CVEs published May 3, 2026
44 CVEs were published on May 3, 2026: 0 critical, 5 high.
- Published
- 44
- Critical
- 0
- High
- 5
- Medium
- 38
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Open5GS
- 3
- Wavlink WL-WN570HA1
- 3
- YunaiV yudao-cloud
- 3
- Acrel Electrical EEMS Enterprise Power Operation and Mainte…
- 2
- AV Stumpfl Pixera Two Media Server
- 2
- Dolibarr ERP CRM · dolibarr/dolibarr
- 2
- Edimax BR-6208AC
- 2
- Edimax BR-6428nC
- 2
- jsbroks COCO Annotator
- 2
- kerwincui FastBee
- 2
High 5
- CVE-2026-7685Edimax BR-6208AC setWAN buffer overflowEdimax BR-6208AC
- CVE-2026-7684Edimax BR-6428nC setWAN buffer overflowEdimax BR-6428nC
- CVE-2026-5063NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Nameswebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-7675Shenzhen Libituo Technology LBT-T300-HW1 apply.cgi start_lan buffer overflowShenzhen Libituo Technology LBT-T300-HW1
- CVE-2026-7674Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflowShenzhen Libituo Technology LBT-T300-HW1
Medium, low and unrated 39
- CVE-2026-6948Unbounded Memory Allocation in VQLResponse Result-Set WriterRapid7 Velociraptor
- CVE-2026-7712MindsDB Pickle pickle.loads deserializationMindsDB
- CVE-2026-7711MindsDB Engine proc_wrapper.py exec unrestricted uploadMindsDB
- CVE-2026-7710YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authenticationYunaiV yudao-cloud
- CVE-2026-7709janeczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorizationjaneczku Calibre-Web
- CVE-2026-7708Open5GS UDR subscription.c ogs_dbi_subscription_data denial of serviceOpen5GS
- CVE-2026-7707Open5GS UDR nudr-handler.c udr_nudr_dr_handle_subscription_context denial of serviceOpen5GS
- CVE-2026-7706Open5GS AMF gmm-handler.c gmm_handle_service_request denial of serviceOpen5GS
- CVE-2026-7705JD Cloud JDCOS Service jdcap set_iptv_info command injectionJD Cloud JDCOS
- CVE-2026-7704AV Stumpfl Pixera Two Media Server Service Port 1338 path traversalAV Stumpfl Pixera Two Media Server
- CVE-2026-7703AV Stumpfl Pixera Two Media Server Websocket API code injectionAV Stumpfl Pixera Two Media Server
- CVE-2026-7702toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorizationtoeverything AFFiNE
- CVE-2026-7701Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceTelegram Desktop
- CVE-2026-7700langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injectionlangflow-ai langflow · langflow
- CVE-2026-7699Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injectionDromara MaxKey
- CVE-2026-7698Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injectionTiandy Easy7 Integrated Management Platform
- CVE-2026-7697AMTT Hotel Broadband Operation System cardhand_submit.php sql injectionAMTT Hotel Broadband Operation System
- CVE-2026-7696Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted uploadAcrel Electrical EEMS Enterprise Power Operation and Mainte…
- CVE-2026-7695Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform elecMaxMinAvgValue sql injectionAcrel Electrical EEMS Enterprise Power Operation and Mainte…
- CVE-2026-7694Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injectionAcrel Electrical ECEMS Enterprise Microgrid Energy Efficien…
- CVE-2026-7692Wavlink WL-WN570HA1 adm.cgi ping_ddns command injectionWavlink WL-WN570HA1
- CVE-2026-7691Wavlink WL-WN570HA1 adm.cgi set_sys_cmd command injectionWavlink WL-WN570HA1
- CVE-2026-7690Wavlink WL-WN570HA1 adm.cgi set_sys_adm command injectionWavlink WL-WN570HA1
- CVE-2026-7689Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verificationDolibarr ERP CRM · dolibarr/dolibarr
- CVE-2026-7688Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injectionDolibarr ERP CRM · dolibarr/dolibarr
- CVE-2026-7687langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injectionlangflow-ai langflow
- CVE-2026-7686eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access controleyeo Adblock Plus
- CVE-2026-7683Edimax BR-6428nC Web setWAN command injectionEdimax BR-6428nC
- CVE-2026-7682Edimax BR-6208AC L2TP Mode setWAN command injectionEdimax BR-6208AC
- CVE-2026-5337Frontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDORFrontend File Manager Plugin
- CVE-2026-7681jsbroks COCO Annotator Dataset API datasets.py authorizationjsbroks COCO Annotator
- CVE-2026-7680jsbroks COCO Annotator Data Endpoint datasets.py path traversaljsbroks COCO Annotator
- CVE-2026-7679YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authenticationYunaiV yudao-cloud
- CVE-2026-7678YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injectionYunaiV yudao-cloud
- CVE-2026-7677kerwincui FastBee System Notice SysNoticeController.java add cross site scriptingkerwincui FastBee
- CVE-2026-7676kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversalkerwincui FastBee
- CVE-2026-7673crmeb_java Admin Upload UploadServiceImpl.java unrestricted uploadcrmeb_java
- CVE-2026-40561Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header PrecedenceKAZUHO Starlet
- CVE-2026-7672youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injectionyoulaitech youlai-boot