# CVEs published 2026-05-10

104 CVEs were published on May 10, 2026: 6 critical, 17 high. Days are UTC.

- [CVE-2026-8254](https://cve.now/CVE-2026-8254.md): Devs Palace ERP Online sales\_save cross site scripting (CVSS 4.8, Devs Palace ERP Online)
- [CVE-2026-8253](https://cve.now/CVE-2026-8253.md): Devs Palace ERP Online purchase\_save cross site scripting (CVSS 4.8, Devs Palace ERP Online)
- [CVE-2026-8252](https://cve.now/CVE-2026-8252.md): Open5GS SMF smf\_nsmf\_handle\_create\_data\_in\_hsmf null pointer dereference (CVSS 5.3, Open5GS)
- [CVE-2026-8251](https://cve.now/CVE-2026-8251.md): Open5GS SMF npcf-handler.c update\_authorized\_pcc\_rule\_and\_qos denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8250](https://cve.now/CVE-2026-8250.md): Open5GS SMF n4-build.c smf\_n4\_build\_qos\_flow\_to\_modify\_list denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8249](https://cve.now/CVE-2026-8249.md): Open5GS SMF npcf-handler.c update\_authorized\_pcc\_rule\_and\_qos denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8248](https://cve.now/CVE-2026-8248.md): Open5GS SMF npcf-handler.c update\_authorized\_pcc\_rule\_and\_qos denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8177](https://cve.now/CVE-2026-8177.md): XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences (CVSS 7.5, SHLOMIF XML::LibXML)
- [CVE-2026-45191](https://cve.now/CVE-2026-45191.md): Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass (CVSS 6.5, STIGTSP Net::CIDR::Lite)
- [CVE-2026-45190](https://cve.now/CVE-2026-45190.md): Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass (CVSS 6.5, STIGTSP Net::CIDR::Lite)
- [CVE-2026-45180](https://cve.now/CVE-2026-45180.md): Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids (CVSS 7.5, RRWO Catalyst::Plugin::Statsd)
- [CVE-2026-45179](https://cve.now/CVE-2026-45179.md): Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses (CVSS 5.3, RRWO Plack::Middleware::Statsd)
- [CVE-2021-47953](https://cve.now/CVE-2021-47953.md): OpenCart 3.0.3.7 Cross-Site Request Forgery via account/password (CVSS 5.3, OpenCart)
- [CVE-2021-47951](https://cve.now/CVE-2021-47951.md): WordPress Picture Gallery 1.4.2 Stored XSS via Edit Content URL (CVSS 5.1, picture-gallery Picture Gallery)
- [CVE-2021-47950](https://cve.now/CVE-2021-47950.md): Advanced Guestbook 2.4.4 Persistent XSS via Smilies (CVSS 5.1, Ampps Advanced Guestbook)
- [CVE-2021-47949](https://cve.now/CVE-2021-47949.md): CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack (CVSS 8.7, CyberPanel)
- [CVE-2021-47948](https://cve.now/CVE-2021-47948.md): WordPress GetPaid Plugin 2.4.6 HTML Injection via Help Text (CVSS 5.1, invoicing Payments Plugin GetPaid)
- [CVE-2021-47947](https://cve.now/CVE-2021-47947.md): Projectsend r1295 Stored Cross-Site Scripting via files-edit.php (CVSS 5.1, Projectsend)
- [CVE-2021-47946](https://cve.now/CVE-2021-47946.md): OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery (CVSS 6.9, OpenCart)
- [CVE-2021-47945](https://cve.now/CVE-2021-47945.md): Argus Surveillance DVR 4.0 Unquoted Service Path Privilege Escalation (CVSS 8.5, Argus Surveillance DVR)
