# CVEs published 2026-05-22

152 CVEs were published on May 22, 2026: 26 critical, 44 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2026-41149](https://cve.now/CVE-2026-41149.md): Mermaid: Improper sanitization of \`classDef\` in state diagrams leads to HTML injection (CVSS 5.3, mermaid-js mermaid · mermaid)
- [CVE-2026-23663](https://cve.now/CVE-2026-23663.md): Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability (CVSS 7.5, Microsoft Global Secure Access)
- [CVE-2026-42901](https://cve.now/CVE-2026-42901.md): Microsoft Entra ID Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Entra)
- [CVE-2026-41104](https://cve.now/CVE-2026-41104.md): Microsoft Planetary Computer Pro Information Disclosure Vulnerability (CVSS 10.0, Microsoft Planetary Computer Pro)
- [CVE-2026-45659](https://cve.now/CVE-2026-45659.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-41148](https://cve.now/CVE-2026-41148.md): Mermaid: Improper sanitization of \`classDefs\` in diagrams leads to CSS injection (CVSS 5.3, mermaid-js mermaid · mermaid)
- [CVE-2026-33843](https://cve.now/CVE-2026-33843.md): Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability (CVSS 9.1, Microsoft Entra)
- [CVE-2026-26147](https://cve.now/CVE-2026-26147.md): Azure Stack HCI Information Disclosure Vulnerability (CVSS 7.7, Microsoft Azure Stack HCI)
- [CVE-2026-41090](https://cve.now/CVE-2026-41090.md): Microsoft Copilot Tampering Vulnerability (CVSS 9.3, Microsoft 365 Copilot for iOS)
- [CVE-2026-42827](https://cve.now/CVE-2026-42827.md): M365 Copilot Information Disclosure Vulnerability (CVSS 6.5, Microsoft 365 Copilot)
- [CVE-2026-47280](https://cve.now/CVE-2026-47280.md): Azure Resource Manager Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Resource Manager)
- [CVE-2026-40411](https://cve.now/CVE-2026-40411.md): Azure Virtual Network Gateway Remote Code Execution Vulnerability (CVSS 9.9, Microsoft Azure Virtual Network Gateway)
- [CVE-2026-35430](https://cve.now/CVE-2026-35430.md): Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Azure Privileged Identity Management)
- [CVE-2026-23652](https://cve.now/CVE-2026-23652.md): Microsoft Power Pages Remote Code Execution Vulnerability (CVSS 10.0, Microsoft Power Pages)
- [CVE-2026-40412](https://cve.now/CVE-2026-40412.md): Azure Orbital Spatio Remote Code Execution Vulnerability (CVSS 10.0, Microsoft Azure Orbital Spatio)
- [CVE-2026-41147](https://cve.now/CVE-2026-41147.md): NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class (CVSS 8.7, nukeviet · nukeviet/nukeviet)
- [CVE-2026-41076](https://cve.now/CVE-2026-41076.md): RT: LDAP authentication bypass via empty password (CVSS 8.1, bestpractical rt)
- [CVE-2026-41075](https://cve.now/CVE-2026-41075.md): RT: SQL injection via entry\_aggregator parameter in JSON search (CVSS 8.8, bestpractical rt)
- [CVE-2026-41074](https://cve.now/CVE-2026-41074.md): RT has broken CSRF protection for authenticated users (CVSS 7.1, bestpractical rt)
- [CVE-2026-41073](https://cve.now/CVE-2026-41073.md): RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps (CVSS 4.6, bestpractical rt)
- [CVE-2026-41071](https://cve.now/CVE-2026-41071.md): libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (CVSS 5.1, strukturag libheif)
- [CVE-2026-41069](https://cve.now/CVE-2026-41069.md): libheif allows Out-of-bounds vector access leading to invalid dereference (DoS) (CVSS 6.5, strukturag libheif)
- [CVE-2026-3294](https://cve.now/CVE-2026-3294.md): Authentication Logic Vulnerability on Multiple TP-Link Range Extenders (CVSS 8.7, TP-Link Systems Archer RE650 · TP-Link Systems Archer RE… +3)
- [CVE-2026-40864](https://cve.now/CVE-2026-40864.md): JupyterHub: Cross-origin form POSTs bypass XSRF (CVSS 5.4, jupyterhub)
- [CVE-2026-40610](https://cve.now/CVE-2026-40610.md): BentoML has Information Disclosure in \`bentoml build\` via symlink traversal in the build context (CVSS 5.5, BentoML)
- [CVE-2026-39824](https://cve.now/CVE-2026-39824.md): Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows (CVSS 3.3, golang.org/x/sys/windows · golang.org/x/sys)
