CVEs published May 22, 2026
152 CVEs were published on May 22, 2026: 26 critical, 44 high. 4 are now in CISA KEV.
- Published
- 152
- Critical
- 26
- High
- 44
- Medium
- 71
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 4
- Fix available
- 112
Most affected products
- Devolutions Server
- 12
- baptisteArno typebot.io
- 9
- golang.org/x/crypto/ssh · golang.org/x/crypto
- 9
- Dell PowerFlex Manager
- 7
- golang.org/x/net/html · golang.org/x/net
- 5
- bestpractical rt
- 4
- mantisbt · mantisbt/mantisbt
- 4
- Mattermost · github.com/mattermost/mattermost-server
- 4
- syslink software AG Avantra
- 4
- Centralny Instytut Ochrony Pracy - Państwowy Instytut Badaw…
- 3
Critical 26
- CVE-2026-42901Microsoft Entra ID Elevation of Privilege VulnerabilityMicrosoft Entra
- CVE-2026-41104Microsoft Planetary Computer Pro Information Disclosure VulnerabilityMicrosoft Planetary Computer Pro
- CVE-2026-33843Microsoft Azure Active Directory B2C Elevation of Privilege VulnerabilityMicrosoft Entra
- CVE-2026-41090Microsoft Copilot Tampering VulnerabilityMicrosoft 365 Copilot for iOS
- CVE-2026-47280Azure Resource Manager Elevation of Privilege VulnerabilityMicrosoft Azure Resource Manager
- CVE-2026-40411Azure Virtual Network Gateway Remote Code Execution VulnerabilityMicrosoft Azure Virtual Network Gateway
- CVE-2026-23652Microsoft Power Pages Remote Code Execution VulnerabilityMicrosoft Power Pages
- CVE-2026-40412Azure Orbital Spatio Remote Code Execution VulnerabilityMicrosoft Azure Orbital Spatio
- CVE-2026-48700An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0.LXQt PCManFM-Qt
- CVE-2026-32253Sunshine: Authentication bypass via improper client certificate validationLizardByte Sunshine
- CVE-2026-33712TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controlsbaptisteArno typebot.io
- CVE-2026-39821Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaGo standard library net/http · Go standard library net/h… +3
- CVE-2026-8670Insecure session handling on metrics web serversyslink software AG Avantra
- CVE-2026-9054Invalid IP packets cause a kernel panic9front
- CVE-2026-46595Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-42508Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsgolang.org/x/crypto/ssh/knownhosts · golang.org/x/crypto
- CVE-2026-39834Invoking infinite loop on large channel writes in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-39831Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-39830Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-39832Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentgolang.org/x/crypto/ssh/agent · golang.org/x/crypto
- CVE-2026-39833Invoking key constraints not enforced in golang.org/x/crypto/ssh/agentgolang.org/x/crypto/ssh/agent · golang.org/x/crypto
- CVE-2026-9264Cross-Site Scripting in SketchUp Dynamic ComponentsTrimble SketchUp
- CVE-2026-33000A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Ubiquiti UniFi OS Server
- CVE-2026-34910A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute aUbiquiti UniFi OS Server · Ubiquiti UDM +29
- CVE-2026-34908A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthUbiquiti UniFi OS Server · Ubiquiti UDM +29
- CVE-2026-34909A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the uUbiquiti UniFi OS Server · Ubiquiti Express +29
High 44
- CVE-2026-23663Microsoft Global Secure Access (GSA) Information Disclosure VulnerabilityMicrosoft Global Secure Access
- CVE-2026-45659Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-26147Azure Stack HCI Information Disclosure VulnerabilityMicrosoft Azure Stack HCI
- CVE-2026-35430Azure Privileged Identity Management (PIM) Elevation of Privilege VulnerabilityMicrosoft Azure Privileged Identity Management
- CVE-2026-41147NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request classnukeviet · nukeviet/nukeviet
- CVE-2026-41076RT: LDAP authentication bypass via empty passwordbestpractical rt
- CVE-2026-41075RT: SQL injection via entry_aggregator parameter in JSON searchbestpractical rt
- CVE-2026-41074RT has broken CSRF protection for authenticated usersbestpractical rt
- CVE-2026-3294Authentication Logic Vulnerability on Multiple TP-Link Range ExtendersTP-Link Systems Archer RE650 · TP-Link Systems Archer RE… +3
- CVE-2026-40607MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Columnmantisbt · mantisbt/mantisbt
- CVE-2026-40597MantisBT has a Content Security Policy bypass via attachmentsmantisbt · mantisbt/mantisbt
- CVE-2026-5843Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loadingDocker Desktop
- CVE-2026-40596MantisBT is vulnerable to XSS and potential account takeover via user font family preference updatemantisbt · mantisbt/mantisbt
- CVE-2026-5817Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backendsDocker Desktop
- CVE-2026-40172authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superusergoauthentik authentik
- CVE-2026-40166authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/goauthentik authentik
- CVE-2026-6406Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flagDocker Desktop
- CVE-2026-39968TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview EndpointbaptisteArno typebot.io
- CVE-2026-9291Insecure Deserialization in Amazon Braket SDK Job Results ProcessingAWS Amazon Braket Python SDK · amazon-braket-sdk
- CVE-2026-39970TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture FormbaptisteArno typebot.io
- CVE-2026-39965TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code BlocksbaptisteArno typebot.io