- [CVE-2021-47944](https://cve.now/CVE-2021-47944.md): memono Notepad 4.2 Denial of Service via Buffer Overflow (CVSS 8.7, memono Notepad)
- [CVE-2021-47943](https://cve.now/CVE-2021-47943.md): TextPattern CMS 4.8.7 Remote Code Execution via File Upload (CVSS 8.7, TextPattern CMS)
- [CVE-2021-47941](https://cve.now/CVE-2021-47941.md): WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss\_params (CVSS 8.8, Modalsurvey Survey & Poll)
- [CVE-2021-47940](https://cve.now/CVE-2021-47940.md): WordPress Download From Files 1.48 Arbitrary File Upload (CVSS 9.3, download-from-files Download From Files)
- [CVE-2021-47939](https://cve.now/CVE-2021-47939.md): Evolution CMS 3.1.6 Authenticated Remote Code Execution via Module Creation (CVSS 8.7, Evolution CMS)
- [CVE-2021-47938](https://cve.now/CVE-2021-47938.md): ImpressCMS 1.4.2 Remote Code Execution via Autotasks (CVSS 8.7, ImpressCMS)
- [CVE-2021-47937](https://cve.now/CVE-2021-47937.md): e107 CMS 2.3.0 Authenticated Remote Code Execution via Theme Upload (CVSS 8.7, e107 CMS)
- [CVE-2021-47936](https://cve.now/CVE-2021-47936.md): OpenCATS 0.9.4 Remote Code Execution via Resume Upload (CVSS 9.3, OpenCATS)
- [CVE-2021-47935](https://cve.now/CVE-2021-47935.md): Sentry 8.2.0 Remote Code Execution via Pickle Deserialization (CVSS 8.7, Sentry)
- [CVE-2021-47933](https://cve.now/CVE-2021-47933.md): WordPress MStore API 2.0.6 Arbitrary File Upload (CVSS 9.3, MStore API)
- [CVE-2021-47932](https://cve.now/CVE-2021-47932.md): WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated (CVSS 9.3, TheCartPress)
- [CVE-2021-47931](https://cve.now/CVE-2021-47931.md): Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication (CVSS 5.1, Exponentcms Exponent CMS)
- [CVE-2021-47930](https://cve.now/CVE-2021-47930.md): Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated (CVSS 8.8, Balbooa Joomla Forms Builder)
- [CVE-2021-47929](https://cve.now/CVE-2021-47929.md): WordPress Plugin Filterable Portfolio Gallery 1.0 Stored XSS (CVSS 5.1, Filterable-Portfolio Filterable Portfolio Gallery)
- [CVE-2021-47928](https://cve.now/CVE-2021-47928.md): Opencart TMD Vendor System 3.x Blind SQL Injection via product route (CVSS 8.8, opencartextensions Extension TMD Vendor System)
- [CVE-2021-47927](https://cve.now/CVE-2021-47927.md): WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps\_admin\_forum\_add\_name (CVSS 5.1, Wpsymposiumpro WP Symposium Pro)
- [CVE-2021-47926](https://cve.now/CVE-2021-47926.md): WordPress Contact Form to Email 1.3.24 Stored XSS (CVSS 5.1, Form2Email Contact Form to Email)
- [CVE-2021-47925](https://cve.now/CVE-2021-47925.md): CMDBuild 3.3.2 Multiple Stored Cross-Site Scripting (CVSS 5.1, CMDBuild)
- [CVE-2021-47924](https://cve.now/CVE-2021-47924.md): WordPress Plugin Ultimate Product Catalogue 5.8.2 Stored XSS via price (CVSS 5.1, Etoilewebdesign Ultimate Product Catalogue)
- [CVE-2021-47923](https://cve.now/CVE-2021-47923.md): OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie (CVSS 9.3, opencart)
- [CVE-2021-47922](https://cve.now/CVE-2021-47922.md): WordPress Plugin Slider by Soliloquy 2.6.2 Stored XSS (CVSS 5.1, Soliloquywp Slider by Soliloquy)