- [CVE-2026-40607](https://cve.now/CVE-2026-40607.md): MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column (CVSS 7.5, mantisbt · mantisbt/mantisbt)
- [CVE-2026-40598](https://cve.now/CVE-2026-40598.md): MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page (CVSS 6.9, mantisbt · mantisbt/mantisbt)
- [CVE-2026-40597](https://cve.now/CVE-2026-40597.md): MantisBT has a Content Security Policy bypass via attachments (CVSS 7.6, mantisbt · mantisbt/mantisbt)
- [CVE-2026-5843](https://cve.now/CVE-2026-5843.md): Docker Model Runner container-to-host code execution via MLX-LM model\_file importlib loading (CVSS 8.8, Docker Desktop)
- [CVE-2026-40596](https://cve.now/CVE-2026-40596.md): MantisBT is vulnerable to XSS and potential account takeover via user font family preference update (CVSS 7.2, mantisbt · mantisbt/mantisbt)
- [CVE-2026-5817](https://cve.now/CVE-2026-5817.md): Docker Model Runner container-to-host code execution via unsandboxed trust\_remote\_code in Python inference backends (CVSS 8.8, Docker Desktop)
- [CVE-2026-40295](https://cve.now/CVE-2026-40295.md): Devise: Open Redirect via Unvalidated \`request.referrer\` in Timeoutable Session Timeout Handler (CVSS 6.1, heartcombo devise · devise)
- [CVE-2026-40172](https://cve.now/CVE-2026-40172.md): authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable\_group\_superuser (CVSS 8.1, goauthentik authentik)
- [CVE-2026-40166](https://cve.now/CVE-2026-40166.md): authentik: Non-admin user can retrieve confidential OAuth client\_secret via /api/v3/oauth2/access\_tokens/ (CVSS 7.1, goauthentik authentik)
- [CVE-2026-39969](https://cve.now/CVE-2026-39969.md): TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification (CVSS 6.5, baptisteArno typebot.io)
- [CVE-2026-48700](https://cve.now/CVE-2026-48700.md): An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. (CVSS 9.3, LXQt PCManFM-Qt)
- [CVE-2026-39967](https://cve.now/CVE-2026-39967.md): TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter (CVSS 3.1, baptisteArno typebot.io)
- [CVE-2026-6406](https://cve.now/CVE-2026-6406.md): Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag (CVSS 8.8, Docker Desktop)
- [CVE-2026-39968](https://cve.now/CVE-2026-39968.md): TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint (CVSS 7.1, baptisteArno typebot.io)
- [CVE-2026-39966](https://cve.now/CVE-2026-39966.md): TypeBot: Async filter() bypasses authorization, allowing IDOR in getLinkedTypebots and leaking cross-workspace bot definitions (CVSS 6.5, baptisteArno typebot.io)
- [CVE-2026-9291](https://cve.now/CVE-2026-9291.md): Insecure Deserialization in Amazon Braket SDK Job Results Processing (CVSS 7.1, AWS Amazon Braket Python SDK · amazon-braket-sdk)
- [CVE-2026-39970](https://cve.now/CVE-2026-39970.md): TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form (CVSS 8.5, baptisteArno typebot.io)
- [CVE-2026-39965](https://cve.now/CVE-2026-39965.md): TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks (CVSS 7.7, baptisteArno typebot.io)
- [CVE-2026-39964](https://cve.now/CVE-2026-39964.md): TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers (CVSS 5.4, baptisteArno typebot.io · @typebot.io/js)
- [CVE-2026-34207](https://cve.now/CVE-2026-34207.md): TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation (CVSS 7.6, baptisteArno typebot.io)
- [CVE-2026-32253](https://cve.now/CVE-2026-32253.md): Sunshine: Authentication bypass via improper client certificate validation (CVSS 9.8, LizardByte Sunshine)
- [CVE-2026-33712](https://cve.now/CVE-2026-33712.md): TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls (CVSS 10.0, baptisteArno typebot.io)
- [CVE-2026-9255](https://cve.now/CVE-2026-9255.md): Tool Execution Without Authorization via Piped Stdin in Kiro CLI (CVSS 7.8, AWS Kiro CLI)
- [CVE-2026-28735](https://cve.now/CVE-2026-28735.md): GitHub OAuth Scope Validation (CVSS 5.4, Mattermost · github.com/mattermost/mattermost-server +1)
- [CVE-2026-28445](https://cve.now/CVE-2026-28445.md): Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview (CVSS 8.7, baptisteArno typebot.io · @typebot.io/js)
