# CVEs published 2026-05-20

201 CVEs were published on May 20, 2026: 21 critical, 70 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2026-40165](https://cve.now/CVE-2026-40165.md): authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation (CVSS 8.7, goauthentik authentik)
- [CVE-2026-9149](https://cve.now/CVE-2026-9149.md): Libsolv: heap buffer overflow in libsolv repo\_add\_solv via negative maxsize from crafted .solv file (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Hardened Images +3)
- [CVE-2026-9150](https://cve.now/CVE-2026-9150.md): Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Hardened Images +3)
- [CVE-2026-47782](https://cve.now/CVE-2026-47782.md): Android App "RoboForm Password Manager" provided by Siber Systems, Inc. (CVSS 3.3, Siber Systems Android App "RoboForm Password Manager")
- [CVE-2026-47372](https://cve.now/CVE-2026-47372.md): Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts (CVSS 9.1, RRWO Crypt::SaltedHash)
- [CVE-2026-40102](https://cve.now/CVE-2026-40102.md): Plane: ORM Field Reference Injection via \`segment\` Parameter in Saved Analytics (CVSS 6.5, makeplane plane)
- [CVE-2026-40094](https://cve.now/CVE-2026-40094.md): nimiq-blockchain: network-libp2p untrusted peer can crash address book via empty peer contact addresses (CVSS 4.3, nimiq core-rs-albatross)
- [CVE-2026-40092](https://cve.now/CVE-2026-40092.md): nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT (CVSS 7.5, nimiq core-rs-albatross · nimiq-keys)
- [CVE-2026-39960](https://cve.now/CVE-2026-39960.md): MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values (CVSS 5.4, mantisbt · mantisbt/mantisbt)
- [CVE-2026-47373](https://cve.now/CVE-2026-47373.md): Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks (CVSS 7.5, RRWO Crypt::SaltedHash)
- [CVE-2026-8632](https://cve.now/CVE-2026-8632.md): HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution (CVSS 8.5, HP Linux Imaging and Printing Software)
- [CVE-2026-8631](https://cve.now/CVE-2026-8631.md): HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution (CVSS 9.3, HP Linux Imaging and Printing Software)
- [CVE-2026-9144](https://cve.now/CVE-2026-9144.md): Taiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration Interface (CVSS 7.6, Taiko Network Communications Pte AG1000-01A SMS Alert Gatew…)
- [CVE-2026-9141](https://cve.now/CVE-2026-9141.md): Taiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web Interface (CVSS 9.8, Taiko Network Communications Pte AG1000-01A SMS Alert Gatew…)
- [CVE-2026-39850](https://cve.now/CVE-2026-39850.md): Yii 2: Local file inclusion via view parameter name collision (CVSS 7.4, yiisoft yii2 · yiisoft/yii2)
- [CVE-2026-35016](https://cve.now/CVE-2026-35016.md): Open ISES Tickets \< 3.44.2 Reflected XSS via search.php frm\_query Parameter (CVSS 5.1, openises tickets)
- [CVE-2026-35015](https://cve.now/CVE-2026-35015.md): Open ISES Tickets \< 3.44.2 Reflected XSS via do\_unit\_mail.php the\_ticket Parameter (CVSS 5.1, openises tickets)
- [CVE-2026-35014](https://cve.now/CVE-2026-35014.md): Open ISES Tickets \< 3.44.2 Reflected XSS via routes\_nm.php ticket\_id Parameter (CVSS 5.1, openises tickets)
- [CVE-2026-35013](https://cve.now/CVE-2026-35013.md): Open ISES Tickets \< 3.44.2 Reflected XSS via street\_view.php thelat and thelng Parameters (CVSS 5.1, openises tickets)
- [CVE-2026-35012](https://cve.now/CVE-2026-35012.md): Open ISES Tickets \< 3.44.2 Reflected XSS via add\_facnote.php ticket\_id Parameter (CVSS 5.1, openises tickets)
- [CVE-2026-9133](https://cve.now/CVE-2026-9133.md): Arbitrary file read in rabbitmq-aws plugin (CVSS 7.7, RabbitMQ AWS)
- [CVE-2026-35011](https://cve.now/CVE-2026-35011.md): Open ISES Tickets \< 3.44.2 Reflected XSS via opena.php frm\_call Parameter (CVSS 5.1, openises tickets)
- [CVE-2026-35010](https://cve.now/CVE-2026-35010.md): Open ISES Tickets \< 3.44.2 Reflected XSS via patient\_JF.php ticket\_id Parameter (CVSS 5.1, openises tickets)
