# CVEs published 2026-05-16

48 CVEs were published on May 16, 2026: 3 critical, 25 high. Days are UTC.

- [CVE-2026-8723](https://cve.now/CVE-2026-8723.md): qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly (CVSS 5.3, ljharb qs · qs)
- [CVE-2026-46728](https://cve.now/CVE-2026-46728.md): Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash. (CVSS 8.2, denx U-Boot)
- [CVE-2021-47978](https://cve.now/CVE-2021-47978.md): ProcessMaker 3.5.4 Local File Inclusion via Path Traversal (CVSS 6.9, ProcessMaker)
- [CVE-2021-47977](https://cve.now/CVE-2021-47977.md): WordPress Anti-Malware Security Bruteforce Firewall \<= 4.20.72 Directory Traversal (CVSS 8.7, Gotmls Malware Security and Bruteforce Firewall)
- [CVE-2021-47942](https://cve.now/CVE-2021-47942.md): Home Assistant Community Store 1.10.0 Path Traversal Account Takeover (CVSS 8.7, Home-Assistant Home Assistant Community Store)
- [CVE-2020-37241](https://cve.now/CVE-2020-37241.md): bloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user add (CVSS 6.9, bloofoxCMS)
- [CVE-2021-47981](https://cve.now/CVE-2021-47981.md): Quick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders Form (CVSS 5.1, Opensolution Quick.CMS)
- [CVE-2021-47980](https://cve.now/CVE-2021-47980.md): Fuel CMS 1.4.13 Blind SQL Injection via col Parameter (CVSS 7.1, Getfuelcms Fuel CMS)
- [CVE-2021-47979](https://cve.now/CVE-2021-47979.md): WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion (CVSS 8.7, Miniorange Backup and Restore)
- [CVE-2021-47976](https://cve.now/CVE-2021-47976.md): TextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin Upload (CVSS 8.7, TextPattern CMS)
- [CVE-2021-47975](https://cve.now/CVE-2021-47975.md): WordPress Plugin WP Learn Manager 1.1.2 Stored XSS (CVSS 5.1, Wplearnmanager WP Learn Manager)
- [CVE-2021-47974](https://cve.now/CVE-2021-47974.md): VX Search 13.5.28 Unquoted Service Path Privilege Escalation (CVSS 8.5, Vxsearch VX Search)
- [CVE-2021-47973](https://cve.now/CVE-2021-47973.md): Sticky Notes Widget 3.0.6 Denial of Service via Buffer Overflow (CVSS 8.7, sticky-notes Sticky Notes Widget)
- [CVE-2021-47972](https://cve.now/CVE-2021-47972.md): Sticky Notes & Color Widgets 1.4.2 Denial of Service (CVSS 8.7, sticky-notes-color-widgets Sticky Notes Color Widgets)
- [CVE-2021-47971](https://cve.now/CVE-2021-47971.md): My Notes Safe 5.3 Denial of Service via Buffer Overflow (CVSS 8.7, my-notes-safe My Notes Safe)
- [CVE-2021-47970](https://cve.now/CVE-2021-47970.md): Macaron Notes 5.5 Denial of Service via Buffer Overflow (CVSS 8.7, Macaron Notes)
- [CVE-2021-47969](https://cve.now/CVE-2021-47969.md): Color Notes 1.4 Denial of Service via Long Character String (CVSS 8.7, color-notes Color Notes)
- [CVE-2021-47957](https://cve.now/CVE-2021-47957.md): WordPress Plugin Cookie Law Bar 1.2.1 Stored XSS via clb\_bar\_msg (CVSS 5.1, Cookielawinfo Cookie Law Bar)
- [CVE-2021-47956](https://cve.now/CVE-2021-47956.md): EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname (CVSS 8.8, EgavilanMedia PHPCRUD)
- [CVE-2021-47955](https://cve.now/CVE-2021-47955.md): CouchCMS 2.2.1 Cross-Site Scripting via SVG File Upload (CVSS 5.1, CouchCMS)
- [CVE-2021-47954](https://cve.now/CVE-2021-47954.md): LayerBB 1.1.4 SQL Injection via search\_query Parameter (CVSS 8.8, LayerBB)
- [CVE-2021-47952](https://cve.now/CVE-2021-47952.md): python jsonpickle 2.0.0 Remote Code Execution via py/repr (CVSS 9.3, python jsonpickle)
- [CVE-2021-47934](https://cve.now/CVE-2021-47934.md): MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF (CVSS 6.9, MyBB Timeline Plugin)
- [CVE-2020-37247](https://cve.now/CVE-2020-37247.md): Kite 4.2.0.1 U1 Unquoted Service Path Privilege Escalation (CVSS 8.5, Kite)
- [CVE-2020-37246](https://cve.now/CVE-2020-37246.md): WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion (CVSS 6.9, Supsystic Backup)
