CVEs published May 10, 2026
104 CVEs were published on May 10, 2026: 6 critical, 17 high.
- Published
- 104
- Critical
- 6
- High
- 17
- Medium
- 77
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Open5GS
- 10
- PHP Group PHP
- 10
- Industrial Application Software IAS Canias ERP
- 8
- uBidAuction
- 8
- Devs Palace ERP Online
- 6
- Wavlink NU516U1
- 4
- Dotouch XproUPF
- 2
- OpenCart
- 2
- STIGTSP Net::CIDR::Lite
- 2
- 3dady real-time web stats
- 1
Critical 6
- CVE-2021-47940WordPress Download From Files 1.48 Arbitrary File Uploaddownload-from-files Download From Files
- CVE-2021-47936OpenCATS 0.9.4 Remote Code Execution via Resume UploadOpenCATS
- CVE-2021-47933WordPress MStore API 2.0.6 Arbitrary File UploadMStore API
- CVE-2021-47932WordPress TheCartPress 1.5.3.6 Privilege Escalation UnauthenticatedTheCartPress
- CVE-2021-47923OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookieopencart
- CVE-2026-6722Use-After-Free in SOAP using Apache mapPHP Group PHP
High 17
- CVE-2026-8177XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequencesSHLOMIF XML::LibXML
- CVE-2026-45180Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session idsRRWO Catalyst::Plugin::Statsd
- CVE-2021-47949CyberPanel 2.1 Authenticated Remote Code Execution via Symlink AttackCyberPanel
- CVE-2021-47945Argus Surveillance DVR 4.0 Unquoted Service Path Privilege EscalationArgus Surveillance DVR
- CVE-2021-47944memono Notepad 4.2 Denial of Service via Buffer Overflowmemono Notepad
- CVE-2021-47943TextPattern CMS 4.8.7 Remote Code Execution via File UploadTextPattern CMS
- CVE-2021-47941WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss_paramsModalsurvey Survey & Poll
- CVE-2021-47939Evolution CMS 3.1.6 Authenticated Remote Code Execution via Module CreationEvolution CMS
- CVE-2021-47938ImpressCMS 1.4.2 Remote Code Execution via AutotasksImpressCMS
- CVE-2021-47937e107 CMS 2.3.0 Authenticated Remote Code Execution via Theme Uploade107 CMS
- CVE-2021-47935Sentry 8.2.0 Remote Code Execution via Pickle DeserializationSentry
- CVE-2021-47930Balbooa Joomla Forms Builder 2.0.6 SQL Injection UnauthenticatedBalbooa Joomla Forms Builder
- CVE-2021-47928Opencart TMD Vendor System 3.x Blind SQL Injection via product routeopencartextensions Extension TMD Vendor System
- CVE-2022-50944Aero CMS 0.0.1 PHP Code Injection via posts.phpMegaTKC Aero CMS
- CVE-2026-8234EFM ipTIME A8004T WifiBasicSet formWifiBasicSet stack-based overflowEFM ipTIME A8004T
- CVE-2025-14179SQL injection in pdo_firebird via NUL bytes in quoted stringsPHP Group PHP
- CVE-2026-6735XSS within PHP-FPM status endpointPHP Group PHP
Medium, low and unrated 81
- CVE-2026-8254Devs Palace ERP Online sales_save cross site scriptingDevs Palace ERP Online
- CVE-2026-8253Devs Palace ERP Online purchase_save cross site scriptingDevs Palace ERP Online
- CVE-2026-8252Open5GS SMF smf_nsmf_handle_create_data_in_hsmf null pointer dereferenceOpen5GS
- CVE-2026-8251Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of serviceOpen5GS
- CVE-2026-8250Open5GS SMF n4-build.c smf_n4_build_qos_flow_to_modify_list denial of serviceOpen5GS
- CVE-2026-8249Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of serviceOpen5GS
- CVE-2026-8248Open5GS SMF npcf-handler.c update_authorized_pcc_rule_and_qos denial of serviceOpen5GS
- CVE-2026-45191Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypassSTIGTSP Net::CIDR::Lite
- CVE-2026-45190Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypassSTIGTSP Net::CIDR::Lite
- CVE-2026-45179Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addressesRRWO Plack::Middleware::Statsd
