# CVEs published 2026-05-17

64 CVEs were published on May 17, 2026: 5 critical, 14 high. Days are UTC.

- [CVE-2026-8772](https://cve.now/CVE-2026-8772.md): linlinjava litemall Admin Endpoint sql injection (CVSS 5.1, linlinjava litemall)
- [CVE-2026-8771](https://cve.now/CVE-2026-8771.md): linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection (CVSS 6.9, linlinjava litemall · org.linlinjava:litemall-wx-api)
- [CVE-2026-8770](https://cve.now/CVE-2026-8770.md): continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal (CVSS 4.8, continuedev continue)
- [CVE-2026-8769](https://cve.now/CVE-2026-8769.md): vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption (CVSS 5.3, vercel ai · @ai-sdk/provider-utils)
- [CVE-2026-8768](https://cve.now/CVE-2026-8768.md): vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery (CVSS 6.9, vercel ai)
- [CVE-2026-8767](https://cve.now/CVE-2026-8767.md): vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection (CVSS 2.3, vercel ai)
- [CVE-2026-8766](https://cve.now/CVE-2026-8766.md): Kilo-Org kilocode Environment Variable config.ts load information disclosure (CVSS 5.3, Kilo-Org kilocode · @kilocode/cli)
- [CVE-2026-8765](https://cve.now/CVE-2026-8765.md): Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal (CVSS 5.3, Kilo-Org kilocode)
- [CVE-2026-8764](https://cve.now/CVE-2026-8764.md): H3C Magic B3 aspForm UpdateWanParams buffer overflow (CVSS 8.6, H3C Magic B3)
- [CVE-2026-8721](https://cve.now/CVE-2026-8721.md): Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs (CVSS 9.8, JONASBN Crypt::OpenSSL::PKCS12)
- [CVE-2026-8507](https://cve.now/CVE-2026-8507.md): Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws (CVSS 9.8, JONASBN Crypt::OpenSSL::PKCS12)
- [CVE-2026-46720](https://cve.now/CVE-2026-46720.md): Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections (CVSS 8.2, RRWO Net::Statsd::Tiny)
- [CVE-2026-8759](https://cve.now/CVE-2026-8759.md): xiandafu beetl SpELFunction SpELFunction.java expression language injection (CVSS 6.9, xiandafu beetl · com.ibeetl:beetl-spring-classic)
- [CVE-2026-8758](https://cve.now/CVE-2026-8758.md): Metasoft 美特软件 MetaCRM upload3.jsp unrestricted upload (CVSS 6.9, Metasoft 美特软件 MetaCRM)
- [CVE-2026-8757](https://cve.now/CVE-2026-8757.md): adenhq hive Delete Request routes\_sessions.py \_read\_events\_tail path traversal (CVSS 6.9, adenhq hive)
- [CVE-2026-8756](https://cve.now/CVE-2026-8756.md): fishaudio Bert-VITS2 Gradio webui\_preprocess.py generate\_config path traversal (CVSS 6.9, fishaudio Bert-VITS2)
- [CVE-2026-8755](https://cve.now/CVE-2026-8755.md): fishaudio Bert-VITS2 Model hiyoriUI.py \_get\_all\_models path traversal (CVSS 6.9, fishaudio Bert-VITS2)
- [CVE-2026-8754](https://cve.now/CVE-2026-8754.md): AstrBotDevs AstrBot File Upload chat.py post\_file path traversal (CVSS 5.3, AstrBotDevs AstrBot · astrbot)
- [CVE-2018-25334](https://cve.now/CVE-2018-25334.md): Zechat 1.5 Cross-Site Request Forgery (CSRF) via hashtag parameter (CVSS 5.3, Bylancer Zechat)
- [CVE-2018-25339](https://cve.now/CVE-2018-25339.md): Zechat 1.5 SQL Injection via v parameter (time-based blind) (CVSS 8.8, Bylancer Zechat)
- [CVE-2018-25338](https://cve.now/CVE-2018-25338.md): Zechat 1.5 SQL Injection via hashtag parameter (CVSS 8.8, Bylancer Zechat)