- [CVE-2026-35009](https://cve.now/CVE-2026-35009.md): Open ISES Tickets \< 3.44.2 Reflected XSS via add\_note.php ticket\_id Parameter (CVSS 5.1, openises tickets)
- [CVE-2026-9139](https://cve.now/CVE-2026-9139.md): Taiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml (CVSS 9.8, Taiko Network Communications Pte AG1000-01A SMS Alert Gatew…)
- [CVE-2026-35008](https://cve.now/CVE-2026-35008.md): Open ISES Tickets \< 3.44.2 Reflected XSS via single.php ticket\_id Parameter (CVSS 5.1, openises tickets)
- [CVE-2026-39405](https://cve.now/CVE-2026-39405.md): Frappe has Path Transversal via SCORM (CVSS 9.4, frappe lms)
- [CVE-2026-35007](https://cve.now/CVE-2026-35007.md): Open ISES Tickets \< 3.44.2 Reflected XSS via single\_unit.php id Parameter (CVSS 5.1, openises tickets)
- [CVE-2026-39352](https://cve.now/CVE-2026-39352.md): Frappe has an Arbitrary File Read via Path Traversal in render\_include (CVSS 8.7, frappe)
- [CVE-2026-39311](https://cve.now/CVE-2026-39311.md): Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments (CVSS 6.8, TriliumNext Trilium)
- [CVE-2026-9124](https://cve.now/CVE-2026-9124.md): Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromise (CVSS 5.3, Google Chrome)
- [CVE-2026-9123](https://cve.now/CVE-2026-9123.md): Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute (CVSS 7.5, Google Chrome)
- [CVE-2026-9122](https://cve.now/CVE-2026-9122.md): Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive informat (CVSS 6.5, Google Chrome)
- [CVE-2026-9121](https://cve.now/CVE-2026-9121.md): Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2026-9126](https://cve.now/CVE-2026-9126.md): Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-9120](https://cve.now/CVE-2026-9120.md): Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML pag (CVSS 8.8, Google Chrome)
- [CVE-2026-9119](https://cve.now/CVE-2026-9119.md): Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-9118](https://cve.now/CVE-2026-9118.md): Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted H (CVSS 8.8, Google Chrome)
- [CVE-2026-9117](https://cve.now/CVE-2026-9117.md): Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer (CVSS 7.5, Google Chrome)
- [CVE-2026-9116](https://cve.now/CVE-2026-9116.md): Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin (CVSS 4.3, Google Chrome)
- [CVE-2026-9115](https://cve.now/CVE-2026-9115.md): Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origi (CVSS 4.3, Google Chrome)
- [CVE-2026-9114](https://cve.now/CVE-2026-9114.md): Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-9113](https://cve.now/CVE-2026-9113.md): Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read (CVSS 4.3, Google Chrome)
- [CVE-2026-9112](https://cve.now/CVE-2026-9112.md): Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandb (CVSS 8.8, Google Chrome)
- [CVE-2026-9110](https://cve.now/CVE-2026-9110.md): Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the ren (CVSS 4.2, Google Chrome)
- [CVE-2026-9111](https://cve.now/CVE-2026-9111.md): Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-39310](https://cve.now/CVE-2026-39310.md): Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds (CVSS 8.6, TriliumNext Trilium)
- [CVE-2026-33137](https://cve.now/CVE-2026-33137.md): XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} (CVSS 9.3, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2026-26028](https://cve.now/CVE-2026-26028.md): CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS (CVSS 6.1, cryptpad)
- [CVE-2026-9137](https://cve.now/CVE-2026-9137.md): CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit (CVSS 5.1, misp)
- [CVE-2026-9136](https://cve.now/CVE-2026-9136.md): Unauthorized ShadowAttribute modification in MISP via client-supplied identifier (CVSS 8.3, misp)
- [CVE-2026-23734](https://cve.now/CVE-2026-23734.md): XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash (CVSS 9.3, xwiki-commons · org.xwiki.commons:xwiki-commons-classloader…)
- [CVE-2026-9082](https://cve.now/CVE-2026-9082.md): Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 (CVSS 9.8, KEV, Drupal core · drupal +1)