- [CVE-2021-47910](https://cve.now/CVE-2021-47910.md): WordPress Plugin AccessPress Social Icons 1.8.2 Stored XSS (CVSS 5.1, Accesspressthemes AccessPress Social Icons)
- [CVE-2021-47907](https://cve.now/CVE-2021-47907.md): Rocket LMS 1.1 Persistent Cross-Site Scripting via Support Tickets (CVSS 5.1, Rocketsoft Rocket LMS)
- [CVE-2022-50970](https://cve.now/CVE-2022-50970.md): WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter (CVSS 5.1, Getaawp WordPress Plugin AAWP)
- [CVE-2022-50969](https://cve.now/CVE-2022-50969.md): uBidAuction 2.0.1 mailingLog manage Reflected XSS (CVSS 5.1, uBidAuction)
- [CVE-2022-50968](https://cve.now/CVE-2022-50968.md): uBidAuction 2.0.1 auctions manage Reflected XSS (CVSS 5.1, uBidAuction)
- [CVE-2022-50967](https://cve.now/CVE-2022-50967.md): uBidAuction 2.0.1 tickets manage Reflected XSS (CVSS 5.1, uBidAuction)
- [CVE-2022-50966](https://cve.now/CVE-2022-50966.md): uBidAuction 2.0.1 news manage Reflected XSS (CVSS 5.1, uBidAuction)
- [CVE-2022-50965](https://cve.now/CVE-2022-50965.md): uBidAuction 2.0.1 posts manage Reflected XSS (CVSS 5.1, uBidAuction)
- [CVE-2022-50964](https://cve.now/CVE-2022-50964.md): uBidAuction 2.0.1 myAuctions loose Reflected XSS (CVSS 5.1, uBidAuction)
- [CVE-2022-50963](https://cve.now/CVE-2022-50963.md): uBidAuction 2.0.1 myAuctions active Reflected XSS (CVSS 5.1, uBidAuction)
- [CVE-2022-50962](https://cve.now/CVE-2022-50962.md): uBidAuction 2.0.1 myOrders Reflected XSS (CVSS 5.1, uBidAuction)
- [CVE-2022-50961](https://cve.now/CVE-2022-50961.md): WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS (CVSS 5.1, IP2Location Country Blocker)
- [CVE-2022-50960](https://cve.now/CVE-2022-50960.md): WordPress International Sms Contact Form 7 Integration 1.2 XSS (CVSS 5.1, Varun Sridharan International Sms For Contact Form)
- [CVE-2022-50959](https://cve.now/CVE-2022-50959.md): WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code\_generator.php (CVSS 5.1, wpdevart Contact Form Builder)
- [CVE-2022-50958](https://cve.now/CVE-2022-50958.md): WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php (CVSS 5.1, Jetpack)
- [CVE-2022-50957](https://cve.now/CVE-2022-50957.md): Drupal avatar\_uploader 7.x-1.0-beta8 Reflected XSS (CVSS 5.1, avatar\_uploader)
- [CVE-2022-50956](https://cve.now/CVE-2022-50956.md): WordPress Plugin amministrazione-aperta 3.7.3 Local File Read (CVSS 6.9, amministrazione-aperta)
- [CVE-2022-50955](https://cve.now/CVE-2022-50955.md): WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery (CVSS 5.3, Curtain)
- [CVE-2022-50954](https://cve.now/CVE-2022-50954.md): WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion (CVSS 6.9, cab-fare-calculator)
- [CVE-2022-50949](https://cve.now/CVE-2022-50949.md): WordPress Plugin Videos sync PDF 1.7.4 Stored XSS (CVSS 5.1, A-J-Evolution Videos sync PDF)
- [CVE-2022-50948](https://cve.now/CVE-2022-50948.md): Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting (CVSS 5.1, Motopress Hotel Booking Lite)
- [CVE-2022-50947](https://cve.now/CVE-2022-50947.md): WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSS (CVSS 5.1, RadiusTheme Testimonial Slider and Showcase)
- [CVE-2022-50946](https://cve.now/CVE-2022-50946.md): WordPress Plugin Netroics Blog Posts Grid 1.0 Stored XSS (CVSS 5.1, Netroics Blog Posts Grid)