- CVE-2026-34207TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request ValidationbaptisteArno typebot.io
- CVE-2026-9255Tool Execution Without Authorization via Piped Stdin in Kiro CLIAWS Kiro CLI
- CVE-2026-28445Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder PreviewbaptisteArno typebot.io · @typebot.io/js
- CVE-2026-7325Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain aDevolutions Server
- CVE-2026-9047Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knDevolutions Server
- CVE-2026-8992An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to exivanti Secure Access Client
- CVE-2026-9256NGINX ngx_http_rewrite_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2026-9277shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`shell-quote
- CVE-2026-8671Log Files contain encrypted secretssyslink software AG Avantra
- CVE-2026-44417Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-5740Unauthenticated WebSocket binary frame causes denial of service in Mattermost ServerMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-25606SQL Injection in STERCentralny Instytut Ochrony Pracy - Państwowy Instytut Badaw…
- CVE-2026-8679AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parametercssigniterteam AudioIgniter Music Player
- CVE-2026-9011Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Actionmetaphorcreations Ditty – Responsive News Tickers, Sliders,…
- CVE-2026-9018Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameterthemewant Easy Elements for Elementor – Addons & Website Te…
- CVE-2026-39829Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-46597Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-4834WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' ParameterweDevs WP ERP Pro
- CVE-2026-34911A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to acUbiquiti UniFi OS Server · Ubiquiti UDM +29
- CVE-2025-45145Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 allows remote attackers to read arbitra
- CVE-2026-36228Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code vi
- CVE-2026-37470An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTT
- CVE-2026-46727An issue was discovered in Ruby 4 before 4.0.5.ruby-lang Ruby
Medium, low and unrated 82
- CVE-2026-41149Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injectionmermaid-js mermaid · mermaid
- CVE-2026-41148Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injectionmermaid-js mermaid · mermaid
- CVE-2026-42827M365 Copilot Information Disclosure VulnerabilityMicrosoft 365 Copilot
- CVE-2026-41073RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar appsbestpractical rt
- CVE-2026-41071libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample countstrukturag libheif
- CVE-2026-41069libheif allows Out-of-bounds vector access leading to invalid dereference (DoS)strukturag libheif
- CVE-2026-40864JupyterHub: Cross-origin form POSTs bypass XSRFjupyterhub
- CVE-2026-40610BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build contextBentoML
- CVE-2026-39824Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windowsgolang.org/x/sys/windows · golang.org/x/sys
- CVE-2026-40598MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Pagemantisbt · mantisbt/mantisbt
- CVE-2026-40295Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handlerheartcombo devise · devise
- CVE-2026-39969TypeBot: WhatsApp Webhook Endpoint Missing Signature VerificationbaptisteArno typebot.io
- CVE-2026-39967TypeBot: Cross-Typebot Result Data Access via Missing typebotId FilterbaptisteArno typebot.io
- CVE-2026-39966TypeBot: Async filter() bypasses authorization, allowing IDOR in getLinkedTypebots and leaking cross-workspace bot definitionsbaptisteArno typebot.io
- CVE-2026-39964TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsersbaptisteArno typebot.io · @typebot.io/js
- CVE-2026-28735GitHub OAuth Scope ValidationMattermost · github.com/mattermost/mattermost-server +1
- CVE-2026-28444Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data DisclosurebaptisteArno typebot.io
- CVE-2026-9251Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass tDevolutions Server
- CVE-2026-5171Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but witDevolutions Server
- CVE-2026-8477Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticateDevolutions Server
- CVE-2026-9246Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault reaDevolutions Server
- CVE-2026-9224Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify theirDevolutions Server
- CVE-2026-9249Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a craDevolutions Server
- CVE-2026-9245Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to reDevolutions Server
- CVE-2026-9247Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealDevolutions Server
- CVE-2026-9248Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to cDevolutions Server
- CVE-2026-9223Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user Devolutions Server
- CVE-2026-27136Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlgolang.org/x/net/html · golang.org/x/net
- CVE-2026-25681Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/htmlgolang.org/x/net/html · golang.org/x/net
- CVE-2026-25680Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/htmlgolang.org/x/net/html · golang.org/x/net
- CVE-2026-42502Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlgolang.org/x/net/html · golang.org/x/net
