# CVEs published 2026-05-02

74 CVEs were published on May 2, 2026: 2 critical, 24 high. Days are UTC.

- [CVE-2026-7671](https://cve.now/CVE-2026-7671.md): CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication (CVSS 6.3, CodeWise Tornet Scooter Mobile App)
- [CVE-2026-7670](https://cve.now/CVE-2026-7670.md): Jinher OA UserSel.aspx sql injection (CVSS 6.9, Jinher OA)
- [CVE-2026-7669](https://cve.now/CVE-2026-7669.md): sgl-project SGLang HuggingFace Transformer hf\_transformers\_utils.py get\_tokenizer code injection (CVSS 6.3, sgl-project SGLang · sglang)
- [CVE-2026-7668](https://cve.now/CVE-2026-7668.md): MikroTik RouterOS SCEP Endpoint scep.p ASN1\_STRING\_data out-of-bounds (CVSS 6.9, MikroTik RouterOS)
- [CVE-2026-7653](https://cve.now/CVE-2026-7653.md): r-huijts mcp-server-rijksmuseum MCP index.ts open\_image\_in\_browser os command injection (CVSS 5.3, r-huijts mcp-server-rijksmuseum)
- [CVE-2026-7645](https://cve.now/CVE-2026-7645.md): ruvnet sublinear-time-solver MCP server.js export\_state path traversal (CVSS 6.9, ruvnet sublinear-time-solver · sublinear-time-solver)
- [CVE-2026-7644](https://cve.now/CVE-2026-7644.md): ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization (CVSS 6.9, ChatGPTNextWeb NextChat)
- [CVE-2026-7643](https://cve.now/CVE-2026-7643.md): ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy (CVSS 5.3, ChatGPTNextWeb NextChat)
- [CVE-2026-7642](https://cve.now/CVE-2026-7642.md): pskill9 website-downloader MCP index.ts download\_website os command injection (CVSS 5.3, pskill9 website-downloader)
- [CVE-2026-7633](https://cve.now/CVE-2026-7633.md): Totolink N300RH cstecgi.cgi setUploadSetting file inclusion (CVSS 6.9, Totolink N300RH)
- [CVE-2026-7632](https://cve.now/CVE-2026-7632.md): code-projects Online Hospital Management System viewappointment.php sql injection (CVSS 6.9, code-projects Online Hospital Management System)
- [CVE-2026-7631](https://cve.now/CVE-2026-7631.md): code-projects Online Hospital Management System Registration improper authorization (CVSS 5.3, code-projects Online Hospital Management System)
- [CVE-2026-0703](https://cve.now/CVE-2026-0703.md): NextMove Lite - Thank You Page for WooCommerce \<= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty\_current\_date' Shortcode (CVSS 6.4, xlplugins NextMove Lite – Thank You Page for WooCommerce)
- [CVE-2026-2554](https://cve.now/CVE-2026-2554.md): WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible \<= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion (CVSS 8.1, wclovers WCFM – Frontend Manager for WooCommerce)
- [CVE-2026-3504](https://cve.now/CVE-2026-3504.md): Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \<= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint (CVSS 5.3, dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…)
- [CVE-2026-7630](https://cve.now/CVE-2026-7630.md): innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication (CVSS 6.9, innocommerce InnoShop)
- [CVE-2026-7629](https://cve.now/CVE-2026-7629.md): kleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injection (CVSS 5.3, kleneway awesome-cursor-mpc-server)
- [CVE-2026-7628](https://cve.now/CVE-2026-7628.md): crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection (CVSS 5.3, crazyrabbitLTC mcp-code-review-server)
- [CVE-2026-6525](https://cve.now/CVE-2026-6525.md): NULL Pointer Dereference in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-6817](https://cve.now/CVE-2026-6817.md): Quiz Maker by AYS \<= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate\_reason' (CVSS 5.8, ays-pro Quiz Maker by AYS)
- [CVE-2026-6320](https://cve.now/CVE-2026-6320.md): Salon Booking System – Free Version \<= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal (CVSS 7.5, wordpresschef Salon Booking System – Free Version)
- [CVE-2026-4061](https://cve.now/CVE-2026-4061.md): Geo Mashup \<= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map\_post\_type' Parameter (CVSS 7.5, cyberhobo Geo Mashup)
- [CVE-2026-4790](https://cve.now/CVE-2026-4790.md): Premium Addons for Elementor \<= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom\_svg' Parameter (CVSS 5.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2026-4062](https://cve.now/CVE-2026-4062.md): Geo Mashup \<= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object\_ids' Parameter (CVSS 7.5, cyberhobo Geo Mashup)