- [CVE-2020-37245](https://cve.now/CVE-2020-37245.md): WordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSS (CVSS 8.7, Supsystic Digital Publications)
- [CVE-2020-37244](https://cve.now/CVE-2020-37244.md): WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx (CVSS 8.8, Supsystic Membership)
- [CVE-2020-37243](https://cve.now/CVE-2020-37243.md): WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS (CVSS 8.8, Supsystic Pricing Table)
- [CVE-2020-37242](https://cve.now/CVE-2020-37242.md): WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx (CVSS 8.8, Supsystic Ultimate Maps)
- [CVE-2020-37240](https://cve.now/CVE-2020-37240.md): Queue Management System 4.0.0 Stored XSS via Add User (CVSS 5.1, Codekernel Queue Management System)
- [CVE-2020-37239](https://cve.now/CVE-2020-37239.md): libbabl 0.1.62 Broken Double Free Detection Memory Safety (CVSS 9.3, Gegl libbabl)
- [CVE-2020-37238](https://cve.now/CVE-2020-37238.md): CMS Made Simple 2.2.15 Stored XSS via SVG File Upload (CVSS 5.1, Cmsmadesimple CMS Made Simple)
- [CVE-2020-37237](https://cve.now/CVE-2020-37237.md): Composr CMS 10.0.34 Persistent Cross-Site Scripting via banners (CVSS 5.1, Composr CMS)
- [CVE-2020-37236](https://cve.now/CVE-2020-37236.md): NewsLister Authenticated Persistent Cross-Site Scripting via Admin Panel (CVSS 5.1, Netartmedia NewsLister)
- [CVE-2020-37235](https://cve.now/CVE-2020-37235.md): WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component (CVSS 5.1, themeftc Theme Wibar)
- [CVE-2020-37234](https://cve.now/CVE-2020-37234.md): Internet Download Manager 6.38.12 Scheduler Buffer Overflow (CVSS 6.9, Internetdownloadmanager Internet Download Manager)
- [CVE-2020-37233](https://cve.now/CVE-2020-37233.md): WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting (CVSS 5.1, Wordpress Buddypress)
- [CVE-2020-37232](https://cve.now/CVE-2020-37232.md): Advanced System Care Service 13.0.0.157 Unquoted Service Path Privilege Escalation (CVSS 8.5, Iobit Advanced System Care Service)
- [CVE-2020-37231](https://cve.now/CVE-2020-37231.md): Privacy Drive 3.17.0 Unquoted Service Path Privilege Escalation (CVSS 8.5, Cybertronsoft Privacy Drive)
- [CVE-2020-37230](https://cve.now/CVE-2020-37230.md): Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation (CVSS 8.5, Syncplify.me Server!)
- [CVE-2020-37229](https://cve.now/CVE-2020-37229.md): OKI sPSV Port Manager 1.0.41 Unquoted Service Path Privilege Escalation (CVSS 8.5, OKI sPSV Port Manager)
- [CVE-2020-37228](https://cve.now/CVE-2020-37228.md): iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass (CVSS 9.3, Yerootech iDS6 DSSPro Digital Signage System)
- [CVE-2020-37227](https://cve.now/CVE-2020-37227.md): WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload (CVSS 8.7, Heliossolutions HS Brand Logo Slider)
- [CVE-2026-46719](https://cve.now/CVE-2026-46719.md): Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections (CVSS 6.5, RRWO Net::Statsd::Lite)
- [CVE-2025-4202](https://cve.now/CVE-2025-4202.md): Multicollab: Content Team Collaboration and Editorial Workflow \<= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration Comment (CVSS 4.3, Multicollab: Content Team Collaboration and Editorial Workf…)
- [CVE-2026-8657](https://cve.now/CVE-2026-8657.md): Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/for (CVSS 8.8, jsondiffpatch · org.webjars.npm:jsondiffpatch)
- [CVE-2026-8656](https://cve.now/CVE-2026-8656.md): Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper (CVSS 5.1, jsondiffpatch)
- [CVE-2026-8681](https://cve.now/CVE-2026-8681.md): Essential Chat Support \<= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs\_reset\_settings' Parameter (CVSS 5.3, essentialplugin Essential Chat Support)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.