- [CVE-2026-28444](https://cve.now/CVE-2026-28444.md): Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure (CVSS 6.5, baptisteArno typebot.io)
- [CVE-2026-7325](https://cve.now/CVE-2026-7325.md): Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain a (CVSS 7.1, Devolutions Server)
- [CVE-2026-9251](https://cve.now/CVE-2026-9251.md): Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass t (CVSS 5.4, Devolutions Server)
- [CVE-2026-5171](https://cve.now/CVE-2026-5171.md): Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but wit (CVSS 4.3, Devolutions Server)
- [CVE-2026-8477](https://cve.now/CVE-2026-8477.md): Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticate (CVSS 2.7, Devolutions Server)
- [CVE-2026-9246](https://cve.now/CVE-2026-9246.md): Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault rea (CVSS 4.3, Devolutions Server)
- [CVE-2026-9224](https://cve.now/CVE-2026-9224.md): Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their (CVSS 4.3, Devolutions Server)
- [CVE-2026-9249](https://cve.now/CVE-2026-9249.md): Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a cra (CVSS 3.1, Devolutions Server)
- [CVE-2026-9245](https://cve.now/CVE-2026-9245.md): Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to re (CVSS 5.0, Devolutions Server)
- [CVE-2026-9247](https://cve.now/CVE-2026-9247.md): Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a seal (CVSS 2.4, Devolutions Server)
- [CVE-2026-9248](https://cve.now/CVE-2026-9248.md): Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to c (CVSS 2.6, Devolutions Server)
- [CVE-2026-9223](https://cve.now/CVE-2026-9223.md): Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user (CVSS 4.3, Devolutions Server)
- [CVE-2026-9047](https://cve.now/CVE-2026-9047.md): Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with kn (CVSS 7.6, Devolutions Server)
- [CVE-2026-27136](https://cve.now/CVE-2026-27136.md): Invoking duplicate attributes can cause XSS in golang.org/x/net/html (CVSS 6.1, golang.org/x/net/html · golang.org/x/net)
- [CVE-2026-25681](https://cve.now/CVE-2026-25681.md): Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html (CVSS 6.1, golang.org/x/net/html · golang.org/x/net)
- [CVE-2026-25680](https://cve.now/CVE-2026-25680.md): Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html (CVSS 6.5, golang.org/x/net/html · golang.org/x/net)
- [CVE-2026-42502](https://cve.now/CVE-2026-42502.md): Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html (CVSS 6.1, golang.org/x/net/html · golang.org/x/net)
- [CVE-2026-39821](https://cve.now/CVE-2026-39821.md): Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna (CVSS 9.6, Go standard library net/http · Go standard library net/h… +3)
- [CVE-2026-42506](https://cve.now/CVE-2026-42506.md): Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html (CVSS 6.1, golang.org/x/net/html · golang.org/x/net)
- [CVE-2022-34363](https://cve.now/CVE-2022-34363.md): Dell Unisphere for PowerMax vApp version prior to 10.0.0.2, contains an authorization bypass vulnerability in the Unisphere for VMAX applic (CVSS 6.5, Dell Unisphere for PowerMax · Dell Unisphere)
- [CVE-2022-31231](https://cve.now/CVE-2022-31231.md): Dell ECS, versions 3.5 and 3.6, contain an Improper Access Control in the Identity and Access Management (IAM) module. (CVSS 5.9, Dell ECS)
- [CVE-2026-8992](https://cve.now/CVE-2026-8992.md): An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to ex (CVSS 8.8, ivanti Secure Access Client)
- [CVE-2026-8353](https://cve.now/CVE-2026-8353.md): Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme (CVSS 2.1, Concrete CMS · concrete5/concrete5)
- [CVE-2021-21508](https://cve.now/CVE-2021-21508.md): Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. (CVSS 6.7, Dell VxRail)
- [CVE-2026-9256](https://cve.now/CVE-2026-9256.md): NGINX ngx\_http\_rewrite\_module vulnerability (CVSS 8.1, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-8347](https://cve.now/CVE-2026-8347.md): Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2026-8340](https://cve.now/CVE-2026-8340.md): Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\\File::approveVersion (CVSS 2.3, Concrete CMS · concrete5/concrete5)