- [CVE-2018-25337](https://cve.now/CVE-2018-25337.md): Joomla JoomOCShop 1.0 Cross-Site Request Forgery (CVSS 5.3, Joomlaextensions Joomla! extension JoomOCShop)
- [CVE-2018-25336](https://cve.now/CVE-2018-25336.md): jCart for OpenCart 2.3.0.2 Cross-Site Request Forgery (CVSS 6.9, jCart for OpenCart)
- [CVE-2018-25335](https://cve.now/CVE-2018-25335.md): WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload (CVSS 9.3, peugeot-music-plugin Peugeot Music)
- [CVE-2018-25333](https://cve.now/CVE-2018-25333.md): Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection (CVSS 8.8, nordex-online N149 Wind Turbine Web Server)
- [CVE-2018-25332](https://cve.now/CVE-2018-25332.md): GitBucket 4.23.1 Unauthenticated Remote Code Execution (CVSS 9.3, GitBucket)
- [CVE-2018-25331](https://cve.now/CVE-2018-25331.md): Zenar Content Management System Cross-Site Scripting via ajax.php (CVSS 5.1, Zenar Content Management System)
- [CVE-2018-25330](https://cve.now/CVE-2018-25330.md): Joomla! EkRishta 2.10 Persistent XSS and SQL Injection (CVSS 8.8, Joomlaextensions Joomla! extension EkRishta)
- [CVE-2018-25329](https://cve.now/CVE-2018-25329.md): WordPress Plugin WP with Spritz 1.0 Remote File Inclusion (CVSS 8.7, wp-with-spritz WP with Spritz)
- [CVE-2018-25328](https://cve.now/CVE-2018-25328.md): VX Search 10.6.18 Local Buffer Overflow via Directory Field (CVSS 8.6, vxsearch VX Search)
- [CVE-2018-25327](https://cve.now/CVE-2018-25327.md): Joomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery (CVSS 6.9, Joomsky JS Jobs)
- [CVE-2018-25326](https://cve.now/CVE-2018-25326.md): Google Drive for WordPress 2.2 Path Traversal RCE via gdrive-ajaxs.php (CVSS 8.7, wp-google-drive Google Drive)
- [CVE-2018-25325](https://cve.now/CVE-2018-25325.md): Woocommerce CSV Importer 3.3.6 Path Traversal File Deletion (CVSS 8.7, woocommerce-csvimport WooCommerce CSV-Importer)
- [CVE-2018-25324](https://cve.now/CVE-2018-25324.md): Simple Fields 0.2-0.3.5 Local File Inclusion via wp\_abspath (CVSS 6.9, Simple-Fields Simple Fields)
- [CVE-2018-25323](https://cve.now/CVE-2018-25323.md): Allok AVI DivX MPEG to DVD Converter 2.6.1217 Buffer Overflow SEH (CVSS 8.6, Alloksoft Allok AVI DivX MPEG to DVD Converter)
- [CVE-2018-25322](https://cve.now/CVE-2018-25322.md): Allok Fast AVI MPEG Splitter 1.2 Stack Based Buffer Overflow (CVSS 8.6, alloksoft Fast AVI MPEG Splitter)
- [CVE-2018-25321](https://cve.now/CVE-2018-25321.md): TP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1\_130719) (CVSS 5.3, Tp-link TL-WR720NMbps Wireless N Router)
- [CVE-2018-25320](https://cve.now/CVE-2018-25320.md): ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution (CVSS 9.3, ACL Analytics)
- [CVE-2018-25319](https://cve.now/CVE-2018-25319.md): Redaxo CMS Addon MyEvents 2.2.1 SQL Injection via event\_add.php (CVSS 7.1, wende60 Redaxo CMS Addon MyEvents)
- [CVE-2026-8753](https://cve.now/CVE-2026-8753.md): kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection (CVSS 5.3, kalcaddle Kodbox)
- [CVE-2026-8752](https://cve.now/CVE-2026-8752.md): h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control (CVSS 6.9, h2oai h2o-3)
- [CVE-2026-8751](https://cve.now/CVE-2026-8751.md): h2oai h2o-3 JAR Model.java importBinaryModel deserialization (CVSS 6.9, h2oai h2o-3)