- [CVE-2022-50945](https://cve.now/CVE-2022-50945.md): WordPress 3dady Real-Time Web Stats 1.0 Stored XSS (CVSS 5.1, 3dady real-time web stats)
- [CVE-2022-50944](https://cve.now/CVE-2022-50944.md): Aero CMS 0.0.1 PHP Code Injection via posts.php (CVSS 8.7, MegaTKC Aero CMS)
- [CVE-2022-50943](https://cve.now/CVE-2022-50943.md): Moodle LMS 4.0 Cross-Site Scripting via course search.php (CVSS 5.1, Moodle LMS)
- [CVE-2026-8244](https://cve.now/CVE-2026-8244.md): Industrial Application Software IAS Canias ERP Login RMI improper authentication (CVSS 6.9, Industrial Application Software IAS Canias ERP)
- [CVE-2026-8243](https://cve.now/CVE-2026-8243.md): Industrial Application Software IAS Canias ERP JNLP Deployment Endpoint hard-coded key (CVSS 6.9, Industrial Application Software IAS Canias ERP)
- [CVE-2026-8242](https://cve.now/CVE-2026-8242.md): Industrial Application Software IAS Canias ERP Login RMI doAction response discrepancy (CVSS 6.3, Industrial Application Software IAS Canias ERP)
- [CVE-2026-8241](https://cve.now/CVE-2026-8241.md): Industrial Application Software IAS Canias ERP RMI iasGetServerInfoEvent improper authorization (CVSS 6.9, Industrial Application Software IAS Canias ERP)
- [CVE-2026-45186](https://cve.now/CVE-2026-45186.md): In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized cr (CVSS 2.9, libexpat project libexpat)
- [CVE-2026-8235](https://cve.now/CVE-2026-8235.md): 8421bit MiniClaw System kernel.ts resolveSkillScriptPath os command injection (CVSS 5.1, 8421bit MiniClaw)
- [CVE-2026-8234](https://cve.now/CVE-2026-8234.md): EFM ipTIME A8004T WifiBasicSet formWifiBasicSet stack-based overflow (CVSS 8.7, EFM ipTIME A8004T)
- [CVE-2026-8233](https://cve.now/CVE-2026-8233.md): Dotouch XproUPF access control (CVSS 2.1, Dotouch XproUPF)
- [CVE-2026-8232](https://cve.now/CVE-2026-8232.md): Dotouch XproUPF UPF Process libvlib.so vlib\_worker\_loop denial of service (CVSS 5.1, Dotouch XproUPF)
- [CVE-2026-8231](https://cve.now/CVE-2026-8231.md): CodeAstro Online Catering Ordering System deleteorder.php sql injection (CVSS 5.3, CodeAstro Online Catering Ordering System)
- [CVE-2026-7263](https://cve.now/CVE-2026-7263.md): DoS attack via DOMNode::C14N() (CVSS 6.3, PHP Group PHP)
- [CVE-2026-6104](https://cve.now/CVE-2026-6104.md): Global buffer over-read in mb\_convert\_encoding() with attacker-supplied encoding (CVSS 6.3, PHP Group PHP)
- [CVE-2026-8230](https://cve.now/CVE-2026-8230.md): Wavlink NU516U1 login.cgi sys\_login1 os command injection (CVSS 5.3, Wavlink NU516U1)
- [CVE-2026-7258](https://cve.now/CVE-2026-7258.md): Out-of-bounds read in urldecode() on NetBSD (CVSS 6.3, PHP Group PHP)
- [CVE-2026-6722](https://cve.now/CVE-2026-6722.md): Use-After-Free in SOAP using Apache map (CVSS 9.5, PHP Group PHP)
- [CVE-2026-8229](https://cve.now/CVE-2026-8229.md): Wavlink NU516U1 wireless.cgi WifiBasic os command injection (CVSS 5.3, Wavlink NU516U1)
- [CVE-2026-7259](https://cve.now/CVE-2026-7259.md): Null pointer dereference in php\_mb\_check\_encoding() via mb\_ereg\_search\_init() (CVSS 2.1, PHP Group PHP)