- CVE-2021-47953OpenCart 3.0.3.7 Cross-Site Request Forgery via account/passwordOpenCart
- CVE-2021-47951WordPress Picture Gallery 1.4.2 Stored XSS via Edit Content URLpicture-gallery Picture Gallery
- CVE-2021-47950Advanced Guestbook 2.4.4 Persistent XSS via SmiliesAmpps Advanced Guestbook
- CVE-2021-47948WordPress GetPaid Plugin 2.4.6 HTML Injection via Help Textinvoicing Payments Plugin GetPaid
- CVE-2021-47947Projectsend r1295 Stored Cross-Site Scripting via files-edit.phpProjectsend
- CVE-2021-47946OpenCart 3.0.3.6 Account Takeover via Cross Site Request ForgeryOpenCart
- CVE-2021-47931Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS AuthenticationExponentcms Exponent CMS
- CVE-2021-47929WordPress Plugin Filterable Portfolio Gallery 1.0 Stored XSSFilterable-Portfolio Filterable Portfolio Gallery
- CVE-2021-47927WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_nameWpsymposiumpro WP Symposium Pro
- CVE-2021-47926WordPress Contact Form to Email 1.3.24 Stored XSSForm2Email Contact Form to Email
- CVE-2021-47925CMDBuild 3.3.2 Multiple Stored Cross-Site ScriptingCMDBuild
- CVE-2021-47924WordPress Plugin Ultimate Product Catalogue 5.8.2 Stored XSS via priceEtoilewebdesign Ultimate Product Catalogue
- CVE-2021-47922WordPress Plugin Slider by Soliloquy 2.6.2 Stored XSSSoliloquywp Slider by Soliloquy
- CVE-2021-47910WordPress Plugin AccessPress Social Icons 1.8.2 Stored XSSAccesspressthemes AccessPress Social Icons
- CVE-2021-47907Rocket LMS 1.1 Persistent Cross-Site Scripting via Support TicketsRocketsoft Rocket LMS
- CVE-2022-50970WordPress Plugin AAWP 3.16 Reflected XSS via tab ParameterGetaawp WordPress Plugin AAWP
- CVE-2022-50969uBidAuction 2.0.1 mailingLog manage Reflected XSSuBidAuction
- CVE-2022-50968uBidAuction 2.0.1 auctions manage Reflected XSSuBidAuction
- CVE-2022-50967uBidAuction 2.0.1 tickets manage Reflected XSSuBidAuction
- CVE-2022-50966uBidAuction 2.0.1 news manage Reflected XSSuBidAuction
- CVE-2022-50965uBidAuction 2.0.1 posts manage Reflected XSSuBidAuction
- CVE-2022-50964uBidAuction 2.0.1 myAuctions loose Reflected XSSuBidAuction
- CVE-2022-50963uBidAuction 2.0.1 myAuctions active Reflected XSSuBidAuction
- CVE-2022-50962uBidAuction 2.0.1 myOrders Reflected XSSuBidAuction
- CVE-2022-50961WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSSIP2Location Country Blocker
- CVE-2022-50960WordPress International Sms Contact Form 7 Integration 1.2 XSSVarun Sridharan International Sms For Contact Form
- CVE-2022-50959WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.phpwpdevart Contact Form Builder
- CVE-2022-50958WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.phpJetpack
- CVE-2022-50957Drupal avatar_uploader 7.x-1.0-beta8 Reflected XSSavatar_uploader
- CVE-2022-50956WordPress Plugin amministrazione-aperta 3.7.3 Local File Readamministrazione-aperta
- CVE-2022-50955WordPress Plugin Curtain 1.0.2 Cross-site Request ForgeryCurtain
- CVE-2022-50954WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusioncab-fare-calculator
- CVE-2022-50949WordPress Plugin Videos sync PDF 1.7.4 Stored XSSA-J-Evolution Videos sync PDF
- CVE-2022-50948Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site ScriptingMotopress Hotel Booking Lite
- CVE-2022-50947WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSSRadiusTheme Testimonial Slider and Showcase
- CVE-2022-50946WordPress Plugin Netroics Blog Posts Grid 1.0 Stored XSSNetroics Blog Posts Grid
- CVE-2022-50945WordPress 3dady Real-Time Web Stats 1.0 Stored XSS3dady real-time web stats
- CVE-2022-50943Moodle LMS 4.0 Cross-Site Scripting via course search.phpMoodle LMS
