CVEs published May 23, 2026
41 CVEs were published on May 23, 2026: 2 critical, 23 high. 1 is now in CISA KEV.
- Published
- 41
- Critical
- 2
- High
- 23
- Medium
- 15
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- Behance Smartshop
- 4
- Edimax BR-6428NS
- 4
- Wishlist Member
- 4
- omec-project amf · github.com/omec-project/amf
- 3
- calcom cal.diy
- 2
- Linux
- 2
- QuantumNous new-api
- 2
- userSpice
- 2
- 10-Strike Network Inventory Explorer
- 1
- 10-Strike Network Scanner
- 1
Critical 2
High 23
- CVE-2018-25358D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgiD-Link DIR-601
- CVE-2018-25356SIPp 3.6 Local Buffer Overflow via Command-line ArgumentsSIPp
- CVE-2018-25355Audiograbber 1.83 Local Buffer Overflow via SEHAudiograbber
- CVE-2018-25353Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File UploadRedaxo CMS Mediapool
- CVE-2018-25352WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_idultimate-form-builder-lite Ultimate Form Builder Lite
- CVE-2018-25351Joomla! Component EkRishta 2.10 SQL Injection via usernameharmistechnology EkRishta
- CVE-2018-25348Joomla! Component Ek Rishta 2.10 SQL Injection via user_detailharmistechnology Ek Rishta
- CVE-2018-25347WordPress Contact Form Maker Plugin 1.12.20 SQL Injectionweb-dorado Contact Form Maker
- CVE-2018-25346WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php10Web Form Maker
- CVE-2018-2534510-Strike Network Scanner 3.0 Local Buffer Overflow SEH10-Strike Network Scanner
- CVE-2018-2534410-Strike Network Inventory Explorer 8.54 Buffer Overflow SEH10-Strike Network Inventory Explorer
- CVE-2018-25342Smartshop 1 SQL Injection via search.phpBehance Smartshop
- CVE-2018-25341Smartshop 1 SQL Injection via product.php id ParameterBehance Smartshop
- CVE-2018-25340Smartshop 1 SQL Injection via category.phpBehance Smartshop
- CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescingLinux
- CVE-2026-43503net: skbuff: propagate shared-frag marker through frag-transfer helpersLinux
- CVE-2026-9295Edimax BR-6428NS POST Request formWirelessTbl buffer overflowEdimax BR-6428NS
- CVE-2026-9294Edimax BR-6428NS POST Request formWanTcpipSetup buffer overflowEdimax BR-6428NS
- CVE-2026-6419Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX actionWishlist Member
- CVE-2026-6897Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX actionWishlist Member
- CVE-2026-9284WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information DisclosureWooCommerce PayPal Payments
- CVE-2026-6895Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX ActionWishlist Member
- CVE-2026-6898WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX actionWishlist Member
Medium, low and unrated 16
- CVE-2026-9343Edimax EW-7438RPn webs formWpsStart os command injectionEdimax EW-7438RPn
- CVE-2026-9342SourceCodester Hospitals Patient Records Management System view_history.php sql injectionSourceCodester Hospitals Patient Records Management System
- CVE-2018-25354Joomla Component jomres 9.11.2 Cross-Site Request ForgeryJomres
- CVE-2018-25349userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For HeaderuserSpice
- CVE-2018-25343Smartshop 1 Cross-Site Request Forgery via editprofile.phpBehance Smartshop
- CVE-2026-9306QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorizationQuantumNous new-api
- CVE-2026-9305QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injectionQuantumNous new-api
- CVE-2026-9304calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgerycalcom cal.diy
- CVE-2026-9303calcom cal.diy cross-site request forgerycalcom cal.diy
- CVE-2026-9302546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection546669204 vps-inventory-monitoring
- CVE-2026-9301omec-project amf NGReset Message memory corruptionomec-project amf · github.com/omec-project/amf
- CVE-2026-9300omec-project amf NGSetupRequest memory corruptionomec-project amf · github.com/omec-project/amf
- CVE-2026-9299omec-project amf handler.go PDUSessionResourceModifyIndication memory corruptionomec-project amf · github.com/omec-project/amf
- CVE-2026-9298omec-project amf PathSwitchRequest memory corruptionomec-project amf
- CVE-2026-9297Edimax BR-6428NS POST Request formWlbasic command injectionEdimax BR-6428NS
- CVE-2026-9296Edimax BR-6428NS POST Request formWlanM system command injectionEdimax BR-6428NS