# CVEs published 2026-05-21

187 CVEs were published on May 21, 2026: 15 critical, 72 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-4093](https://cve.now/CVE-2026-4093.md): Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels) (CVSS 5.1, Drupal Term Reference Tree)
- [CVE-2026-4929](https://cve.now/CVE-2026-4929.md): Simple Hierarchical Select (Drupal 7) XSS in term-derived output (CVSS 5.1, Drupal Simple Hierarchical Select)
- [CVE-2026-8139](https://cve.now/CVE-2026-8139.md): Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName (CVSS 2.0, Concrete CMS · concrete5/concrete5)
- [CVE-2026-7890](https://cve.now/CVE-2026-7890.md): Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block (CVSS 2.1, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8409](https://cve.now/CVE-2026-8409.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8410](https://cve.now/CVE-2026-8410.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8411](https://cve.now/CVE-2026-8411.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8412](https://cve.now/CVE-2026-8412.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8413](https://cve.now/CVE-2026-8413.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8414](https://cve.now/CVE-2026-8414.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8415](https://cve.now/CVE-2026-8415.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8416](https://cve.now/CVE-2026-8416.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-6960](https://cve.now/CVE-2026-6960.md): BookingPress Pro \<= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field (CVSS 9.8, Repute Infosystems BookingPress Appointment Booking Pro)
- [CVE-2026-8427](https://cve.now/CVE-2026-8427.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8432](https://cve.now/CVE-2026-8432.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8433](https://cve.now/CVE-2026-8433.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8434](https://cve.now/CVE-2026-8434.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8435](https://cve.now/CVE-2026-8435.md): Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-7887](https://cve.now/CVE-2026-7887.md): For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-7886](https://cve.now/CVE-2026-7886.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments\[\] parameter (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-7882](https://cve.now/CVE-2026-7882.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8327](https://cve.now/CVE-2026-8327.md): Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. (CVSS 5.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8245](https://cve.now/CVE-2026-8245.md): Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection (CVSS 6.0, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8337](https://cve.now/CVE-2026-8337.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8240](https://cve.now/CVE-2026-8240.md): Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\\SummaryTemplate (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-7881](https://cve.now/CVE-2026-7881.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-7879](https://cve.now/CVE-2026-7879.md): Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit\_password() (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-5091](https://cve.now/CVE-2026-5091.md): Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks (CVSS 5.1, JJNAPIORK Catalyst::Plugin::Authentication)
- [CVE-2026-8238](https://cve.now/CVE-2026-8238.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message\_page' allowing unauthenticated read of any conversation message (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8237](https://cve.now/CVE-2026-8237.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in the\`/ccm/frontend/conversations/message\_detail\` endpoint (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8239](https://cve.now/CVE-2026-8239.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get\_rating' (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-22678](https://cve.now/CVE-2026-22678.md): Webmin \< 2.641 Stored XSS via System and Server Status (CVSS 5.1, Webmin)