- [CVE-2025-32751](https://cve.now/CVE-2025-32751.md): Dell PowerFlex Manager, version(s) \<=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. (CVSS 5.5, Dell PowerFlex Manager)
- [CVE-2025-46371](https://cve.now/CVE-2025-46371.md): Dell PowerFlex Manager, version(s) \<=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. (CVSS 3.6, Dell PowerFlex Manager)
- [CVE-2025-26483](https://cve.now/CVE-2025-26483.md): Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. (CVSS 6.1, Dell PowerFlex Manager)
- [CVE-2026-8997](https://cve.now/CVE-2026-8997.md): Heap Buffer Overflow in vifm (CVSS 4.8, vifm)
- [CVE-2025-32745](https://cve.now/CVE-2025-32745.md): Dell PowerFlex Manager, version(s) \<=4.6.2, contain(s) an Improper Certificate Validation vulnerability. (CVSS 4.2, Dell PowerFlex Manager)
- [CVE-2026-9277](https://cve.now/CVE-2026-9277.md): shell-quote \`quote()\` does not validate object-token shapes, allowing command injection via line terminators in \`.op\` (CVSS 8.1, shell-quote)
- [CVE-2026-8673](https://cve.now/CVE-2026-8673.md): Password re-initialization mechanism sends passwords in plain text (CVSS 5.9, syslink software AG Avantra)
- [CVE-2026-8672](https://cve.now/CVE-2026-8672.md): Default credentials for internal DB (CVSS 5.1, syslink software AG Avantra)
- [CVE-2026-8671](https://cve.now/CVE-2026-8671.md): Log Files contain encrypted secrets (CVSS 7.5, syslink software AG Avantra)
- [CVE-2025-32746](https://cve.now/CVE-2025-32746.md): Dell PowerFlex Manager, version(s) \<=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. (CVSS 4.0, Dell PowerFlex Manager)
- [CVE-2026-8670](https://cve.now/CVE-2026-8670.md): Insecure session handling on metrics web server (CVSS 9.6, syslink software AG Avantra)
- [CVE-2025-32747](https://cve.now/CVE-2025-32747.md): Dell PowerFlex Manager, version(s) \<=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. (CVSS 5.3, Dell PowerFlex Manager)
- [CVE-2025-32749](https://cve.now/CVE-2025-32749.md): Dell PowerFlex Manager, version(s) \<=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. (CVSS 5.3, Dell PowerFlex Manager)
- [CVE-2026-44417](https://cve.now/CVE-2026-44417.md): Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE) (CVSS 7.5, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-44618](https://cve.now/CVE-2026-44618.md): Apache CXF: XXE vulnerability in WS-Transfer functionality (CVSS 5.3, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-44930](https://cve.now/CVE-2026-44930.md): Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository (CVSS 4.3, Apache Software Foundation Apache CXF · org.apache.cxf.serv…)
- [CVE-2026-4635](https://cve.now/CVE-2026-4635.md): Persistent notification timing attack causing server denial of service (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-3473](https://cve.now/CVE-2026-3473.md): Improper file ownership validation in the Boards API allows unauthorised file access (CVSS 5.9, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-4646](https://cve.now/CVE-2026-4646.md): Insufficient input validation in GitHub plugin API causes denial of service (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +1)
- [CVE-2026-3636](https://cve.now/CVE-2026-3636.md): Sanitize team member data returned by API (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-5740](https://cve.now/CVE-2026-5740.md): Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server (CVSS 7.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-5308](https://cve.now/CVE-2026-5308.md): Missing request body size limits on Zoom plugin HTTP endpoints (CVSS 4.9, Mattermost · github.com/mattermost/mattermost-server +1)
- [CVE-2026-5755](https://cve.now/CVE-2026-5755.md): Denial of service via crafted TIFF file upload (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-25608](https://cve.now/CVE-2026-25608.md): Lack of traffic encryption in STER (CVSS 2.3, Centralny Instytut Ochrony Pracy - Państwowy Instytut Badaw…)
- [CVE-2026-25607](https://cve.now/CVE-2026-25607.md): Weak password encoding in STER (CVSS 5.7, Centralny Instytut Ochrony Pracy - Państwowy Instytut Badaw…)
