CVEs published May 16, 2026
48 CVEs were published on May 16, 2026: 3 critical, 25 high.
- Published
- 48
- Critical
- 3
- High
- 25
- Medium
- 20
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- bloofoxCMS
- 1
- Cmsmadesimple CMS Made Simple
- 1
- Codekernel Queue Management System
- 1
- color-notes Color Notes
- 1
- Composr CMS
- 1
- Cookielawinfo Cookie Law Bar
- 1
- CouchCMS
- 1
- Cybertronsoft Privacy Drive
- 1
- denx U-Boot
- 1
- EgavilanMedia PHPCRUD
- 1
Critical 3
High 25
- CVE-2026-46728Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.denx U-Boot
- CVE-2021-47977WordPress Anti-Malware Security Bruteforce Firewall <= 4.20.72 Directory TraversalGotmls Malware Security and Bruteforce Firewall
- CVE-2021-47942Home Assistant Community Store 1.10.0 Path Traversal Account TakeoverHome-Assistant Home Assistant Community Store
- CVE-2021-47980Fuel CMS 1.4.13 Blind SQL Injection via col ParameterGetfuelcms Fuel CMS
- CVE-2021-47979WordPress Plugin Backup and Restore 1.0.3 Arbitrary File DeletionMiniorange Backup and Restore
- CVE-2021-47976TextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin UploadTextPattern CMS
- CVE-2021-47974VX Search 13.5.28 Unquoted Service Path Privilege EscalationVxsearch VX Search
- CVE-2021-47973Sticky Notes Widget 3.0.6 Denial of Service via Buffer Overflowsticky-notes Sticky Notes Widget
- CVE-2021-47972Sticky Notes & Color Widgets 1.4.2 Denial of Servicesticky-notes-color-widgets Sticky Notes Color Widgets
- CVE-2021-47971My Notes Safe 5.3 Denial of Service via Buffer Overflowmy-notes-safe My Notes Safe
- CVE-2021-47970Macaron Notes 5.5 Denial of Service via Buffer OverflowMacaron Notes
- CVE-2021-47969Color Notes 1.4 Denial of Service via Long Character Stringcolor-notes Color Notes
- CVE-2021-47956EgavilanMedia PHPCRUD 1.0 SQL Injection via firstnameEgavilanMedia PHPCRUD
- CVE-2021-47954LayerBB 1.1.4 SQL Injection via search_query ParameterLayerBB
- CVE-2020-37247Kite 4.2.0.1 U1 Unquoted Service Path Privilege EscalationKite
- CVE-2020-37245WordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSSSupsystic Digital Publications
- CVE-2020-37244WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidxSupsystic Membership
- CVE-2020-37243WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSSSupsystic Pricing Table
- CVE-2020-37242WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidxSupsystic Ultimate Maps
- CVE-2020-37232Advanced System Care Service 13.0.0.157 Unquoted Service Path Privilege EscalationIobit Advanced System Care Service
- CVE-2020-37231Privacy Drive 3.17.0 Unquoted Service Path Privilege EscalationCybertronsoft Privacy Drive
- CVE-2020-37230Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege EscalationSyncplify.me Server!
- CVE-2020-37229OKI sPSV Port Manager 1.0.41 Unquoted Service Path Privilege EscalationOKI sPSV Port Manager
- CVE-2020-37227WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File UploadHeliossolutions HS Brand Logo Slider
- CVE-2026-8657Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/forjsondiffpatch · org.webjars.npm:jsondiffpatch
Medium, low and unrated 20
- CVE-2026-8723qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnlyljharb qs · qs
- CVE-2021-47978ProcessMaker 3.5.4 Local File Inclusion via Path TraversalProcessMaker
- CVE-2020-37241bloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user addbloofoxCMS
- CVE-2021-47981Quick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders FormOpensolution Quick.CMS
- CVE-2021-47975WordPress Plugin WP Learn Manager 1.1.2 Stored XSSWplearnmanager WP Learn Manager
- CVE-2021-47957WordPress Plugin Cookie Law Bar 1.2.1 Stored XSS via clb_bar_msgCookielawinfo Cookie Law Bar
- CVE-2021-47955CouchCMS 2.2.1 Cross-Site Scripting via SVG File UploadCouchCMS
- CVE-2021-47934MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRFMyBB Timeline Plugin
- CVE-2020-37246WordPress Plugin Supsystic Backup 2.3.9 Local File InclusionSupsystic Backup
- CVE-2020-37240Queue Management System 4.0.0 Stored XSS via Add UserCodekernel Queue Management System
- CVE-2020-37238CMS Made Simple 2.2.15 Stored XSS via SVG File UploadCmsmadesimple CMS Made Simple
- CVE-2020-37237Composr CMS 10.0.34 Persistent Cross-Site Scripting via bannersComposr CMS
- CVE-2020-37236NewsLister Authenticated Persistent Cross-Site Scripting via Admin PanelNetartmedia NewsLister
- CVE-2020-37235WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Componentthemeftc Theme Wibar
- CVE-2020-37234Internet Download Manager 6.38.12 Scheduler Buffer OverflowInternetdownloadmanager Internet Download Manager
- CVE-2020-37233WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site ScriptingWordpress Buddypress
- CVE-2026-46719Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injectionsRRWO Net::Statsd::Lite
- CVE-2025-4202Multicollab: Content Team Collaboration and Editorial Workflow <= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration CommentMulticollab: Content Team Collaboration and Editorial Workf…
- CVE-2026-8656Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper jsondiffpatch
- CVE-2026-8681Essential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameteressentialplugin Essential Chat Support