- [CVE-2026-8236](https://cve.now/CVE-2026-8236.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID} (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8205](https://cve.now/CVE-2026-8205.md): Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action\_get\_events does not check canView on the calendar (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8204](https://cve.now/CVE-2026-8204.md): Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog (CVSS 6.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-6826](https://cve.now/CVE-2026-6826.md): Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller (CVSS 6.9, Concrete CMS · concrete5/concrete5)
- [CVE-2026-47102](https://cve.now/CVE-2026-47102.md): LiteLLM \< 1.83.10 Privilege Escalation via User Update (CVSS 8.7, BerriAI litellm · litellm)
- [CVE-2026-47101](https://cve.now/CVE-2026-47101.md): LiteLLM \< 1.83.14 Privilege Escalation via API Key Generation (CVSS 8.7, BerriAI litellm · litellm)
- [CVE-2026-8203](https://cve.now/CVE-2026-8203.md): Concrete CMS 9.5.0 and below has Stored XSS on the height parameter (CVSS 7.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8197](https://cve.now/CVE-2026-8197.md): Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name (CVSS 7.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8350](https://cve.now/CVE-2026-8350.md): Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk\_user\_assignment.php which can lead to privilege escalation to Administrative Group (CVSS 7.5, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8421](https://cve.now/CVE-2026-8421.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF on install\_package() with conditional token bypass leading to RCE (CVSS 7.5, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8428](https://cve.now/CVE-2026-8428.md): CSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and below (CVSS 7.5, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8426](https://cve.now/CVE-2026-8426.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF on prepare\_remote\_upgrade() leading to one-request RCE via package overwrite (CVSS 7.5, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8140](https://cve.now/CVE-2026-8140.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controller (CVSS 7.5, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8417](https://cve.now/CVE-2026-8417.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF in do\_update() in the package update controller (CVSS 7.5, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8135](https://cve.now/CVE-2026-8135.md): Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller. (CVSS 8.9, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8134](https://cve.now/CVE-2026-8134.md): Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion (CVSS 9.4, Concrete CMS · concrete5/concrete5)
- [CVE-2026-47114](https://cve.now/CVE-2026-47114.md): IINA \< 1.4.3 Command Execution via iina://open URL Scheme (CVSS 8.6, iina)
- [CVE-2026-4843](https://cve.now/CVE-2026-4843.md): GSheet For Woo Importer \<= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset (CVSS 4.3, mrdollar4444 GSheet For Woo Importer)
- [CVE-2026-46473](https://cve.now/CVE-2026-46473.md): Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand (CVSS 7.5, TCHATZI Authen::TOTP)
- [CVE-2026-48249](https://cve.now/CVE-2026-48249.md): Open ISES Tickets \< 3.44.2 Disabled TLS Certificate Verification in rm/incs/mobile\_login.inc.php (CVSS 8.2, Open ISES Tickets)
- [CVE-2026-48248](https://cve.now/CVE-2026-48248.md): Open ISES Tickets \< 3.44.2 Disabled TLS Certificate Verification in incs/login.inc.php (CVSS 8.2, Open ISES Tickets)
