May 2026
7,365 CVEs published, +14% on April 2026 and +69% on May 2025. CISA added 21 to KEV.
2026 month by month
- Critical
- 64210% of the 6,642 with a CVSS score
- Added to CISA KEV
- 2119 of this month's CVEs are in KEV, listed a median 2 days after publication
- Vendors
- 2,0465,828 products
- Top weakness
- XSSCWE-79 · 601 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1LinuxLinux, Linux Kernel1,02843none—
- 2GoogleChrome, Google Chrome, Android38013none+3
- 3MicrosoftMicrosoft Edge, Windows Server 2025 (Server Core Installation), Windows Server 2025278263—
- 4Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Open Webui, Linux266252+25
- 5ApplemacOS, iPadOS, iPhone OS1000none+57
- 6Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9956none+6
- 7Apache Software FoundationApache Ofbiz, HTTP Server, Apache HTTP Server8719none+3
- 8npmOpenclaw, Flowise, @hulumi/policies860none−6
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Parsec, Linux Astra Modules840nonenew
- 10ApacheOfbiz, HTTP Server, Cloudstack8018none+1
- 11OpenclawOpenclaw, Crabbox758none−7
- 12EdimaxEw-7438rpn, Br-6675nd, Br-6478ac590nonenew
- 13Open-webuiOpen-webui591nonenew
- 14OpenwebuiOpen Webui591nonenew
- 15Ао «ивк»Альт Сп 10, Альт 8 Сп573nonenew
- 16F5BIG-IP, BIG-IP SSL Orchestrator, BIG-IP Application Security Manager531nonenew
- 17AdobeCommerce B2B, Magento Open Source, Adobe Commerce522none−2
- 18TotolinkA8000RU, CA750-POE, N300RH5031none−11
- 19AmdAmd Ryzen™ Embedded 8000 Series Processors, Amd Ryzen™ 7035 Series Processors With Radeon™ Graphics (Formerly Codenamed "rembrandt R"), Amd Ryzen™ 8040 Series Mobile Processors With Radeon™ Graphics (Formerly Codenamed "hawk Point")490nonenew
- 20IBMHTTP Server, DB2, Aspera High-speed Transfer Server496none—
- 21Edimax Technology Co., Ltd.Edimax Ew-7438rpn, Edimax Br-6675nd, Edimax Br-6478ac460nonenew
- 22Concrete CMSConcrete CMS440nonenew
- 23Crates.ioGix, Diesel, Lemmy_api440none+29
- 24MozillaFirefox, Thunderbird, Firefox Esr449none−5
- 25Open IsesTickets, Open Ises Project440nonenew
Severity
How this month's CVEs score on CVSS; 723 have no score yet. Severity is not exploitation.
- Critical642
- High2,735
- Medium2,992
- Low273
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS601
- CWE-89SQL Injection382
- CWE-862Missing Authorization311
- CWE-416Use After Free305
- CWE-22Path Traversal236
- CWE-78OS Command Injection219
- CWE-476NULL Pointer Dereference208
- CWE-125Out-of-bounds Read202
- CWE-94Code Injection199
- CWE-20Improper Input Validation195
- CWE-77Command Injection187
- CWE-918SSRF187
- CWE-284Improper Access Control177
- CWE-74Injection166
- CWE-119Memory Buffer Bounds165
- CWE-787Out-of-bounds Write160
- CWE-863Incorrect Authorization160
- CWE-639Auth Bypass via User Key137
- CWE-352CSRF135
- CWE-121129
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems2,69329% of sector-tagged CVEs
- OSS Libraries1,17513% of sector-tagged CVEs
- Web & CMS Plugins1,13412% of sector-tagged CVEs
- Networking Infrastructure7918% of sector-tagged CVEs
- Consumer Software7298% of sector-tagged CVEs
- Enterprise Software5916% of sector-tagged CVEs
- Cloud & SaaS4004% of sector-tagged CVEs
- 8 smaller sectors1,608
- Not yet classified223
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 416Use After Free | 862Missing Authorization | 22Path Traversal | 78OS Command Injection | 125Out-of-bounds Read | 476NULL Pointer Dereference | 94Code Injection | 20Improper Input Validation |
|---|---|---|---|---|---|---|---|---|---|---|
| Linux | 106 | 2 | 76 | 116 | 7 | |||||
| 4 | 129 | 1 | 31 | 4 | 55 | |||||
| Сообщество Свободного Программного Обеспечения | 12 | 7 | 26 | 11 | 2 | 6 | 14 | 14 | 5 | 15 |
| Microsoft Corp | 7 | 50 | 1 | 2 | 1 | 12 | 6 | 3 | 33 | |
| Microsoft | 5 | 28 | 2 | 5 | 2 | 4 | 6 | 3 | 7 | |
| Google Inc | 3 | 33 | 9 | 1 | 31 | |||||
| Apple | 7 | 1 | 2 | 5 | 1 | 5 | ||||
| Apache Software Foundation | 4 | 2 | 4 | 2 | 2 | 6 | 7 | |||
| npm | 3 | 5 | 3 | 2 | 2 | |||||
| Apache | 4 | 2 | 4 | 2 | 2 | 6 | 7 | |||
| Ооо «русбитех-астра» | 8 | 13 | 18 | 6 | ||||||
| Openclaw | 16 | 2 | 1 |
In the news
The CVEs security news mentioned most in May 2026.
- CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability510.0
- CVE-2026-0300PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal39.8
- CVE-2026-20127Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability310.0
- CVE-2026-31431crypto: algif_aead - Revert to operating out-of-place37.8
- CVE-2026-35616A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.39.8
- CVE-2026-41089Windows Netlogon Remote Code Execution Vulnerability39.8
- CVE-2026-41096Windows DNS Client Remote Code Execution Vulnerability39.8
- CVE-2024-55591An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2...29.8
- CVE-2025-55182A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, rea...210.0
- CVE-2026-0257PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities29.1
- CVE-2026-0265PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled29.8
- CVE-2026-32161Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability27.5
CVEs published in May 2026
80 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityKEV10.0
- CVE-2026-34908A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.KEV10.0
- CVE-2026-34909A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an u...KEV10.0
- CVE-2026-34910A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.KEV10.0
- CVE-2026-0300PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication PortalKEV9.8
- CVE-2026-42208LiteLLM: SQL injection in Proxy API key verificationKEV9.8
- CVE-2026-45247Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object InjectionKEV9.8
- CVE-2026-46817Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability al...KEV9.8
- CVE-2026-48027Compromised Nx Console version 18.95.0KEV9.8
- CVE-2026-48172LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jso...KEV9.8
- CVE-2026-8398A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc...KEV9.8
- CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004KEV9.8
- CVE-2026-45321Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysKEV9.6
- CVE-2026-0257PAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesKEV9.1
- CVE-2026-42271LiteLLM: Authenticated command execution via MCP stdio test endpointsKEV8.8
- CVE-2026-45659Microsoft SharePoint Remote Code Execution VulnerabilityKEV8.8
- CVE-2026-42897Microsoft Exchange Server Spoofing VulnerabilityKEV8.1
- CVE-2026-41091Microsoft Defender Elevation of Privilege VulnerabilityKEV7.8
- CVE-2026-6973An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.KEV7.2
- CVE-2026-34926A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agen...KEV6.7
- CVE-2026-48710Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksKEV6.5
- CVE-2026-45498Microsoft Defender Denial of Service VulnerabilityKEV4.0
- CVE-2026-34234CtrlPanel: Unauthenticated RCE using installer script10.0
- CVE-2026-45444WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability10.0
- CVE-2026-45312RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution9.9
- CVE-2020-37239libbabl 0.1.62 Broken Double Free Detection Memory Safety9.8
- CVE-2026-35221Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder9.8
- CVE-2026-44717MCP Calculate Server: Prompt Injection to RCE9.8
- CVE-2026-8495Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-0379.8
- CVE-2026-8633IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins9.8
- CVE-2026-8760Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force9.8
- CVE-2026-41589Wish has SCP Path Traversal that allows arbitrary file read/write9.6
- CVE-2026-8511Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)9.6
- CVE-2026-41948Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access9.4
- CVE-2025-27851The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, includi...9.3
- CVE-2026-44212PrestaShop: Stored XSS executable in customer service view9.3
- CVE-2026-41947Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints9.1
- CVE-2026-42354Sentry: Improper authentication on SAML SSO process allows user identity linking9.1
- CVE-2026-42608Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.9.1
- CVE-2026-4480Samba: samba: remote code execution in printing subsystem via unescaped job description9.0
- CVE-2026-25588RedisTimeSeries RESTORE invalid memory access may allow remote code execution8.8
- CVE-2026-32740libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing8.8
- CVE-2026-43284xfrm: esp: avoid in-place decrypt on shared skb frags8.8
- CVE-2026-43503net: skbuff: propagate shared-frag marker through frag-transfer helpers8.8
- CVE-2026-43892AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection8.8
- CVE-2018-25360AgataSoft Auto PingMaster 1.5 Buffer Overflow SEH8.4
- CVE-2026-46728Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.8.2
- CVE-2026-22166GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable8.1
- CVE-2026-23631redis-server Lua use-after-free may allow remote code execution8.1
- CVE-2026-48131VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero8.1
- CVE-2026-48132VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP8.1
- CVE-2026-33835Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability7.8
- CVE-2026-33840Win32k Elevation of Privilege Vulnerability7.8
- CVE-2026-40397Windows Common Log File System Driver Elevation of Privilege Vulnerability7.8
- CVE-2026-43074eventpoll: defer struct eventpoll free to RCU grace period7.8
- CVE-2026-43499rtmutex: Use waiter::task instead of current in remove_waiter()7.8
- CVE-2026-43500rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present7.8
- CVE-2026-43502net/rds: handle zerocopy send cleanup before the message is queued7.8
- CVE-2026-4430Heap Buffer Overflow in AgileEngine7.8
- CVE-2026-46242eventpoll: fix ep_remove struct eventpoll / struct file UAF7.8
- CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescing7.8
- CVE-2026-41493yard: Possible arbitrary path traversal and file access via yard server7.5
- CVE-2026-44573Next.js: Middleware / Proxy bypass in Pages Router applications using i18n7.5
- CVE-2026-48844Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has bee...7.5
- CVE-2026-6918In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.7.5
- CVE-2026-8510Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafte...7.5
- CVE-2026-46818Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability ...7.4
- CVE-2023-42344Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.7.3
- CVE-2026-32177.NET Elevation of Privilege Vulnerability7.3
- CVE-2026-7598libssh2 userauth.c userauth_password integer overflow7.3
- CVE-2026-32882libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride7.1
- CVE-2026-20171Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vulnerability6.8
- CVE-2026-32814libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles6.5
- CVE-2026-44197Wagtail: Improper permission handling when comparing revisions6.5
- CVE-2026-45626Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter6.3
- CVE-2026-9305QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection6.3
- CVE-2026-9793Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing5.9
- CVE-2026-27329WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability5.3
- CVE-2026-3073Authorization Bypass Through User-Controlled Key in GitLab4.3
- CVE-2026-32996This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.