CVEs published May 2, 2026
74 CVEs were published on May 2, 2026: 2 critical, 24 high.
- Published
- 74
- Critical
- 2
- High
- 24
- Medium
- 47
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- TRENDnet TEW-821DAP
- 6
- Gravity Forms
- 5
- cyberhobo Geo Mashup
- 4
- JeecgBoot
- 4
- ChatGPTNextWeb NextChat
- 2
- code-projects Online Hospital Management System
- 2
- wproyal Royal Addons for Elementor – Addons and Templates K…
- 2
- 8nite metatrader-4-mcp
- 1
- ameliabooking Booking for Appointments and Events Calendar…
- 1
- appcheap App Builder – Create Native Android & iOS Apps On…
- 1
Critical 2
- CVE-2026-4882User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File UploadWPEverest User Registration Advanced Fields
- CVE-2026-7458User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API EndpointUser Verification by PickPlugins
High 24
- CVE-2026-2554WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletionwclovers WCFM – Frontend Manager for WooCommerce
- CVE-2026-6320Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversalwordpresschef Salon Booking System – Free Version
- CVE-2026-4061Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parametercyberhobo Geo Mashup
- CVE-2026-4062Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parametercyberhobo Geo Mashup
- CVE-2026-4100Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruptionstrangerstudios Paid Memberships Pro – Content Restriction,…
- CVE-2026-4060Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parametercyberhobo Geo Mashup
- CVE-2026-7491Zyosoft｜School App - Insecure Direct Object ReferenceZyosoft School App
- CVE-2026-7490Sunnet｜CTMS and CPAS - Arbitrary File UploadSunnet CTMS · Sunnet CPAS
- CVE-2026-7489Sunnet｜CTMS - SQL InjectionSunnet CTMS
- CVE-2026-5324Brizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Valuethemefusecom Brizy – Page Builder
- CVE-2026-6229Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameterwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-2052Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logicmarketingfire Widget Options – Advanced Conditional Visibil…
- CVE-2026-7607TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflowTRENDnet TEW-821DAP
- CVE-2026-7649ARMember <= 4.0.60 - Unauthenticated SQL Injection via 'orderby' Parameterreputeinfosystems ARMember – Membership Plugin, Content Res…
- CVE-2026-5110Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside RepeaterGravity Forms
- CVE-2026-7647Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object InjectionCozmoslabs Profile Builder Pro
- CVE-2026-5111Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in RepeaterGravity Forms
- CVE-2026-5109Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product OptionGravity Forms
- CVE-2026-5112Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in RepeaterGravity Forms
- CVE-2026-5113Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden InputGravity Forms
- CVE-2026-7049PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' ParameterPixelYourSite Pro – Your smart PIXEL (TAG) Manager
- CVE-2026-6963WP Mail Gateway <= 1.8 - Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg_save_provider_config' AJAX Actionshahariaazam WP Mail Gateway
- CVE-2026-7641Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fieldscarazo Import and export users and customers
- CVE-2026-43824In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.argoproj Argo CD · github.com/argoproj/argo-cd/v3 +2
Medium, low and unrated 48
- CVE-2026-7671CodeWise Tornet Scooter Mobile App TwoFactor excessive authenticationCodeWise Tornet Scooter Mobile App
- CVE-2026-7670Jinher OA UserSel.aspx sql injectionJinher OA
- CVE-2026-7669sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injectionsgl-project SGLang · sglang
- CVE-2026-7668MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-boundsMikroTik RouterOS
- CVE-2026-7653r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injectionr-huijts mcp-server-rijksmuseum
- CVE-2026-7645ruvnet sublinear-time-solver MCP server.js export_state path traversalruvnet sublinear-time-solver · sublinear-time-solver
- CVE-2026-7644ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorizationChatGPTNextWeb NextChat
- CVE-2026-7643ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyChatGPTNextWeb NextChat
- CVE-2026-7642pskill9 website-downloader MCP index.ts download_website os command injectionpskill9 website-downloader