- [CVE-2026-9129](https://cve.now/CVE-2026-9129.md): Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read (CVSS 9.4, Altium Enterprise Server)
- [CVE-2026-45444](https://cve.now/CVE-2026-45444.md): WordPress Gift Cards For WooCommerce Pro plugin \<= 4.2.6 - Arbitrary File Upload vulnerability (CVSS 10.0, WP Swings Gift Cards For WooCommerce Pro)
- [CVE-2026-47099](https://cve.now/CVE-2026-47099.md): TeleJSON \< 6.0.0 DOM-based XSS via parse() Function (CVSS 2.1, storybookjs telejson · telejson)
- [CVE-2026-2813](https://cve.now/CVE-2026-2813.md): Unvalidated Redirect in ArcGIS Server (CVSS 4.7, Esri ArcGIS Server)
- [CVE-2026-9102](https://cve.now/CVE-2026-9102.md): Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File Write (CVSS 9.4, Altium Enterprise Server)
- [CVE-2026-2812](https://cve.now/CVE-2026-2812.md): Improper Authentication issue in ArcGIS Server (CVSS 5.3, Esri ArcGIS Server)
- [CVE-2026-24217](https://cve.now/CVE-2026-24217.md): NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file. (CVSS 8.8, NVIDIA BioNeMo Framework)
- [CVE-2026-24216](https://cve.now/CVE-2026-24216.md): NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data. (CVSS 7.8, NVIDIA BioNeMo Framework)
- [CVE-2026-24218](https://cve.now/CVE-2026-24218.md): NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host key (CVSS 8.1, NVIDIA DGX Spark)
- [CVE-2026-24188](https://cve.now/CVE-2026-24188.md): NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. (CVSS 8.2, NVIDIA TensorRT)
- [CVE-2026-20238](https://cve.now/CVE-2026-20238.md): Improper Access Control through Role Inheritance in Splunk AI Toolkit app (CVSS 6.5, Splunk AI Toolkit)
- [CVE-2026-20239](https://cve.now/CVE-2026-20239.md): Sensitive Information Disclosure through Log Files in Splunk Enterprise (CVSS 7.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20240](https://cve.now/CVE-2026-20240.md): Denial of Service through coldToFrozen.sh Script in Splunk Enterprise (CVSS 7.1, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-7613](https://cve.now/CVE-2026-7613.md): Cost of Goods by PixelYourSite \<= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import (CVSS 7.2, Cost of Goods by PixelYourSite)
- [CVE-2026-9101](https://cve.now/CVE-2026-9101.md): Prototype pollution in csv parsing (CVSS 5.3, MongoDB Compass)
- [CVE-2026-20199](https://cve.now/CVE-2026-20199.md): A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to exe (CVSS 4.7, Cisco ThousandEyes Enterprise Agent)
- [CVE-2026-9087](https://cve.now/CVE-2026-9087.md): Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login (CVSS 6.4, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-20171](https://cve.now/CVE-2026-20171.md): Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vulnerability (CVSS 6.8, Cisco NX-OS Software)
- [CVE-2026-20206](https://cve.now/CVE-2026-20206.md): Cisco ThousandEyes BrowserBot Command Injection Vulnerability (CVSS 6.3, Cisco ThousandEyes Enterprise Agent)
- [CVE-2026-20223](https://cve.now/CVE-2026-20223.md): Cisco Secure Workload Unauthorized API Access Vulnerability (CVSS 10.0, Cisco Secure Workload)
- [CVE-2026-9100](https://cve.now/CVE-2026-9100.md): Heap memory out of bounds read and crash in C Driver legacy GridFS file reader (CVSS 6.0, MongoDB C Driver)
- [CVE-2026-8598](https://cve.now/CVE-2026-8598.md): Unauthenticated Export Service in ZKTeco CCTV Cameras (CVSS 9.1, ZKTeco SSC335-GC2063-Face-0b77 Solution Camera)
- [CVE-2026-4293](https://cve.now/CVE-2026-4293.md): Kieback & Peter DDC Building Controllers Cross-site Scripting (CVSS 5.3, Kieback & Peter DDC4002 · Kieback & Peter DDC4100 +9)
- [CVE-2025-32750](https://cve.now/CVE-2025-32750.md): Dell PowerFlex Manager, version(s) \<=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. (CVSS 7.5, Dell PowerFlex Manager)
- [CVE-2026-9084](https://cve.now/CVE-2026-9084.md): MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations (CVSS 6.0, misp)