- [CVE-2026-8750](https://cve.now/CVE-2026-8750.md): h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure (CVSS 6.9, h2oai h2o-3)
- [CVE-2026-8747](https://cve.now/CVE-2026-8747.md): Z-BlogPHP Commend Approval c\_system\_event.php CheckComment improper authorization (CVSS 5.3, Z-BlogPHP)
- [CVE-2026-8746](https://cve.now/CVE-2026-8746.md): Open5GS NRF nghttp2-server.c discover\_handler use after free (CVSS 5.3, Open5GS)
- [CVE-2026-8745](https://cve.now/CVE-2026-8745.md): Open5GS AUSF nausf-handler.c ogs\_timer\_add denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8744](https://cve.now/CVE-2026-8744.md): Open5GS NRF context.c ogs\_sbi\_nf\_service\_add denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8743](https://cve.now/CVE-2026-8743.md): Open5GS AMF/MME context.c ran\_ue\_find\_by\_amf\_ue\_ngap\_id improper authorization (CVSS 5.3, Open5GS)
- [CVE-2026-8741](https://cve.now/CVE-2026-8741.md): EMQX QoS 2 PUBLISH Packet emqx\_persistent\_session\_ds.erl race condition (CVSS 2.3, EMQX)
- [CVE-2026-8740](https://cve.now/CVE-2026-8740.md): Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine (CVSS 5.3, Sanluan PublicCMS)
- [CVE-2026-8739](https://cve.now/CVE-2026-8739.md): Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key (CVSS 6.9, Sanluan PublicCMS)
- [CVE-2026-8738](https://cve.now/CVE-2026-8738.md): Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error (CVSS 6.9, Sanluan PublicCMS)
- [CVE-2026-8737](https://cve.now/CVE-2026-8737.md): Sanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authentication (CVSS 6.9, Sanluan PublicCMS)
- [CVE-2026-8736](https://cve.now/CVE-2026-8736.md): Oinone Pamirs RestController LocalFileClient.java request.getParameter path traversal (CVSS 2.4, Oinone Pamirs)
- [CVE-2026-8735](https://cve.now/CVE-2026-8735.md): Oinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization (CVSS 5.3, Oinone Pamirs)
- [CVE-2026-8734](https://cve.now/CVE-2026-8734.md): Oinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injection (CVSS 6.9, Oinone Pamirs)
- [CVE-2026-8733](https://cve.now/CVE-2026-8733.md): Investintech SlimPDFReader SlimPDFReader.exe sub\_3B4610 stack-based overflow (CVSS 5.3, Investintech SlimPDFReader)
- [CVE-2026-8731](https://cve.now/CVE-2026-8731.md): Open5GS NRF client.c ogs\_sbi\_client\_add denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8730](https://cve.now/CVE-2026-8730.md): Open5GS NRF context.c ogs\_sbi\_nf\_instance\_set\_id denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8729](https://cve.now/CVE-2026-8729.md): Open5GS NRF message.c denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8719](https://cve.now/CVE-2026-8719.md): AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token (CVSS 8.8, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2026-8728](https://cve.now/CVE-2026-8728.md): Open5GS NRF conv.c ogs\_sbi\_discovery\_option\_parse\_plmn\_list denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8725](https://cve.now/CVE-2026-8725.md): CoreWorxLab CAAL test-hass Endpoint webhooks.py server-side request forgery (CVSS 6.9, CoreWorxLab CAAL)
- [CVE-2026-8724](https://cve.now/CVE-2026-8724.md): Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection (CVSS 5.1, Dataease)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.