- CVE-2026-7633Totolink N300RH cstecgi.cgi setUploadSetting file inclusionTotolink N300RH
- CVE-2026-7632code-projects Online Hospital Management System viewappointment.php sql injectioncode-projects Online Hospital Management System
- CVE-2026-7631code-projects Online Hospital Management System Registration improper authorizationcode-projects Online Hospital Management System
- CVE-2026-0703NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcodexlplugins NextMove Lite – Thank You Page for WooCommerce
- CVE-2026-3504Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpointdokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…
- CVE-2026-7630innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authenticationinnocommerce InnoShop
- CVE-2026-7629kleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injectionkleneway awesome-cursor-mpc-server
- CVE-2026-7628crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injectioncrazyrabbitLTC mcp-code-review-server
- CVE-2026-6525NULL Pointer Dereference in WiresharkWireshark Foundation Wireshark
- CVE-2026-6817Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'ays-pro Quiz Maker by AYS
- CVE-2026-4790Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameterleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2026-76278nite metatrader-4-mcp sync_ea_from_file index.ts CallToolRequestSchema path traversal8nite metatrader-4-mcp
- CVE-2026-7612itsourcecode Courier Management System edit_user.php sql injectionitsourcecode Courier Management System
- CVE-2026-7611TRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticityTRENDnet TEW-821DAP
- CVE-2026-5077Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attributehashthemes Total
- CVE-2026-7610TRENDnet TEW-821DAP Firmware Update ssi cleartext transmissionTRENDnet TEW-821DAP
- CVE-2026-7609TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injectionTRENDnet TEW-821DAP
- CVE-2026-7608TRENDnet TEW-821DAP tools_diagnostic os command injectionTRENDnet TEW-821DAP
- CVE-2026-4024Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modificationwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-6457Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parametercyberhobo Geo Mashup
- CVE-2026-6449Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpointameliabooking Booking for Appointments and Events Calendar…
- CVE-2026-4650FundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handlerthimpress FundPress – WordPress Donation Plugin
- CVE-2026-7606TRENDnet TEW-821DAP Firmware Update new_gui_update_firmware data authenticityTRENDnet TEW-821DAP
- CVE-2026-7605JeecgBoot uploadImgByHttpEndpoint CommonController.java HttpFileToMultipartFileUtil.downloadImageData server-side request forgeryJeecgBoot
- CVE-2026-43058media: vidtv: fix pass-by-value structs causing MSAN warningsLinux
- CVE-2026-6447Call for Price for WooCommerce <= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settingstychesoftwares Call for Price for WooCommerce
- CVE-2026-6916Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attributejegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2026-6812Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameterdeothemes Ona
- CVE-2026-7604JeecgBoot OpenApi Service OpenApiController.java OpenApiController.call server-side request forgeryJeecgBoot
- CVE-2026-6446My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Actionbplugins My Social Feeds – Social Feeds Embedder Plugin for…
- CVE-2025-14726Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpointstrustindex Widgets for Social Photo Feed
- CVE-2026-4658Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributeswpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2026-7603JeecgBoot LoadFile Endpoint FileDownloadUtils.jav checkPathTraversalBatch server-side request forgeryJeecgBoot
- CVE-2026-7209Simple Link Directory <= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesquantumcloud Simple Link Directory
- CVE-2026-7638App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameterappcheap App Builder – Create Native Android & iOS Apps On…
- CVE-2026-6378Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST APIckp267 MaxiBlocks Builder | 17,000+ Design Assets, Patterns…
- CVE-2026-7602JeecgBoot FillRuleUtil edit improper authorizationJeecgBoot
- CVE-2026-7601Open5GS AMF gmm-handler.c denial of serviceOpen5GS
- CVE-2026-7600ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injectionArtMin96 yii2-mcp-server · yii2-mcp-server