- CVE-2026-42506Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/htmlgolang.org/x/net/html · golang.org/x/net
- CVE-2022-34363Dell Unisphere for PowerMax vApp version prior to 10.0.0.2, contains an authorization bypass vulnerability in the Unisphere for VMAX applicDell Unisphere for PowerMax · Dell Unisphere
- CVE-2022-31231Dell ECS, versions 3.5 and 3.6, contain an Improper Access Control in the Identity and Access Management (IAM) module.Dell ECS
- CVE-2026-8353Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik themeConcrete CMS · concrete5/concrete5
- CVE-2021-21508Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager.Dell VxRail
- CVE-2026-8347Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialogConcrete CMS · concrete5/concrete5
- CVE-2026-8340Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersionConcrete CMS · concrete5/concrete5
- CVE-2025-32751Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability.Dell PowerFlex Manager
- CVE-2025-46371Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh.Dell PowerFlex Manager
- CVE-2025-26483Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability.Dell PowerFlex Manager
- CVE-2026-8997Heap Buffer Overflow in vifmvifm
- CVE-2025-32745Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation vulnerability.Dell PowerFlex Manager
- CVE-2026-8673Password re-initialization mechanism sends passwords in plain textsyslink software AG Avantra
- CVE-2026-8672Default credentials for internal DBsyslink software AG Avantra
- CVE-2025-32746Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability.Dell PowerFlex Manager
- CVE-2025-32747Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability.Dell PowerFlex Manager
- CVE-2025-32749Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability.Dell PowerFlex Manager
- CVE-2026-44618Apache CXF: XXE vulnerability in WS-Transfer functionalityApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-44930Apache CXF: LDAP Injection vulnerability in XKMS LDAP RepositoryApache Software Foundation Apache CXF · org.apache.cxf.serv…
- CVE-2026-4635Persistent notification timing attack causing server denial of serviceMattermost · github.com/mattermost/mattermost-server
- CVE-2026-3473Improper file ownership validation in the Boards API allows unauthorised file accessMattermost · github.com/mattermost/mattermost-server
- CVE-2026-4646Insufficient input validation in GitHub plugin API causes denial of serviceMattermost · github.com/mattermost/mattermost-server +1
- CVE-2026-3636Sanitize team member data returned by APIMattermost · github.com/mattermost/mattermost-server
- CVE-2026-5308Missing request body size limits on Zoom plugin HTTP endpointsMattermost · github.com/mattermost/mattermost-server +1
- CVE-2026-5755Denial of service via crafted TIFF file uploadMattermost · github.com/mattermost/mattermost-server
- CVE-2026-25608Lack of traffic encryption in STERCentralny Instytut Ochrony Pracy - Państwowy Instytut Badaw…
- CVE-2026-25607Weak password encoding in STERCentralny Instytut Ochrony Pracy - Państwowy Instytut Badaw…
- CVE-2026-8381Broken Access Control in TeamViewer DEX Platform (On Premises)TeamViewer DEX
- CVE-2026-8684MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Actionjetmonsters MotoPress Hotel Booking
- CVE-2026-7798FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parametertechjewel FluentCRM – Email Newsletter, Automation, Email M…
- CVE-2026-7636Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpointsmub Slider by Soliloquy – Responsive Image Slider for Word…
- CVE-2026-7615Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameterkasparsd Widget Context
- CVE-2026-8692Vedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Actionregistrationformbuilder Vedrixa Forms – User Registration F…
- CVE-2026-5072ptp: Potential Denial of Service via PTP Interval Shiftzephyrproject-rtos Zephyr
- CVE-2026-4070Alfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameterpftool Alfie – Feed Plugin
- CVE-2026-2518FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activationwpxpo FastX
- CVE-2026-3481WP Blockade <= 0.9.14 - Reflected Cross-Site Scripting via 'shortcode' Parameterburlingtonbytes WP Blockade – Visual Page Builder
- CVE-2026-44409Information disclosure vulnerability in ZTE MU5250ZTE MU5250
- CVE-2026-7249Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purgingshapedplugin Location Weather – WordPress Weather Forecast,…
- CVE-2026-7509KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]helgatheviking KIA Subtitle
- CVE-2026-6864CBX 5 Star Rating & Review <= 1.0.7 - Reflected Cross-Site Scripting via 'page' Parametermanchumahara CBX 5 Star Rating & Review
- CVE-2026-9104Draft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Titledartiss Draft List
- CVE-2026-9053Mothra would respect a default value given by a website for HTML file upload forms.9front
- CVE-2026-46598Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agentgolang.org/x/crypto/ssh/agent · golang.org/x/crypto
- CVE-2026-39827Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-39835Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-39828Invoking bypass of certificate restrictions in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-36226Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via
- CVE-2026-36227Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary cod
- CVE-2026-42626HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing).
- CVE-2026-42627In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file