- [CVE-2026-5783](https://cve.now/CVE-2026-5783.md): Reflected XSS in Beyaz Computer's CityPLus (CVSS 7.6, Beyaz Computer Software Design Industry and Trade Ltd. City…)
- [CVE-2026-8488](https://cve.now/CVE-2026-8488.md): Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation (CVSS 4.3, Progress Software MOVEit Automation)
- [CVE-2023-7346](https://cve.now/CVE-2023-7346.md): Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript (CVSS 4.0, Ledger Bitcoin app)
- [CVE-2026-8487](https://cve.now/CVE-2026-8487.md): Incorrect default permissions vulnerability in Progress Software MOVEit Automation (CVSS 6.5, Progress Software MOVEit Automation)
- [CVE-2026-8486](https://cve.now/CVE-2026-8486.md): Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation (CVSS 5.3, Progress Software MOVEit Automation)
- [CVE-2026-8485](https://cve.now/CVE-2026-8485.md): Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation (CVSS 5.9, Progress Software MOVEit Automation)
- [CVE-2026-22554](https://cve.now/CVE-2026-22554.md): A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version(s): 26.01). (CVSS 7.8, MediaArea MediaInfoLib)
- [CVE-2026-24425](https://cve.now/CVE-2026-24425.md): Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface (CVSS 8.7, twigphp Twig · twig/twig)
- [CVE-2026-21836](https://cve.now/CVE-2026-21836.md): HCL DominoIQ is affected by broken access control (CVSS 6.5, HCLSoftware DominoIQ)
- [CVE-2026-47068](https://cve.now/CVE-2026-47068.md): Cross-session PubSub topic injection via URL parameter in phoenix\_storybook (CVSS 2.3, phenixdigital phoenix\_storybook)
- [CVE-2026-8467](https://cve.now/CVE-2026-8467.md): Unauthenticated remote code execution via HEEx template injection in phoenix\_storybook playground (CVSS 9.5, phenixdigital phoenix\_storybook)
- [CVE-2026-8469](https://cve.now/CVE-2026-8469.md): Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix\_storybook (CVSS 8.2, phenixdigital phoenix\_storybook)
- [CVE-2026-5950](https://cve.now/CVE-2026-5950.md): Unbounded resend loop in BIND 9 resolver (CVSS 5.3, ISC BIND)
- [CVE-2026-5947](https://cve.now/CVE-2026-5947.md): SIG(0) validation during query flood may lead to undefined behavior (CVSS 7.5, ISC BIND)
- [CVE-2026-5946](https://cve.now/CVE-2026-5946.md): Invalid handling of CLASS != IN (CVSS 7.5, ISC BIND)
- [CVE-2026-3593](https://cve.now/CVE-2026-3593.md): Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (CVSS 7.4, ISC BIND)
- [CVE-2026-42834](https://cve.now/CVE-2026-42834.md): Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Admin Center in Azure Portal)
- [CVE-2026-45584](https://cve.now/CVE-2026-45584.md): Microsoft Defender Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Malware Protection Engine)
- [CVE-2026-3592](https://cve.now/CVE-2026-3592.md): Amplification vulnerabilities via self-pointed glue records (CVSS 5.3, ISC BIND)
- [CVE-2026-41091](https://cve.now/CVE-2026-41091.md): Microsoft Defender Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Malware Protection Engine)
- [CVE-2026-45498](https://cve.now/CVE-2026-45498.md): Microsoft Defender Denial of Service Vulnerability (CVSS 4.0, KEV, Microsoft Defender Antimalware Platform)
- [CVE-2026-3039](https://cve.now/CVE-2026-3039.md): BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVSS 7.5, ISC BIND)
- [CVE-2026-42383](https://cve.now/CVE-2026-42383.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.29.0 - SQL Injection vulnerability (CVSS 7.6, YITH WooCommerce Product Add-Ons)
- [CVE-2026-24573](https://cve.now/CVE-2026-24573.md): WordPress Visualizer plugin \< 4.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themeisle Visualizer)
- [CVE-2026-29518](https://cve.now/CVE-2026-29518.md): Rsync \< 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write (CVSS 7.3, RsyncProject rsync)
- [CVE-2026-27405](https://cve.now/CVE-2026-27405.md): WordPress WpBookingly plugin \<= 1.2.9 - Broken Access Control vulnerability (CVSS 6.5, Magepeople WpBookingly)
