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

    HighCVSS 8.8Proof of conceptEPSS 1%

    brainstormforce · spectra gutenberg blocks – website builder for the block editorMay 30, 2026

  • CVE-2026-46242
    32Monitor

    eventpoll: fix ep_remove struct eventpoll / struct file UAF

    HighCVSS 7.8Proof of conceptEPSS 4%

    linux · linux kernelMay 30, 2026

  • CVE-2026-10170
    8Monitor

    code-projects Visitor Management System phone_0.php sql injection

    LowCVSS 2.1Proof of conceptEPSS 0%

    code-projects · visitor management systemMay 31, 2026

  • CVE-2026-10187
    37Monitor

    Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow

    HighCVSS 8.9Proof of conceptEPSS 7%

    totolink · n300rhMay 31, 2026