# CVEs published 2026-05-23 41 CVEs were published on May 23, 2026: 2 critical, 23 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2026-9343](https://cve.now/CVE-2026-9343.md): Edimax EW-7438RPn webs formWpsStart os command injection (CVSS 5.3, Edimax EW-7438RPn) - [CVE-2026-9342](https://cve.now/CVE-2026-9342.md): SourceCodester Hospitals Patient Records Management System view\_history.php sql injection (CVSS 5.3, SourceCodester Hospitals Patient Records Management System) - [CVE-2018-25357](https://cve.now/CVE-2018-25357.md): Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php (CVSS 9.3, Dolibarr ERP CRM · dolibarr/dolibarr) - [CVE-2018-25358](https://cve.now/CVE-2018-25358.md): D-Link DIR601 2.02NA Credential Disclosure via my\_cgi.cgi (CVSS 8.7, D-Link DIR-601) - [CVE-2018-25356](https://cve.now/CVE-2018-25356.md): SIPp 3.6 Local Buffer Overflow via Command-line Arguments (CVSS 8.6, SIPp) - [CVE-2018-25355](https://cve.now/CVE-2018-25355.md): Audiograbber 1.83 Local Buffer Overflow via SEH (CVSS 8.6, Audiograbber) - [CVE-2018-25354](https://cve.now/CVE-2018-25354.md): Joomla Component jomres 9.11.2 Cross-Site Request Forgery (CVSS 5.3, Jomres) - [CVE-2018-25353](https://cve.now/CVE-2018-25353.md): Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload (CVSS 8.7, Redaxo CMS Mediapool) - [CVE-2018-25352](https://cve.now/CVE-2018-25352.md): WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry\_id (CVSS 7.1, ultimate-form-builder-lite Ultimate Form Builder Lite) - [CVE-2018-25351](https://cve.now/CVE-2018-25351.md): Joomla! Component EkRishta 2.10 SQL Injection via username (CVSS 8.8, harmistechnology EkRishta) - [CVE-2018-25350](https://cve.now/CVE-2018-25350.md): userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php (CVSS 9.3, userSpice) - [CVE-2018-25349](https://cve.now/CVE-2018-25349.md): userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header (CVSS 5.1, userSpice) - [CVE-2018-25348](https://cve.now/CVE-2018-25348.md): Joomla! Component Ek Rishta 2.10 SQL Injection via user\_detail (CVSS 8.8, harmistechnology Ek Rishta) - [CVE-2018-25347](https://cve.now/CVE-2018-25347.md): WordPress Contact Form Maker Plugin 1.12.20 SQL Injection (CVSS 7.1, web-dorado Contact Form Maker) - [CVE-2018-25346](https://cve.now/CVE-2018-25346.md): WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php (CVSS 7.1, 10Web Form Maker) - [CVE-2018-25345](https://cve.now/CVE-2018-25345.md): 10-Strike Network Scanner 3.0 Local Buffer Overflow SEH (CVSS 8.6, 10-Strike Network Scanner) - [CVE-2018-25344](https://cve.now/CVE-2018-25344.md): 10-Strike Network Inventory Explorer 8.54 Buffer Overflow SEH (CVSS 8.6, 10-Strike Network Inventory Explorer) - [CVE-2018-25343](https://cve.now/CVE-2018-25343.md): Smartshop 1 Cross-Site Request Forgery via editprofile.php (CVSS 5.3, Behance Smartshop) - [CVE-2018-25342](https://cve.now/CVE-2018-25342.md): Smartshop 1 SQL Injection via search.php (CVSS 8.8, Behance Smartshop) - [CVE-2018-25341](https://cve.now/CVE-2018-25341.md): Smartshop 1 SQL Injection via product.php id Parameter (CVSS 8.8, Behance Smartshop) - [CVE-2018-25340](https://cve.now/CVE-2018-25340.md): Smartshop 1 SQL Injection via category.php (CVSS 8.8, Behance Smartshop) - [CVE-2026-9306](https://cve.now/CVE-2026-9306.md): QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization (CVSS 6.3, QuantumNous new-api) - [CVE-2026-9305](https://cve.now/CVE-2026-9305.md): QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection (CVSS 5.3, QuantumNous new-api) - [CVE-2026-9304](https://cve.now/CVE-2026-9304.md): calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery (CVSS 2.3, calcom cal.diy) - [CVE-2026-9303](https://cve.now/CVE-2026-9303.md): calcom cal.diy cross-site request forgery (CVSS 5.3, calcom cal.diy) - [CVE-2026-9302](https://cve.now/CVE-2026-9302.md): 546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection (CVSS 5.3, 546669204 vps-inventory-monitoring) - [CVE-2026-9301](https://cve.now/CVE-2026-9301.md): omec-project amf NGReset Message memory corruption (CVSS 5.3, omec-project amf · github.com/omec-project/amf) - [CVE-2026-9300](https://cve.now/CVE-2026-9300.md): omec-project amf NGSetupRequest memory corruption (CVSS 5.3, omec-project amf · github.com/omec-project/amf) - [CVE-2026-46300](https://cve.now/CVE-2026-46300.md): net: skbuff: preserve shared-frag marker during coalescing (CVSS 7.8, KEV, Linux) - [CVE-2026-43503](https://cve.now/CVE-2026-43503.md): net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVSS 8.8, Linux) - [CVE-2026-9299](https://cve.now/CVE-2026-9299.md): omec-project amf handler.go PDUSessionResourceModifyIndication memory corruption (CVSS 5.3, omec-project amf · github.com/omec-project/amf) - [CVE-2026-9298](https://cve.now/CVE-2026-9298.md): omec-project amf PathSwitchRequest memory corruption (CVSS 5.3, omec-project amf) - [CVE-2026-9297](https://cve.now/CVE-2026-9297.md): Edimax BR-6428NS POST Request formWlbasic command injection (CVSS 5.3, Edimax BR-6428NS) - [CVE-2026-9296](https://cve.now/CVE-2026-9296.md): Edimax BR-6428NS POST Request formWlanM system command injection (CVSS 5.3, Edimax BR-6428NS) - [CVE-2026-9295](https://cve.now/CVE-2026-9295.md): Edimax BR-6428NS POST Request formWirelessTbl buffer overflow (CVSS 8.7, Edimax BR-6428NS) - [CVE-2026-9294](https://cve.now/CVE-2026-9294.md): Edimax BR-6428NS POST Request formWanTcpipSetup buffer overflow (CVSS 8.7, Edimax BR-6428NS) - [CVE-2026-6419](https://cve.now/CVE-2026-6419.md): Wishlist Member \<= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3\_get\_screen' AJAX action (CVSS 8.8, Wishlist Member) - [CVE-2026-6897](https://cve.now/CVE-2026-6897.md): Wishlist Member \<= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember\_team\_accounts\_save\_settings' AJAX action (CVSS 8.8, Wishlist Member) - [CVE-2026-9284](https://cve.now/CVE-2026-9284.md): WooCommerce PayPal Payments \<= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure (CVSS 8.2, WooCommerce PayPal Payments) - [CVE-2026-6895](https://cve.now/CVE-2026-6895.md): Wishlist Member \<= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3\_export\_settings' AJAX Action (CVSS 8.8, Wishlist Member) - [CVE-2026-6898](https://cve.now/CVE-2026-6898.md): WishList Member \<= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3\_generate\_api\_key' AJAX action (CVSS 8.8, Wishlist Member) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2026-05-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.