- [CVE-2026-7261](https://cve.now/CVE-2026-7261.md): SoapServer session-persisted object use-after-free via SOAP header fault (CVSS 6.3, PHP Group PHP)
- [CVE-2026-7262](https://cve.now/CVE-2026-7262.md): NULL pointer dereference in SOAP apache:Map decoder with missing \<value\> (CVSS 2.9, PHP Group PHP)
- [CVE-2026-8228](https://cve.now/CVE-2026-8228.md): Wavlink NU516U1 wireless.cgi advance os command injection (CVSS 5.3, Wavlink NU516U1)
- [CVE-2025-14179](https://cve.now/CVE-2025-14179.md): SQL injection in pdo\_firebird via NUL bytes in quoted strings (CVSS 7.4, PHP Group PHP)
- [CVE-2026-8227](https://cve.now/CVE-2026-8227.md): Wavlink NU516U1 adm.cgi wzdapMesh os command injection (CVSS 5.3, Wavlink NU516U1)
- [CVE-2026-7568](https://cve.now/CVE-2026-7568.md): Signed integer overflow in metaphone() (CVSS 6.3, PHP Group PHP)
- [CVE-2026-8226](https://cve.now/CVE-2026-8226.md): Open5GS types.c ogs\_pcc\_rule\_install\_flow\_from\_media denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-6735](https://cve.now/CVE-2026-6735.md): XSS within PHP-FPM status endpoint (CVSS 7.3, PHP Group PHP)
- [CVE-2026-8225](https://cve.now/CVE-2026-8225.md): Open5GS delete Endpoint sm-sm.c pcf\_npcf\_smpolicycontrol\_handle\_delete denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-8224](https://cve.now/CVE-2026-8224.md): Open5GS PCF context.c pcf\_sess\_set\_ipv6prefix denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-8223](https://cve.now/CVE-2026-8223.md): Open5GS sm-policies Endpoint pcf\_sess\_sbi\_discover\_and\_send denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-8222](https://cve.now/CVE-2026-8222.md): Open5GS sm-policies Endpoint nbsf-handler.c pcf\_nbsf\_management\_handle\_register denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-8221](https://cve.now/CVE-2026-8221.md): Devs Palace ERP Online item-save cross site scripting (CVSS 4.8, Devs Palace ERP Online)
- [CVE-2026-8220](https://cve.now/CVE-2026-8220.md): Devs Palace ERP Online customer-save cross site scripting (CVSS 4.8, Devs Palace ERP Online)
- [CVE-2026-8219](https://cve.now/CVE-2026-8219.md): Devs Palace ERP Online supplier-save cross site scripting (CVSS 4.8, Devs Palace ERP Online)
- [CVE-2026-8218](https://cve.now/CVE-2026-8218.md): Devs Palace ERP Online purchase\_return\_save cross site scripting (CVSS 4.8, Devs Palace ERP Online)
- [CVE-2026-8217](https://cve.now/CVE-2026-8217.md): Industrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injection (CVSS 5.3, Industrial Application Software IAS Canias ERP)
- [CVE-2026-8216](https://cve.now/CVE-2026-8216.md): Industrial Application Software IAS Canias ERP Java RMI Session Management iasServerRemoteInterface.doAction improper authentication (CVSS 6.9, Industrial Application Software IAS Canias ERP)
- [CVE-2026-8215](https://cve.now/CVE-2026-8215.md): Industrial Application Software IAS Canias ERP RMI iasRequestFileEvent path traversal (CVSS 6.9, Industrial Application Software IAS Canias ERP)
- [CVE-2026-8214](https://cve.now/CVE-2026-8214.md): Industrial Application Software IAS Canias ERP RMI doAction improper authentication (CVSS 6.9, Industrial Application Software IAS Canias ERP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.