- [CVE-2026-4100](https://cve.now/CVE-2026-4100.md): Paid Memberships Pro \<= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption (CVSS 7.1, strangerstudios Paid Memberships Pro – Content Restriction,…)
- [CVE-2026-4060](https://cve.now/CVE-2026-4060.md): Geo Mashup \<= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter (CVSS 7.5, cyberhobo Geo Mashup)
- [CVE-2026-7627](https://cve.now/CVE-2026-7627.md): 8nite metatrader-4-mcp sync\_ea\_from\_file index.ts CallToolRequestSchema path traversal (CVSS 5.3, 8nite metatrader-4-mcp)
- [CVE-2026-7612](https://cve.now/CVE-2026-7612.md): itsourcecode Courier Management System edit\_user.php sql injection (CVSS 5.1, itsourcecode Courier Management System)
- [CVE-2026-7611](https://cve.now/CVE-2026-7611.md): TRENDnet TEW-821DAP Firmware Update cameo\_dev.sh platform\_do\_upgrade\_cameo\_dev data authenticity (CVSS 6.3, TRENDnet TEW-821DAP)
- [CVE-2026-5077](https://cve.now/CVE-2026-5077.md): Total \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute (CVSS 5.4, hashthemes Total)
- [CVE-2026-7610](https://cve.now/CVE-2026-7610.md): TRENDnet TEW-821DAP Firmware Update ssi cleartext transmission (CVSS 6.3, TRENDnet TEW-821DAP)
- [CVE-2026-7491](https://cve.now/CVE-2026-7491.md): Zyosoft｜School App - Insecure Direct Object Reference (CVSS 8.6, Zyosoft School App)
- [CVE-2026-7490](https://cve.now/CVE-2026-7490.md): Sunnet｜CTMS and CPAS - Arbitrary File Upload (CVSS 8.6, Sunnet CTMS · Sunnet CPAS)
- [CVE-2026-7489](https://cve.now/CVE-2026-7489.md): Sunnet｜CTMS - SQL Injection (CVSS 8.7, Sunnet CTMS)
- [CVE-2026-7609](https://cve.now/CVE-2026-7609.md): TRENDnet TEW-821DAP Firmware Udpate diagnostic tools\_diagnostic os command injection (CVSS 5.3, TRENDnet TEW-821DAP)
- [CVE-2026-7608](https://cve.now/CVE-2026-7608.md): TRENDnet TEW-821DAP tools\_diagnostic os command injection (CVSS 5.1, TRENDnet TEW-821DAP)
- [CVE-2026-5324](https://cve.now/CVE-2026-5324.md): Brizy – Page Builder \<= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value (CVSS 7.2, themefusecom Brizy – Page Builder)
- [CVE-2026-4024](https://cve.now/CVE-2026-4024.md): Royal Addons for Elementor \<= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification (CVSS 5.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-6229](https://cve.now/CVE-2026-6229.md): Royal Addons for Elementor \<= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter (CVSS 7.2, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-6457](https://cve.now/CVE-2026-6457.md): Geo Mashup \<= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo\_mashup\_null\_fields' Parameter (CVSS 6.5, cyberhobo Geo Mashup)
- [CVE-2026-6449](https://cve.now/CVE-2026-6449.md): Booking for Appointments and Events Calendar – Amelia \<= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint (CVSS 5.3, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2026-2052](https://cve.now/CVE-2026-2052.md): Widget Options \<= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic (CVSS 8.8, marketingfire Widget Options – Advanced Conditional Visibil…)
- [CVE-2026-4650](https://cve.now/CVE-2026-4650.md): FundPress \<= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate\_action\_status AJAX Handler (CVSS 5.3, thimpress FundPress – WordPress Donation Plugin)
- [CVE-2026-7607](https://cve.now/CVE-2026-7607.md): TRENDnet TEW-821DAP Firmware Udpate auto\_update\_firmware buffer overflow (CVSS 8.7, TRENDnet TEW-821DAP)
- [CVE-2026-7606](https://cve.now/CVE-2026-7606.md): TRENDnet TEW-821DAP Firmware Update new\_gui\_update\_firmware data authenticity (CVSS 6.3, TRENDnet TEW-821DAP)
- [CVE-2026-7649](https://cve.now/CVE-2026-7649.md): ARMember \<= 4.0.60 - Unauthenticated SQL Injection via 'orderby' Parameter (CVSS 7.5, reputeinfosystems ARMember – Membership Plugin, Content Res…)
- [CVE-2026-7605](https://cve.now/CVE-2026-7605.md): JeecgBoot uploadImgByHttpEndpoint CommonController.java HttpFileToMultipartFileUtil.downloadImageData server-side request forgery (CVSS 5.3, JeecgBoot)
- [CVE-2026-43058](https://cve.now/CVE-2026-43058.md): media: vidtv: fix pass-by-value structs causing MSAN warnings (no CVSS, Linux)
- [CVE-2026-5110](https://cve.now/CVE-2026-5110.md): Gravity Forms \<= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater (CVSS 7.2, Gravity Forms)
- [CVE-2026-7647](https://cve.now/CVE-2026-7647.md): Profile Builder Pro \<= 3.14.5 - Unauthenticated PHP Object Injection (CVSS 8.1, Cozmoslabs Profile Builder Pro)