- [CVE-2026-48247](https://cve.now/CVE-2026-48247.md): Open ISES Tickets \< 3.44.2 Disabled TLS Certificate Verification in incs/functions.inc.php (CVSS 8.2, Open ISES Tickets)
- [CVE-2026-48246](https://cve.now/CVE-2026-48246.md): Open ISES Tickets \< 3.44.2 Disabled TLS Certificate Verification in ajax/reports.php (CVSS 8.2, Open ISES Tickets)
- [CVE-2026-48245](https://cve.now/CVE-2026-48245.md): Open ISES Tickets \< 3.44.2 Hardcoded Google Maps API Key in tables.php (CVSS 6.9, Open ISES Tickets)
- [CVE-2026-48244](https://cve.now/CVE-2026-48244.md): Open ISES Tickets \< 3.44.2 Hardcoded Google Maps API Key in settings.inc.php (CVSS 6.9, Open ISES Tickets)
- [CVE-2026-48243](https://cve.now/CVE-2026-48243.md): Open ISES Tickets \< 3.44.2 Hardcoded WhitePages API Key in wp1.php (CVSS 6.9, Open ISES Tickets)
- [CVE-2026-48242](https://cve.now/CVE-2026-48242.md): Open ISES Tickets \< 3.44.2 Hardcoded MySQL Database Credentials in import\_mdb.php (CVSS 9.2, Open ISES Tickets)
- [CVE-2026-48241](https://cve.now/CVE-2026-48241.md): Open ISES Tickets \< 3.44.2 Hardcoded MySQL Database Credentials in loader.php (CVSS 9.2, Open ISES Tickets)
- [CVE-2026-48240](https://cve.now/CVE-2026-48240.md): Open ISES Tickets \< 3.44.2 SQL Injection via ajax/statistics.php tick\_id and f\_tick\_id Parameters (CVSS 7.1, Open ISES Tickets)
- [CVE-2026-48239](https://cve.now/CVE-2026-48239.md): Open ISES Tickets \< 3.44.2 SQL Injection via ajax/reports.php tick\_id Parameter (CVSS 7.1, Open ISES Tickets)
- [CVE-2026-48238](https://cve.now/CVE-2026-48238.md): Open ISES Tickets \< 3.44.2 SQL Injection via ajax/mobile\_main.php id Parameter (CVSS 7.1, Open ISES Tickets)
- [CVE-2026-48237](https://cve.now/CVE-2026-48237.md): Open ISES Tickets \< 3.44.2 SQL Injection via message.php frm\_ticket\_id and frm\_resp\_id Parameters (CVSS 7.1, Open ISES Tickets)
- [CVE-2026-48236](https://cve.now/CVE-2026-48236.md): Open ISES Tickets \< 3.44.2 SQL Injection via db\_loader.php Multiple Parameters (CVSS 7.1, Open ISES Tickets)
- [CVE-2026-48235](https://cve.now/CVE-2026-48235.md): Open ISES Tickets \< 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker Data (CVSS 8.8, Open ISES Tickets)
- [CVE-2026-48234](https://cve.now/CVE-2026-48234.md): Open ISES Tickets \< 3.44.2 SQL Injection via portal/ajax/list\_requests.php sort and dir Parameters (CVSS 7.1, Open ISES Tickets)
- [CVE-2026-48233](https://cve.now/CVE-2026-48233.md): Open ISES Tickets \< 3.44.2 SQL Injection via ajax/sit\_incidents.php offset Parameter (CVSS 7.1, Open ISES Tickets)
- [CVE-2026-48232](https://cve.now/CVE-2026-48232.md): Open ISES Tickets \< 3.44.2 SQL Injection via ajax/fullsit\_incidents.php offset Parameter (CVSS 7.1, Open ISES Tickets)
- [CVE-2026-48231](https://cve.now/CVE-2026-48231.md): Open ISES Tickets \< 3.44.2 SQL Injection via tables.php Multiple Parameters (CVSS 7.1, Open ISES Tickets)
- [CVE-2026-48230](https://cve.now/CVE-2026-48230.md): Open ISES Tickets \< 3.44.2 Reflected XSS via ticketsmdb\_import.php Multiple POST Parameters (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48229](https://cve.now/CVE-2026-48229.md): Open ISES Tickets \< 3.44.2 Reflected XSS via routes\_i.php ticket\_id Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48228](https://cve.now/CVE-2026-48228.md): Open ISES Tickets \< 3.44.2 Reflected XSS via patient\_w.php id and ticket\_id Parameters (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48227](https://cve.now/CVE-2026-48227.md): Open ISES Tickets \< 3.44.2 Reflected XSS via patient.php id and ticket\_id Parameters (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48226](https://cve.now/CVE-2026-48226.md): Open ISES Tickets \< 3.44.2 Reflected XSS via os\_watch.php ref and mode\_orig Parameters (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48225](https://cve.now/CVE-2026-48225.md): Open ISES Tickets \< 3.44.2 Reflected XSS via landb.php \_type Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48224](https://cve.now/CVE-2026-48224.md): Open ISES