- [CVE-2026-25606](https://cve.now/CVE-2026-25606.md): SQL Injection in STER (CVSS 8.7, Centralny Instytut Ochrony Pracy - Państwowy Instytut Badaw…)
- [CVE-2026-8381](https://cve.now/CVE-2026-8381.md): Broken Access Control in TeamViewer DEX Platform (On Premises) (CVSS 5.4, TeamViewer DEX)
- [CVE-2026-8679](https://cve.now/CVE-2026-8679.md): AudioIgniter Music Player \<= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter\_playlist\_id' Parameter (CVSS 7.5, cssigniterteam AudioIgniter Music Player)
- [CVE-2026-8684](https://cve.now/CVE-2026-8684.md): MotoPress Hotel Booking \<= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb\_update\_booking\_notes AJAX Action (CVSS 5.3, jetmonsters MotoPress Hotel Booking)
- [CVE-2026-7798](https://cve.now/CVE-2026-7798.md): FluentCRM \<= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter (CVSS 5.4, techjewel FluentCRM – Email Newsletter, Automation, Email M…)
- [CVE-2026-7636](https://cve.now/CVE-2026-7636.md): Slider by Soliloquy \<= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint (CVSS 4.3, smub Slider by Soliloquy – Responsive Image Slider for Word…)
- [CVE-2026-9011](https://cve.now/CVE-2026-9011.md): Ditty \<= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty\_init AJAX Action (CVSS 7.5, metaphorcreations Ditty – Responsive News Tickers, Sliders,…)
- [CVE-2026-7615](https://cve.now/CVE-2026-7615.md): Widget Context \<= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter (CVSS 4.3, kasparsd Widget Context)
- [CVE-2026-8692](https://cve.now/CVE-2026-8692.md): Vedrixa Forms \<= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb\_save\_form\_structure AJAX Action (CVSS 4.3, registrationformbuilder Vedrixa Forms – User Registration F…)
- [CVE-2026-5072](https://cve.now/CVE-2026-5072.md): ptp: Potential Denial of Service via PTP Interval Shift (CVSS 6.5, zephyrproject-rtos Zephyr)
- [CVE-2026-9018](https://cve.now/CVE-2026-9018.md): Easy Elements for Elementor – Addons & Website Templates \<= 1.4.5 - Unauthenticated Privilege Escalation via 'custom\_meta' Parameter (CVSS 8.8, themewant Easy Elements for Elementor – Addons & Website Te…)
- [CVE-2026-4070](https://cve.now/CVE-2026-4070.md): Alfie \<= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter (CVSS 4.3, pftool Alfie – Feed Plugin)
- [CVE-2026-2518](https://cve.now/CVE-2026-2518.md): FastX \<= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation (CVSS 4.3, wpxpo FastX)
- [CVE-2026-3481](https://cve.now/CVE-2026-3481.md): WP Blockade \<= 0.9.14 - Reflected Cross-Site Scripting via 'shortcode' Parameter (CVSS 6.1, burlingtonbytes WP Blockade – Visual Page Builder)
- [CVE-2026-44409](https://cve.now/CVE-2026-44409.md): Information disclosure vulnerability in ZTE MU5250 (CVSS 5.7, ZTE MU5250)
- [CVE-2026-7249](https://cve.now/CVE-2026-7249.md): Location Weather \<= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging (CVSS 4.3, shapedplugin Location Weather – WordPress Weather Forecast,…)
- [CVE-2026-7509](https://cve.now/CVE-2026-7509.md): KIA Subtitle \<= 4.0.1 - \[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\] (CVSS 6.4, helgatheviking KIA Subtitle)
- [CVE-2026-6864](https://cve.now/CVE-2026-6864.md): CBX 5 Star Rating & Review \<= 1.0.7 - Reflected Cross-Site Scripting via 'page' Parameter (CVSS 6.1, manchumahara CBX 5 Star Rating & Review)
- [CVE-2026-9104](https://cve.now/CVE-2026-9104.md): Draft List \<= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title (CVSS 6.4, dartiss Draft List)
- [CVE-2026-9054](https://cve.now/CVE-2026-9054.md): Invalid IP packets cause a kernel panic (CVSS 9.2, 9front)
- [CVE-2026-9053](https://cve.now/CVE-2026-9053.md): Mothra would respect a default value given by a website for HTML file upload forms. (CVSS 6.9, 9front)
- [CVE-2026-46598](https://cve.now/CVE-2026-46598.md): Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (CVSS 5.3, golang.org/x/crypto/ssh/agent · golang.org/x/crypto)