- [CVE-2026-5111](https://cve.now/CVE-2026-5111.md): Gravity Forms \<= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater (CVSS 7.2, Gravity Forms)
- [CVE-2026-6447](https://cve.now/CVE-2026-6447.md): Call for Price for WooCommerce \<= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings (CVSS 4.4, tychesoftwares Call for Price for WooCommerce)
- [CVE-2026-5109](https://cve.now/CVE-2026-5109.md): Gravity Forms \<= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option (CVSS 7.2, Gravity Forms)
- [CVE-2026-5112](https://cve.now/CVE-2026-5112.md): Gravity Forms \<= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater (CVSS 7.2, Gravity Forms)
- [CVE-2026-5113](https://cve.now/CVE-2026-5113.md): Gravity Forms \<= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input (CVSS 7.2, Gravity Forms)
- [CVE-2026-6916](https://cve.now/CVE-2026-6916.md): Jeg Kit for Elementor \<= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg\_content\_number\_prefix' Shortcode Attribute (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2026-7049](https://cve.now/CVE-2026-7049.md): PixelYourSite Pro \<= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls\[\]' Parameter (CVSS 7.2, PixelYourSite Pro – Your smart PIXEL (TAG) Manager)
- [CVE-2026-6812](https://cve.now/CVE-2026-6812.md): Ona \<= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download\_link' Parameter (CVSS 4.4, deothemes Ona)
- [CVE-2026-7604](https://cve.now/CVE-2026-7604.md): JeecgBoot OpenApi Service OpenApiController.java OpenApiController.call server-side request forgery (CVSS 5.3, JeecgBoot)
- [CVE-2026-4882](https://cve.now/CVE-2026-4882.md): User Registration Advanced Fields \<= 1.6.20 - Unauthenticated Arbitrary File Upload (CVSS 9.8, WPEverest User Registration Advanced Fields)
- [CVE-2026-6446](https://cve.now/CVE-2026-6446.md): My Social Feeds \<= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp\_get\_accounts' AJAX Action (CVSS 5.4, bplugins My Social Feeds – Social Feeds Embedder Plugin for…)
- [CVE-2026-6963](https://cve.now/CVE-2026-6963.md): WP Mail Gateway \<= 1.8 - Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg\_save\_provider\_config' AJAX Action (CVSS 8.8, shahariaazam WP Mail Gateway)
- [CVE-2025-14726](https://cve.now/CVE-2025-14726.md): Widgets for Social Photo Feed \<= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex\_feed\_hook\_instagram REST API endpoints (CVSS 6.5, trustindex Widgets for Social Photo Feed)
- [CVE-2026-4658](https://cve.now/CVE-2026-4658.md): Gutenberg Essential Blocks \<= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2026-7641](https://cve.now/CVE-2026-7641.md): Import and export users and customers \<= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields (CVSS 8.8, carazo Import and export users and customers)
- [CVE-2026-7458](https://cve.now/CVE-2026-7458.md): User Verification by PickPlugins \<= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint (CVSS 9.8, User Verification by PickPlugins)
- [CVE-2026-7603](https://cve.now/CVE-2026-7603.md): JeecgBoot LoadFile Endpoint FileDownloadUtils.jav checkPathTraversalBatch server-side request forgery (CVSS 5.3, JeecgBoot)
- [CVE-2026-7209](https://cve.now/CVE-2026-7209.md): Simple Link Directory \<= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, quantumcloud Simple Link Directory)
- [CVE-2026-7638](https://cve.now/CVE-2026-7638.md): App Builder \<= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user\_id' Parameter (CVSS 5.3, appcheap App Builder – Create Native Android & iOS Apps On…)
- [CVE-2026-6378](https://cve.now/CVE-2026-6378.md): Maxi Blocks \<= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API (CVSS 6.4, ckp267 MaxiBlocks Builder | 17,000+ Design Assets, Patterns…)
- [CVE-2026-7602](https://cve.now/CVE-2026-7602.md): JeecgBoot FillRuleUtil edit improper authorization (CVSS 5.3, JeecgBoot)
- [CVE-2026-7601](https://cve.now/CVE-2026-7601.md): Open5GS AMF gmm-handler.c denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-43824](https://cve.now/CVE-2026-43824.md): In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. (CVSS 7.7, argoproj Argo CD · github.com/argoproj/argo-cd/v3 +2)
- [CVE-2026-7600](https://cve.now/CVE-2026-7600.md): ArtMin96 yii2-mcp-server MCP index.ts yii\_execute\_command os command injection (CVSS 5.3, ArtMin96 yii2-mcp-server · yii2-mcp-server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.