Tickets \< 3.44.2 Reflected XSS via ics214.php frm\_add\_str Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48223](https://cve.now/CVE-2026-48223.md): Open ISES Tickets \< 3.44.2 Reflected XSS via ics213rr.php frm\_add\_str Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48222](https://cve.now/CVE-2026-48222.md): Open ISES Tickets \< 3.44.2 Reflected XSS via ics213.php frm\_add\_str Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48221](https://cve.now/CVE-2026-48221.md): Open ISES Tickets \< 3.44.2 Reflected XSS via ics205a.php frm\_add\_str Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48220](https://cve.now/CVE-2026-48220.md): Open ISES Tickets \< 3.44.2 Reflected XSS via ics205.php frm\_add\_str Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48219](https://cve.now/CVE-2026-48219.md): Open ISES Tickets \< 3.44.2 Reflected XSS via ics202.php frm\_add\_str Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48218](https://cve.now/CVE-2026-48218.md): Open ISES Tickets \< 3.44.2 Reflected XSS via icons/buttons/landb.php frm\_name and frm\_id Parameters (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48217](https://cve.now/CVE-2026-48217.md): Open ISES Tickets \< 3.44.2 Reflected XSS via delete\_module.php Multiple POST Parameters (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48216](https://cve.now/CVE-2026-48216.md): Open ISES Tickets \< 3.44.2 Reflected XSS via db\_loader.php Multiple POST Parameters (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48215](https://cve.now/CVE-2026-48215.md): Open ISES Tickets \< 3.44.2 Reflected XSS via circle.php frm\_id Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48214](https://cve.now/CVE-2026-48214.md): Open ISES Tickets \< 3.44.2 Reflected XSS via add\_nm.php ticket\_id Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-39593](https://cve.now/CVE-2026-39593.md): WordPress HAPPY plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 6.5, VillaTheme HAPPY)
- [CVE-2026-48213](https://cve.now/CVE-2026-48213.md): Open ISES Tickets \< 3.44.2 Reflected XSS via add.php ticket\_id Parameter (CVSS 5.1, Open ISES Tickets)
- [CVE-2026-48207](https://cve.now/CVE-2026-48207.md): Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement (CVSS 9.8, Apache Software Foundation Apache Fory · pyfory)
- [CVE-2026-39531](https://cve.now/CVE-2026-39531.md): WordPress WP Directory Kit plugin \<= 1.5.0 - SQL Injection vulnerability (CVSS 9.3, WP Directory Kit)
- [CVE-2026-9089](https://cve.now/CVE-2026-9089.md): The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operatio (CVSS 8.8, ConnectWise Automate)
- [CVE-2026-1816](https://cve.now/CVE-2026-1816.md): OTP Bypass in TEİAŞ's Mobile Application (CVSS 6.3, Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile…)
- [CVE-2026-1815](https://cve.now/CVE-2026-1815.md): Session Hijacking in TEİAŞ's Mobile Application (CVSS 5.7, Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile…)
- [CVE-2025-13479](https://cve.now/CVE-2025-13479.md): IDOR in PosCube's QR Menu (CVSS 7.5, PosCube Hardware Software and Consulting QR Menu)
- [CVE-2026-45208](https://cve.now/CVE-2026-45208.md): A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installa (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2026-45207](https://cve.now/CVE-2026-45207.md): An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2026-45206](https://cve.now/CVE-2026-45206.md): An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2026-34930](https://cve.now/CVE-2026-34930.md): An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2026-34929](https://cve.now/CVE-2026-34929.md): An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2026-34928](https://cve.now/CVE-2026-34928.md): An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2026-34927](https://cve.now/CVE-2026-34927.md): An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2026-34926](https://cve.now/CVE-2026-34926.md): A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table (CVSS 6.7, KEV, Trend Micro TrendAI Apex One)