- [CVE-2026-27424](https://cve.now/CVE-2026-27424.md): WordPress Image Photo Gallery Final Tiles Grid plugin \<= 3.6.11 - Broken Access Control vulnerability (CVSS 4.3, WP Chill Image Photo Gallery Final Tiles Grid)
- [CVE-2025-11954](https://cve.now/CVE-2025-11954.md): CSRF in Sitemio's WISECP (CVSS 8.0, Sitemio Information Technologies Trade Ltd. WISECP)
- [CVE-2026-45443](https://cve.now/CVE-2026-45443.md): WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin \<= 5.5.1 - Broken Access Control vulnerability (CVSS 5.0, ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Templat…)
- [CVE-2025-31985](https://cve.now/CVE-2025-31985.md): HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header (CVSS 3.7, HCL BigFix Service Management)
- [CVE-2025-31973](https://cve.now/CVE-2025-31973.md): HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version' (CVSS 4.0, HCL BigFix Service Management)
- [CVE-2026-25602](https://cve.now/CVE-2026-25602.md): Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). (CVSS 2.3, Mesalvo Meona Server · Mesalvo Meona Client)
- [CVE-2026-0857](https://cve.now/CVE-2026-0857.md): Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose passw (CVSS 4.4, Mesalvo Meona Client · Mesalvo Meona Server)
- [CVE-2026-0856](https://cve.now/CVE-2026-0856.md): Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administ (CVSS 7.8, Mesalvo Meona Client · Mesalvo Meona Server)
- [CVE-2026-6728](https://cve.now/CVE-2026-6728.md): Slider Revolution \<= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream' (CVSS 5.3, Revolution Slider Slider Revolution)
- [CVE-2026-35070](https://cve.now/CVE-2026-35070.md): Dell SmartFabric Storage Software, versions prior to 1.4.5, contains an Improper Neutralization of Special Elements used in a Command ('Comm (CVSS 6.4, Dell SmartFabric Storage Software)
- [CVE-2026-44608](https://cve.now/CVE-2026-44608.md): Use after free and crash under special conditions in RPZ code (CVSS 4.6, NLnet Labs Unbound)
- [CVE-2026-44390](https://cve.now/CVE-2026-44390.md): Unbounded name compression in certain cases causes degradation of service (CVSS 6.9, NLnet Labs Unbound)
- [CVE-2026-42960](https://cve.now/CVE-2026-42960.md): Possible cache poisoning via promiscuous records for the authority section (CVSS 5.7, NLnet Labs Unbound)
- [CVE-2026-42959](https://cve.now/CVE-2026-42959.md): Crash during DNSSEC validation of malicious content (CVSS 8.7, NLnet Labs Unbound)
- [CVE-2026-42944](https://cve.now/CVE-2026-42944.md): Heap overflow with multiple NSID, COOKIE, PADDING EDNS options (CVSS 8.7, NLnet Labs Unbound)
- [CVE-2026-42923](https://cve.now/CVE-2026-42923.md): Degradation of service with unbounded NSEC3 hash calculations (CVSS 6.9, NLnet Labs Unbound)
- [CVE-2026-42534](https://cve.now/CVE-2026-42534.md): Jostle logic bypass degrades resolution performance (CVSS 6.9, NLnet Labs Unbound)
- [CVE-2026-41292](https://cve.now/CVE-2026-41292.md): Long list of incoming EDNS options degrades performance (CVSS 6.6, NLnet Labs Unbound)
- [CVE-2026-40622](https://cve.now/CVE-2026-40622.md): Another 'ghost domain names' attack variant (CVSS 6.6, NLnet Labs Unbound)
- [CVE-2026-33278](https://cve.now/CVE-2026-33278.md): Possible arbitrary code execution during DNSSEC validation (CVSS 9.1, NLnet Labs Unbound)
- [CVE-2026-32792](https://cve.now/CVE-2026-32792.md): Packet of death with DNSCrypt (CVSS 4.6, NLnet Labs Unbound)
- [CVE-2026-9064](https://cve.now/CVE-2026-9064.md): 389-ds-base: 389-ds-base: unbounded ldap controls count in get\_ldapmessage\_controls\_ext() causes cpu and heap amplification (remote dos) (CVSS 7.5, 389-ds-base · Red Hat Directory Server 11.5 E4S for RHEL +6)
- [CVE-2026-41054](https://cve.now/CVE-2026-41054.md): Missing exit out of permission check in haveged could lead to root exploit (CVSS 7.8, Container suse/sle-micro-rancher/5.3:latest · Container… +30)
- [CVE-2026-44933](https://cve.now/CVE-2026-44933.md): Path Traversal in Plugin Loading in libzypp (CVSS 7.8, SUSE Linux Enterprise · openSUSE)