- CVE-2026-8244Industrial Application Software IAS Canias ERP Login RMI improper authenticationIndustrial Application Software IAS Canias ERP
- CVE-2026-8243Industrial Application Software IAS Canias ERP JNLP Deployment Endpoint hard-coded keyIndustrial Application Software IAS Canias ERP
- CVE-2026-8242Industrial Application Software IAS Canias ERP Login RMI doAction response discrepancyIndustrial Application Software IAS Canias ERP
- CVE-2026-8241Industrial Application Software IAS Canias ERP RMI iasGetServerInfoEvent improper authorizationIndustrial Application Software IAS Canias ERP
- CVE-2026-45186In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crlibexpat project libexpat
- CVE-2026-82358421bit MiniClaw System kernel.ts resolveSkillScriptPath os command injection8421bit MiniClaw
- CVE-2026-8233Dotouch XproUPF access controlDotouch XproUPF
- CVE-2026-8232Dotouch XproUPF UPF Process libvlib.so vlib_worker_loop denial of serviceDotouch XproUPF
- CVE-2026-8231CodeAstro Online Catering Ordering System deleteorder.php sql injectionCodeAstro Online Catering Ordering System
- CVE-2026-7263DoS attack via DOMNode::C14N()PHP Group PHP
- CVE-2026-6104Global buffer over-read in mb_convert_encoding() with attacker-supplied encodingPHP Group PHP
- CVE-2026-8230Wavlink NU516U1 login.cgi sys_login1 os command injectionWavlink NU516U1
- CVE-2026-7258Out-of-bounds read in urldecode() on NetBSDPHP Group PHP
- CVE-2026-8229Wavlink NU516U1 wireless.cgi WifiBasic os command injectionWavlink NU516U1
- CVE-2026-7259Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()PHP Group PHP
- CVE-2026-7261SoapServer session-persisted object use-after-free via SOAP header faultPHP Group PHP
- CVE-2026-7262NULL pointer dereference in SOAP apache:Map decoder with missing <value>PHP Group PHP
- CVE-2026-8228Wavlink NU516U1 wireless.cgi advance os command injectionWavlink NU516U1
- CVE-2026-8227Wavlink NU516U1 adm.cgi wzdapMesh os command injectionWavlink NU516U1
- CVE-2026-7568Signed integer overflow in metaphone()PHP Group PHP
- CVE-2026-8226Open5GS types.c ogs_pcc_rule_install_flow_from_media denial of serviceOpen5GS
- CVE-2026-8225Open5GS delete Endpoint sm-sm.c pcf_npcf_smpolicycontrol_handle_delete denial of serviceOpen5GS
- CVE-2026-8224Open5GS PCF context.c pcf_sess_set_ipv6prefix denial of serviceOpen5GS
- CVE-2026-8223Open5GS sm-policies Endpoint pcf_sess_sbi_discover_and_send denial of serviceOpen5GS
- CVE-2026-8222Open5GS sm-policies Endpoint nbsf-handler.c pcf_nbsf_management_handle_register denial of serviceOpen5GS
- CVE-2026-8221Devs Palace ERP Online item-save cross site scriptingDevs Palace ERP Online
- CVE-2026-8220Devs Palace ERP Online customer-save cross site scriptingDevs Palace ERP Online
- CVE-2026-8219Devs Palace ERP Online supplier-save cross site scriptingDevs Palace ERP Online
- CVE-2026-8218Devs Palace ERP Online purchase_return_save cross site scriptingDevs Palace ERP Online
- CVE-2026-8217Industrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injectionIndustrial Application Software IAS Canias ERP
- CVE-2026-8216Industrial Application Software IAS Canias ERP Java RMI Session Management iasServerRemoteInterface.doAction improper authenticationIndustrial Application Software IAS Canias ERP
- CVE-2026-8215Industrial Application Software IAS Canias ERP RMI iasRequestFileEvent path traversalIndustrial Application Software IAS Canias ERP
- CVE-2026-8214Industrial Application Software IAS Canias ERP RMI doAction improper authenticationIndustrial Application Software IAS Canias ERP