- [CVE-2026-46595](https://cve.now/CVE-2026-46595.md): Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (CVSS 10.0, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-42508](https://cve.now/CVE-2026-42508.md): Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (CVSS 9.1, golang.org/x/crypto/ssh/knownhosts · golang.org/x/crypto)
- [CVE-2026-39834](https://cve.now/CVE-2026-39834.md): Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (CVSS 9.1, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-39831](https://cve.now/CVE-2026-39831.md): Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (CVSS 9.1, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-39829](https://cve.now/CVE-2026-39829.md): Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (CVSS 7.5, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-39830](https://cve.now/CVE-2026-39830.md): Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (CVSS 9.1, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-39827](https://cve.now/CVE-2026-39827.md): Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (CVSS 6.5, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-39835](https://cve.now/CVE-2026-39835.md): Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (CVSS 5.3, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-39828](https://cve.now/CVE-2026-39828.md): Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (CVSS 6.3, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-46597](https://cve.now/CVE-2026-46597.md): Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (CVSS 7.5, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-39832](https://cve.now/CVE-2026-39832.md): Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (CVSS 9.1, golang.org/x/crypto/ssh/agent · golang.org/x/crypto)
- [CVE-2026-39833](https://cve.now/CVE-2026-39833.md): Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (CVSS 9.1, golang.org/x/crypto/ssh/agent · golang.org/x/crypto)
- [CVE-2026-4834](https://cve.now/CVE-2026-4834.md): WP ERP Pro \<= 1.5.1 - Unauthenticated SQL Injection via 'search\_key' Parameter (CVSS 7.5, weDevs WP ERP Pro)
- [CVE-2026-9264](https://cve.now/CVE-2026-9264.md): Cross-Site Scripting in SketchUp Dynamic Components (CVSS 9.3, Trimble SketchUp)
- [CVE-2026-34911](https://cve.now/CVE-2026-34911.md): A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to ac (CVSS 7.7, Ubiquiti UniFi OS Server · Ubiquiti UDM +29)
- [CVE-2026-33000](https://cve.now/CVE-2026-33000.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS (CVSS 9.1, Ubiquiti UniFi OS Server)
- [CVE-2026-34910](https://cve.now/CVE-2026-34910.md): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a (CVSS 10.0, KEV, Ubiquiti UniFi OS Server · Ubiquiti UDM +29)
- [CVE-2026-34908](https://cve.now/CVE-2026-34908.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauth (CVSS 10.0, KEV, Ubiquiti UniFi OS Server · Ubiquiti UDM +29)
- [CVE-2026-34909](https://cve.now/CVE-2026-34909.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the u (CVSS 10.0, KEV, Ubiquiti UniFi OS Server · Ubiquiti Express +29)
- [CVE-2025-45145](https://cve.now/CVE-2025-45145.md): Directory traversal in Follett Software's Destiny Library Manager 22\_0\_2\_rc1 and fixed in v.22.5 AU1 allows remote attackers to read arbitra (CVSS 7.5)
- [CVE-2026-36226](https://cve.now/CVE-2026-36226.md): Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via (CVSS 6.1)
- [CVE-2026-36227](https://cve.now/CVE-2026-36227.md): Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary cod (CVSS 6.5)
- [CVE-2026-36228](https://cve.now/CVE-2026-36228.md): Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code vi (CVSS 7.3)
- [CVE-2026-37470](https://cve.now/CVE-2026-37470.md): An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTT (CVSS 7.3)
- [CVE-2026-42626](https://cve.now/CVE-2026-42626.md): HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing). (CVSS 5.9)
- [CVE-2026-42627](https://cve.now/CVE-2026-42627.md): In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file (CVSS 6.2)
- [CVE-2026-46727](https://cve.now/CVE-2026-46727.md): An issue was discovered in Ruby 4 before 4.0.5. (CVSS 8.1, ruby-lang Ruby)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.