- [CVE-2026-9065](https://cve.now/CVE-2026-9065.md): Surecart - SQL Injection (CVSS 9.3, brainstormforce Surecart)
- [CVE-2026-9059](https://cve.now/CVE-2026-9059.md): NextGEN Gallery - SQL Injection (CVSS 9.3, awesomemotive NextGEN Gallery)
- [CVE-2026-5200](https://cve.now/CVE-2026-5200.md): AcyMailing \<= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing\_router' (CVSS 8.8, acyba AcyMailing – An Ultimate Newsletter Plugin and Market…)
- [CVE-2026-6405](https://cve.now/CVE-2026-6405.md): Anomify AI \<= 0.3.6 - Cross-Site Request Forgery (CVSS 4.3, simonholliday Anomify AI – Anomaly Detection and Alerting)
- [CVE-2026-7385](https://cve.now/CVE-2026-7385.md): Decent Comments \< 3.0.2 - Unauthenticated Email Address Disclosure (CVSS 5.8, Decent Comments)
- [CVE-2026-5776](https://cve.now/CVE-2026-5776.md): Email Encoder \< 2.4.7 - Unauthenticated Stored XSS (CVSS 6.1, Email Encoder)
- [CVE-2026-47784](https://cve.now/CVE-2026-47784.md): In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl (CVSS 8.1, memcached)
- [CVE-2026-47783](https://cve.now/CVE-2026-47783.md): In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon a (CVSS 8.1, memcached)
- [CVE-2026-2955](https://cve.now/CVE-2026-2955.md): AI Chatbot & Workflow Automation by AIWU \<= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header (CVSS 6.4, wupsales AI Chatbot & Workflow Automation by AIWU)
- [CVE-2026-6566](https://cve.now/CVE-2026-6566.md): Photo Gallery, Sliders, Proofing and Themes \<= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API (CVSS 4.3, smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…)
- [CVE-2026-44392](https://cve.now/CVE-2026-44392.md): Missing authorization vulnerability exists in Movable Type. (CVSS 4.3, Six Apart Movable Type)
- [CVE-2026-9057](https://cve.now/CVE-2026-9057.md): Security fix for Qlik Talend Administration Center URL access control vulnerability (CVSS 8.2, Talend Administration Center)
- [CVE-2026-9056](https://cve.now/CVE-2026-9056.md): Security fix for Qlik Talend Administration Center cross-site scripting vulnerability (CVSS 5.4, Talend Administration Center)
- [CVE-2026-7522](https://cve.now/CVE-2026-7522.md): Advanced Database Cleaner – Premium \<= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template' (CVSS 8.8, SigmaPlugin Advanced Database Cleaner – Premium)
- [CVE-2026-5075](https://cve.now/CVE-2026-5075.md): All in One SEO \<= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data (CVSS 4.3, smub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…)
- [CVE-2026-24163](https://cve.now/CVE-2026-24163.md): NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. (CVSS 7.5, NVIDIA TensorRT-LLM)
- [CVE-2026-24160](https://cve.now/CVE-2026-24160.md): NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an unchecked return value to a null pointer derefere (CVSS 5.5, NVIDIA TensorRT-LLM)
- [CVE-2026-24142](https://cve.now/CVE-2026-24142.md): NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. (CVSS 6.3, NVIDIA TensorRT-LLM)
- [CVE-2025-33255](https://cve.now/CVE-2025-33255.md): NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. (CVSS 7.5, NVIDIA TensorRT-LLM)
- [CVE-2026-24215](https://cve.now/CVE-2026-24215.md): NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption (CVSS 5.7, NVIDIA Triton Inference Server)
- [CVE-2026-24214](https://cve.now/CVE-2026-24214.md): NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. (CVSS 8.0, NVIDIA Triton Inference Server)
- [CVE-2026-24213](https://cve.now/CVE-2026-24213.md): NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. (CVSS 8.0, NVIDIA Triton Inference Server)
- [CVE-2026-24210](https://cve.now/CVE-2026-24210.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow. (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-24209](https://cve.now/CVE-2026-24209.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-24208](https://cve.now/CVE-2026-24208.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. (CVSS 5.3, NVIDIA Triton Inference Server)