- [CVE-2025-71217](https://cve.now/CVE-2025-71217.md): An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to e (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2025-71216](https://cve.now/CVE-2025-71216.md): A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate p (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2025-71215](https://cve.now/CVE-2025-71215.md): A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local a (CVSS 7.0, Trend Micro TrendAI Apex One)
- [CVE-2025-71214](https://cve.now/CVE-2025-71214.md): An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate priv (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2025-71213](https://cve.now/CVE-2025-71213.md): An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatio (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2025-71212](https://cve.now/CVE-2025-71212.md): A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected insta (CVSS 7.8, Trend Micro TrendAI Apex One)
- [CVE-2025-71211](https://cve.now/CVE-2025-71211.md): A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands o (CVSS 9.8, Trend Micro TrendAI Apex One)
- [CVE-2025-71210](https://cve.now/CVE-2025-71210.md): A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands o (CVSS 9.8, Trend Micro TrendAI Apex One)
- [CVE-2025-13477](https://cve.now/CVE-2025-13477.md): OTP Bypass in Digital Operation Services' WifiBurada (CVSS 7.1, Digital Operations Services WifiBurada)
- [CVE-2026-2740](https://cve.now/CVE-2026-2740.md): Remote Code Execution (CVSS 8.4, Zohocorp ManageEngine ADSelfService Plus · Zohocorp Mana… +1)
- [CVE-2026-43502](https://cve.now/CVE-2026-43502.md): net/rds: handle zerocopy send cleanup before the message is queued (CVSS 7.8, Linux)
- [CVE-2026-43501](https://cve.now/CVE-2026-43501.md): ipv6: rpl: reserve mac\_len headroom when recompressed SRH grows (CVSS 9.8, Linux)
- [CVE-2026-43499](https://cve.now/CVE-2026-43499.md): rtmutex: Use waiter::task instead of current in remove\_waiter() (CVSS 7.8, Linux)
- [CVE-2026-43498](https://cve.now/CVE-2026-43498.md): accel/ivpu: Disallow re-exporting imported GEM objects (CVSS 7.8, Linux)
- [CVE-2026-43497](https://cve.now/CVE-2026-43497.md): fbdev: udlfb: add vm\_ops to dlfb\_ops\_mmap to prevent use-after-free (CVSS 7.3, Linux)
- [CVE-2026-43496](https://cve.now/CVE-2026-43496.md): net/sched: sch\_red: Replace direct dequeue call with peek and qdisc\_dequeue\_peeked (no CVSS, Linux)
- [CVE-2026-43495](https://cve.now/CVE-2026-43495.md): net: wwan: t7xx: validate port\_count against message length in t7xx\_port\_enum\_msg\_handler (CVSS 8.8, Linux)
- [CVE-2026-6841](https://cve.now/CVE-2026-6841.md): Reflected XSS in Request Tracker (CVSS 5.1, Best Practical Request Tracker)
- [CVE-2026-45760](https://cve.now/CVE-2026-45760.md): Apache Camel K: Camel K Cross-Namespace Build Deputy Attack (CVSS 8.1, Apache Software Foundation Apache Camel K · github.com/a… +1)
- [CVE-2026-5118](https://cve.now/CVE-2026-5118.md): Divi Form Builder \<= 5.1.2 - Unauthenticated Privilege Escalation via 'role' (CVSS 9.8, Divi Engine Divi Form Builder)
- [CVE-2026-43494](https://cve.now/CVE-2026-43494.md): net/rds: reset op\_nents when zerocopy page pin fails (CVSS 7.8, Linux)
- [CVE-2026-0393](https://cve.now/CVE-2026-0393.md): CODESYS Visualization - Insufficiently Protected Credentials (CVSS 6.9, CODESYS Visualization)
- [CVE-2026-45254](https://cve.now/CVE-2026-45254.md): Incorrect libcap\_net limitation list manipulation (CVSS 6.5, FreeBSD)
- [CVE-2026-41999](https://cve.now/CVE-2026-41999.md): Incorrect Behaviour of Views with TCP PROXY Requests (CVSS 4.8, PowerDNS Authoritative)
- [CVE-2026-45255](https://cve.now/CVE-2026-45255.md): Remote code execution via installer Wi-Fi access point scans (CVSS 7.5, FreeBSD)
- [CVE-2026-42002](https://cve.now/CVE-2026-42002.md): Concurrency and locking defects in GSS-TSIG (CVSS 5.9, PowerDNS Authoritative)