- [CVE-2026-24207](https://cve.now/CVE-2026-24207.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. (CVSS 9.8, NVIDIA Triton Inference Server)
- [CVE-2026-9003](https://cve.now/CVE-2026-9003.md): TONNET｜E-LAN Hybrid Recording System - SQL Injection (CVSS 8.7, TONNET TPR7308)
- [CVE-2026-24206](https://cve.now/CVE-2026-24206.md): NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. (CVSS 7.3, NVIDIA Triton Inference Server)
- [CVE-2026-7637](https://cve.now/CVE-2026-7637.md): Boost \<= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST\_USER\_LOCATION Cookie (CVSS 9.8, PixelYourSite Boost)
- [CVE-2025-15369](https://cve.now/CVE-2025-15369.md): Xpro Addons — 140+ Widgets for Elementor \<= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation (CVSS 5.3, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2026-9010](https://cve.now/CVE-2026-9010.md): Boost \<= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters (CVSS 7.5, PixelYourSite Boost)
- [CVE-2026-7460](https://cve.now/CVE-2026-7460.md): mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped (CVSS 7.4, mailcow-dockerized)
- [CVE-2026-6549](https://cve.now/CVE-2026-6549.md): Logo Manager For Enamad \<= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute (CVSS 6.4, goback2 Logo Manager For Enamad)
- [CVE-2026-8038](https://cve.now/CVE-2026-8038.md): Faces of Users \<= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute (CVSS 6.4, mcinvale Faces of Users)
- [CVE-2026-6395](https://cve.now/CVE-2026-6395.md): Word 2 Cash \<= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page (CVSS 6.1, winking Word 2 Cash)
- [CVE-2026-6400](https://cve.now/CVE-2026-6400.md): Child Height Predictor by Ostheimer \<= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form (CVSS 4.3, helpstring Child Height Predictor by Ostheimer)
- [CVE-2026-6401](https://cve.now/CVE-2026-6401.md): Bottom Bar \<= 0.1.7 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, svil4ok Bottom Bar)
- [CVE-2026-6399](https://cve.now/CVE-2026-6399.md): General Options \<= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad\_contact\_number' Parameter (CVSS 4.4, yog2515 General Options)
- [CVE-2026-7472](https://cve.now/CVE-2026-7472.md): Read More & Accordion \<= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9, edmonparker Read More & Accordion)
- [CVE-2026-6072](https://cve.now/CVE-2026-6072.md): Oliver POS \<= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header (CVSS 6.5, oliverpos Oliver POS – A WooCommerce Point of Sale)
- [CVE-2026-8419](https://cve.now/CVE-2026-8419.md): Amazon Scraper \<= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update (CVSS 4.3, submone Amazon Scraper)
- [CVE-2026-8424](https://cve.now/CVE-2026-8424.md): Remove Yellow BGBOX \<= 1.0 - Cross-Site Request Forgery (CVSS 4.3, jay\_patel Remove Yellow BGBOX)
- [CVE-2026-5293](https://cve.now/CVE-2026-5293.md): 診断ジェネレータ作成プラグイン \<= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter (CVSS 6.4, olivesystem 診断ジェネレータ作成プラグイン)
- [CVE-2026-6394](https://cve.now/CVE-2026-6394.md): Nexa Blocks \<= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo\_json\_file' Parameter (CVSS 5.4, wpdive Nexa Blocks – Gutenberg Blocks, Page Builder for Gut…)
- [CVE-2026-7467](https://cve.now/CVE-2026-7467.md): Read More & Accordion \<= 3.5.7 - Privilege Escalation via importData (CVSS 8.8, edmonparker Read More & Accordion)
- [CVE-2026-6391](https://cve.now/CVE-2026-6391.md): Sentence To SEO (keywords, description and tags) \<= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters (CVSS 6.1, eazyserver Sentence To SEO)
- [CVE-2026-8420](https://cve.now/CVE-2026-8420.md): BLOGCHAT Chat System \<= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update (CVSS 6.1, rdbeach BLOGCHAT Chat System)
- [CVE-2026-6456](https://cve.now/CVE-2026-6456.md): Account Switcher \<= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation (CVSS 8.8, beycanpress Account Switcher)
- [CVE-2026-7462](https://cve.now/CVE-2026-7462.md): VatanSMS WP SMS \<= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter (CVSS 6.1, vatanyazilim VatanSMS WP SMS)
- [CVE-2026-8610](https://cve.now/CVE-2026-8610.md): TypeSquare Webfonts for ConoHa \<= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter (CVSS 4.3, TypeSquare Webfonts for ConoHa)
- [CVE-2026-8626](https://cve.now/CVE-2026-8626.md): SponsorMe \<= 0.5.2 - Reflected Cross-Site Scripting via PHP\_SELF Parameter (CVSS 6.1, owencutajar SponsorMe)
- [CVE-2026-8423](https://cve.now/CVE-2026-8423.md): JaviBola Custom Theme Test \<= 2.0.5 - Cross-Site Request Forgery (CVSS 4.3, JaviBola Custom Theme Test)
- [CVE-2026-6452](https://cve.now/CVE-2026-6452.md): Bigfishgames Syndicate \<= 1.2 - Cross-Site Request Forgery to Settings Reset and Update (CVSS 4.3, ktulhu Bigfishgames Syndicate)
- [CVE-2026-8627](https://cve.now/CVE-2026-8627.md): Correct Prices \<= 1.0 - Reflected Cross-Site Scripting via PHP\_SELF Parameter (CVSS 6.1, lykich Correct Prices)
- [CVE-2026-6404](https://cve.now/CVE-2026-6404.md): Anomify AI \<= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify\_api\_key' Parameter (CVSS 4.4, simonholliday Anomify AI – Anomaly Detection and Alerting)
- [CVE-2026-3985](https://cve.now/CVE-2026-3985.md): Creative Mail – Easier WordPress & WooCommerce Email Marketing \<= 1.6.9 - Unauthenticated SQL Injection via 'checkout\_uuid' Parameter (CVSS 7.5, constantcontact Creative Mail – Easier WordPress & WooComme…)
- [CVE-2026-7284](https://cve.now/CVE-2026-7284.md): Easy Elements for Elementor \<= 1.4.4 - Unauthenticated Privilege Escalation via easyel\_handle\_register (CVSS 9.8, themewant Easy Elements for Elementor – Addons & Website Te…)
- [CVE-2026-8685](https://cve.now/CVE-2026-8685.md): Infility Global \<= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter (CVSS 6.5, Infility Global)
- [CVE-2026-6397](https://cve.now/CVE-2026-6397.md): Sticky \<= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute (CVSS 6.4, cvmh Sticky)
- [CVE-2026-8624](https://cve.now/CVE-2026-8624.md): LJ comments import: reloaded \<= 0.97.1 - Reflected Cross-Site Scripting via PHP\_SELF Parameter (CVSS 6.1, etspring LJ comments import: reloaded)
- [CVE-2026-6555](https://cve.now/CVE-2026-6555.md): ProSolution WP Client \<= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files' (CVSS 9.8, ProSolution WP Client)
- [CVE-2026-8418](https://cve.now/CVE-2026-8418.md): Games Catalog \<= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion (CVSS 4.3, askywhale Games Catalog)
- [CVE-2026-43617](https://cve.now/CVE-2026-43617.md): Rsync \< 3.4.3 Authorization Bypass via Hostname Resolution (CVSS 6.3, RsyncProject rsync)
- [CVE-2026-43618](https://cve.now/CVE-2026-43618.md): Rsync \< 3.4.3 Integer Overflow Information Disclosure (CVSS 6.1, RsyncProject rsync)
- [CVE-2026-43619](https://cve.now/CVE-2026-43619.md): Rsync \< 3.4.3 Symlink Race Condition via Path-Based Syscalls (CVSS 7.2, RsyncProject rsync)
- [CVE-2026-43620](https://cve.now/CVE-2026-43620.md): Rsync \< 3.4.3 Out-of-Bounds Array Read via recv\_files() (CVSS 6.9, RsyncProject rsync)
- [CVE-2026-45232](https://cve.now/CVE-2026-45232.md): Rsync \< 3.4.3 Off-by-One Stack Write via HTTP Proxy (CVSS 2.1, RsyncProject rsync)
- [CVE-2026-30691](https://cve.now/CVE-2026-30691.md): Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a (CVSS 6.1, @cyntler/react-doc-viewer)
- [CVE-2026-39047](https://cve.now/CVE-2026-39047.md): Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Printing Service (JetDir (CVSS 7.5)
- [CVE-2026-44923](https://cve.now/CVE-2026-44923.md): SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges. (CVSS 6.5)
- [CVE-2026-44924](https://cve.now/CVE-2026-44924.md): InfoScale VIOM 9.1.3 allows XSS. (CVSS 5.4)
- [CVE-2026-44925](https://cve.now/CVE-2026-44925.md): Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force the user with an (CVSS 8.8)
- [CVE-2026-44926](https://cve.now/CVE-2026-44926.md): InfoScale CmdServer before 7.4.2 mishandles access control. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.