- [CVE-2026-42001](https://cve.now/CVE-2026-42001.md): Insufficient Validation of Autoprimary SOA Queries (CVSS 7.5, PowerDNS Authoritative)
- [CVE-2026-42000](https://cve.now/CVE-2026-42000.md): Insufficient Validation of Names During AXFR (CVSS 6.8, PowerDNS Authoritative)
- [CVE-2026-42396](https://cve.now/CVE-2026-42396.md): Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail (CVSS 4.9, PowerDNS Authoritative)
- [CVE-2026-39461](https://cve.now/CVE-2026-39461.md): select(2) file descriptor set overflow causes stack overflow (CVSS 8.8, FreeBSD)
- [CVE-2026-45253](https://cve.now/CVE-2026-45253.md): Missing validation in ptrace(PT\_SC\_REMOTE) (CVSS 8.4, FreeBSD)
- [CVE-2026-45252](https://cve.now/CVE-2026-45252.md): Heap overflow in FUSE\_LISTXATTR (CVSS 5.5, FreeBSD)
- [CVE-2026-45251](https://cve.now/CVE-2026-45251.md): Kernel use-after-free via file descriptor syscalls (CVSS 7.8, FreeBSD)
- [CVE-2026-28764](https://cve.now/CVE-2026-28764.md): A heap-based buffer overflow vulnerability exists in the LXF element parsing functionality of MediaInfoLib (version(s): 26.01). (CVSS 7.8, MediaArea MediaInfoLib)
- [CVE-2026-5434](https://cve.now/CVE-2026-5434.md): Improper storage of sensitive information (CVSS 5.9, Honeywell International Control Network Module)
- [CVE-2026-45250](https://cve.now/CVE-2026-45250.md): Stack buffer overflow via setcred(2) (CVSS 7.8, FreeBSD)
- [CVE-2026-5433](https://cve.now/CVE-2026-5433.md): Improper sanitization (CVSS 9.1, Honeywell International Control Network Module)
- [CVE-2026-27393](https://cve.now/CVE-2026-27393.md): WordPress CF7 WOW Styler plugin \<= 1.7.6 - Broken Access Control vulnerability (CVSS 5.3, Tobias CF7 WOW Styler)
- [CVE-2026-22880](https://cve.now/CVE-2026-22880.md): Mobile SSO authentication flow allows credential theft via malicious server (CVSS 6.1, Mattermost)
- [CVE-2026-27349](https://cve.now/CVE-2026-27349.md): WordPress Mail Mint plugin \<= 1.19.5 - Sensitive Data Exposure vulnerability (CVSS 4.3, WPFunnels Team Mail Mint)
- [CVE-2026-7837](https://cve.now/CVE-2026-7837.md): TOCTOU with root privilege in ad\_flush (CVSS 3.7, Netatalk)
- [CVE-2026-44075](https://cve.now/CVE-2026-44075.md): Missing break in DSI OpenSession (CVSS 3.7, Netatalk)
- [CVE-2026-44074](https://cve.now/CVE-2026-44074.md): Bitwise OR of errno values (CVSS 3.7, Netatalk)
- [CVE-2026-44071](https://cve.now/CVE-2026-44071.md): FORTIFY\_SOURCE disabled (CVSS 3.7, Netatalk)
- [CVE-2026-44057](https://cve.now/CVE-2026-44057.md): Dead bounds check in Spotlight RPC unmarshaller (CVSS 3.1, Netatalk)
- [CVE-2026-4858](https://cve.now/CVE-2026-4858.md): Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. (CVSS 8.0, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-9157](https://cve.now/CVE-2026-9157.md): Remote Code Execution in Gmission Web FAX (CVSS 8.6, Gmission Web Fax)
- [CVE-2026-7836](https://cve.now/CVE-2026-7836.md): hextoint macro uppercase bug (CVSS 3.1, Netatalk)
- [CVE-2026-7835](https://cve.now/CVE-2026-7835.md): Format string argument mismatch (CVSS 3.1, Netatalk)
- [CVE-2026-44076](https://cve.now/CVE-2026-44076.md): Shell injection via volume path (CVSS 6.7, Netatalk)
- [CVE-2026-44073](https://cve.now/CVE-2026-44073.md): seteuid failure ignored in auth modules (CVSS 4.0, Netatalk)
- [CVE-2026-44072](https://cve.now/CVE-2026-44072.md): system() after failed chdir() (CVSS 2.5, Netatalk)
- [CVE-2026-44070](https://cve.now/CVE-2026-44070.md): Unbounded realloc in charset conversion (CVSS 3.1, Netatalk)
- [CVE-2026-44069](https://cve.now/CVE-2026-44069.md): Integer underflow in volxlate (CVSS 3.4, Netatalk)
- [CVE-2026-44068](https://cve.now/CVE-2026-44068.md): EA path traversal via incomplete sanitization (CVSS 7.6, Netatalk)
- [CVE-2026-44067](https://cve.now/CVE-2026-44067.md): EA header parsing heap over-read (CVSS 3.7, Netatalk)
- [CVE-2026-44066](https://cve.now/CVE-2026-44066.md): Heap out-of-bounds reads in Spotlight RPC unmarshalling (CVSS 7.1, Netatalk)
- [CVE-2026-44065](https://cve.now/CVE-2026-44065.md): Off-by-two in papd lp\_write() (CVSS 3.7, Netatalk)
- [CVE-2026-44064](https://cve.now/CVE-2026-44064.md): ASP session ID out-of-bounds access (CVSS 7.1, Netatalk)
- [CVE-2026-44063](https://cve.now/CVE-2026-44063.md): LDAP filter injection (CVSS 4.2, Netatalk)
- [CVE-2026-44062](https://cve.now/CVE-2026-44062.md): Missing o\_len bounds check in pull\_charset\_flags() (CVSS 7.5, Netatalk)
- [CVE-2026-44061](https://cve.now/CVE-2026-44061.md): DES-ECB auth with timing side channel (CVSS 5.9, Netatalk)
- [CVE-2026-44060](https://cve.now/CVE-2026-44060.md): Integer underflow in dsi\_writeinit() leads to denial of service (CVSS 7.5, Netatalk)
- [CVE-2026-44059](https://cve.now/CVE-2026-44059.md): Non-reentrant privilege toggle (CVSS 3.9, Netatalk)
- [CVE-2026-44058](https://cve.now/CVE-2026-44058.md): Authentication bypass via admin auth user (CVSS 6.4, Netatalk)
- [CVE-2026-44056](https://cve.now/CVE-2026-44056.md): Stack buffer overflow in desktop.c (CVSS 6.0, Netatalk)
- [CVE-2026-44055](https://cve.now/CVE-2026-44055.md): Bitwise OR logic bug enables shell injection (CVSS 7.5, Netatalk)
- [CVE-2026-44054](https://cve.now/CVE-2026-44054.md): Predictable afpd session token (CVSS 6.5, Netatalk)
- [CVE-2026-44053](https://cve.now/CVE-2026-44053.md): Weak cryptography in DHCAST128 UAM (CVSS 7.4, Netatalk)
- [CVE-2026-44052](https://cve.now/CVE-2026-44052.md): LDAP simple-bind password exposure in log output (CVSS 7.5, Netatalk)
- [CVE-2026-44051](https://cve.now/CVE-2026-44051.md): Arbitrary file read via attacker-controlled symlink creation (CVSS 8.1, Netatalk)
- [CVE-2026-44050](https://cve.now/CVE-2026-44050.md): Heap buffer overflow in CNID daemon comm\_rcv() (CVSS 9.9, Netatalk)
- [CVE-2026-44049](https://cve.now/CVE-2026-44049.md): Out-of-bounds write in convert\_charset() null termination (CVSS 7.5, Netatalk)
- [CVE-2026-44048](https://cve.now/CVE-2026-44048.md): Stack buffer overflow via UCS-2 type confusion in convert\_charset() (CVSS 8.8, Netatalk)
- [CVE-2026-44047](https://cve.now/CVE-2026-44047.md): SQL injection in MySQL CNID backend (CVSS 8.8, Netatalk)
- [CVE-2026-4055](https://cve.now/CVE-2026-4055.md): Insufficient permission validation on cross-team playbook run creation (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2026-1543](https://cve.now/CVE-2026-1543.md): Avada (Fusion) Builder \<= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4, themefusion Avada (Fusion) Builder)
- [CVE-2026-6279](https://cve.now/CVE-2026-6279.md): Avada (Fusion) Builder \<= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render\_logics' Shortcode Attribute via Widget AJAX Handler (CVSS 9.8, themefusion Avada (Fusion) Builder)
- [CVE-2026-2734](https://cve.now/CVE-2026-2734.md): Authorization Bypass in SearchModelVersions in mlflow/mlflow (CVSS 6.5, mlflow/mlflow · mlflow)
- [CVE-2026-4811](https://cve.now/CVE-2026-4811.md): WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons \<= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category Field (CVSS 4.9, wpbean WPB Floating Menu or Categories – Sticky Floating Si…)
- [CVE-2026-1881](https://cve.now/CVE-2026-1881.md): Broadstreet \<= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get\_sponsored\_meta (CVSS 4.3, broadstreetads Broadstreet)
- [CVE-2026-9152](https://cve.now/CVE-2026-9152.md): Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction (CVSS 10.0, Altium)
- [CVE-2026-48172](https://cve.now/CVE-2026-48172.md): LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. (CVSS 10.0, KEV, LiteSpeed Technologies cPanel Plugin · LiteSpeed Technologi…)
- [CVE-2026-36189](https://cve.now/CVE-2026-36189.md): Buffer Overflow vulnerability in Uncrustify Project Affected v.Uncrustify\_d-0.82.0-132-bcc41cbdc and Fixed in commit 68e67b9a1435a1bb173b106 (CVSS 6.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.