CVEs published May 24, 2026
65 CVEs were published on May 24, 2026: 10 critical, 17 high.
- Published
- 65
- Critical
- 10
- High
- 17
- Medium
- 35
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Edimax BR-6675nD
- 10
- Edimax EW-7438RPn
- 10
- Totolink A8000RU
- 9
- Besen BS20 EV Charging Station
- 5
- NousResearch hermes-agent
- 5
- NousResearch hermes-agent · hermes-agent
- 4
- ItzCrazyKns Vane
- 2
- SourceCodester Hospitals Patient Records Management System
- 2
- calcom cal.diy
- 1
- Ettercap
- 1
Critical 10
- CVE-2026-9407Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injectionTotolink A8000RU
- CVE-2026-9406Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injectionTotolink A8000RU
- CVE-2026-9405Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injectionTotolink A8000RU
- CVE-2026-9404Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injectionTotolink A8000RU
- CVE-2026-9397Besen BS20 EV Charging Station OTA Update Installation improper authorizationBesen BS20 EV Charging Station
- CVE-2026-9388Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injectionTotolink A8000RU
- CVE-2026-9387Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injectionTotolink A8000RU
- CVE-2026-9386Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injectionTotolink A8000RU
- CVE-2026-9385Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injectionTotolink A8000RU
- CVE-2026-9384Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injectionTotolink A8000RU
High 17
- CVE-2026-9403Edimax BR-6675nD POST Request formWlSiteSurvey buffer overflowEdimax BR-6675nD
- CVE-2026-9401Edimax BR-6675nD POST Request formWanTcpipSetup buffer overflowEdimax BR-6675nD
- CVE-2026-9399Edimax BR-6675nD POST Request formsetPPPoE buffer overflowEdimax BR-6675nD
- CVE-2026-48831Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types.WineHQ Wine
- CVE-2026-9393H3C Magic B0 aspForm Edit_BasicSSID_5G buffer overflowH3C Magic B0
- CVE-2026-9389Tenda F456 L7Im frmL7ImForm buffer overflowTenda F456
- CVE-2026-4372Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformershuggingface/transformers · transformers
- CVE-2026-9382Edimax BR-6675nD POST Request formPPTPSetup buffer overflowEdimax BR-6675nD
- CVE-2026-9381Edimax BR-6675nD POST Request formPPPoESetup buffer overflowEdimax BR-6675nD
- CVE-2026-9380Edimax BR-6675nD POST Request formL2TPSetup buffer overflowEdimax BR-6675nD
- CVE-2026-9360Edimax EW-7438RPn POST Request formwlencrypt24g buffer overflowEdimax EW-7438RPn
- CVE-2026-3515Argument Injection in prefecthq/prefectprefecthq/prefect · prefect
- CVE-2026-48829In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanyiGNU SASL
- CVE-2026-9348Edimax EW-7438RPn webs mp stack-based overflowEdimax EW-7438RPn
- CVE-2026-9346Edimax EW-7438RPn webs formWirelessTbl buffer overflowEdimax EW-7438RPn
- CVE-2026-9345Edimax EW-7438RPn webs formWizSurvey buffer overflowEdimax EW-7438RPn
- CVE-2026-9344Edimax EW-7438RPn webs formWpsStart stack-based overflowEdimax EW-7438RPn
Medium, low and unrated 38
- CVE-2026-48832action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability.SPIP
- CVE-2026-9402Edimax BR-6675nD POST Request formWlanMP command injectionEdimax BR-6675nD
- CVE-2026-9400Edimax BR-6675nD POST Request formUSBStorage command injectionEdimax BR-6675nD
- CVE-2026-9398Besen BS20 EV Charging Station BLE/WiFi authentication replayBesen BS20 EV Charging Station
- CVE-2026-9396Besen BS20 EV Charging Station Firmware Version Check ui layerBesen BS20 EV Charging Station
- CVE-2026-9395Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentialsBesen BS20 EV Charging Station
- CVE-2026-9394Besen BS20 EV Charging Station Bluetooth Low Energy weak passwordBesen BS20 EV Charging Station
- CVE-2026-9383itsourcecode Electronic Judging System login.php sql injectionitsourcecode Electronic Judging System
- CVE-2026-9379Edimax BR-6675nD POST Request formWpsStart command injectionEdimax BR-6675nD
- CVE-2026-9378Edimax BR-6675nD POST Request formHwSet command injectionEdimax BR-6675nD
- CVE-2026-9377SourceCodester SUP Online Shopping productedit.php cross site scriptingSourceCodester SUP Online Shopping
- CVE-2026-9376JPress UCenter Article Submission Endpoint doWriteSave improper authorizationJPress
- CVE-2026-9374yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted uploadyangzongzhuan RuoYi-Vue
- CVE-2026-9373JeecgBoot OpenAPI Endpoint call improper authenticationJeecgBoot
- CVE-2026-9372ItzCrazyKns Vane Model Provider API route.ts server-side request forgeryItzCrazyKns Vane
- CVE-2026-9371ItzCrazyKns Vane API route.ts missing authenticationItzCrazyKns Vane
- CVE-2026-9370ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable saltulisesbocchio jasypt-spring-boot · com.github.ulisesbocc… +1
- CVE-2026-9369NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparisonNousResearch hermes-agent · hermes-agent
- CVE-2026-9368NousResearch hermes-agent Environment Variable code_execution_tool.py execute_code sandboxNousResearch hermes-agent · hermes-agent
- CVE-2026-9367NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injectionNousResearch hermes-agent
- CVE-2026-9366NousResearch hermes-agent prompt_builder.py _scan_context_content injectionNousResearch hermes-agent · hermes-agent
- CVE-2026-9365Ettercap GG Dissector ec_gg.c FUNC_DECODER heap-based overflowEttercap
- CVE-2026-9364projectworlds Online Art Gallery Shop adminHome.php sql injectionprojectworlds Online Art Gallery Shop
- CVE-2026-9363Edimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injectionEdimax EW-7438RPn
- CVE-2026-9362Edimax EW-7438RPn Setting formConnectionSetting command injectionEdimax EW-7438RPn
- CVE-2026-9361Edimax EW-7438RPn POST Request formAccep formAccept command injectionEdimax EW-7438RPn
- CVE-2026-9359Edimax EW-7438RPn POST Request formHwSet command injectionEdimax EW-7438RPn
- CVE-2026-9358postcss-selector-parser AST Serialization container.js toString recursionpostcss-selector-parser
- CVE-2026-9357vBulletin Login cross site scriptingvBulletin
- CVE-2026-9356SourceCodester Hospitals Patient Records Management System manage_history.php sql injectionSourceCodester Hospitals Patient Records Management System
- CVE-2026-9355SourceCodester Hospitals Patient Records Management System Master.php save_patient_history sql injectionSourceCodester Hospitals Patient Records Management System
- CVE-2026-9354NousResearch hermes-agent Slack Agent/Mattermost Agent escape outputNousResearch hermes-agent
- CVE-2026-9353NousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py injectionNousResearch hermes-agent · hermes-agent
- CVE-2026-9352NousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosureNousResearch hermes-agent
- CVE-2026-9351NousResearch hermes-agent read_file Tool file_tools.py _is_blocked_device path traversalNousResearch hermes-agent
- CVE-2026-9350NousResearch hermes-agent Batch Runner approval.py check_all_command_guards authorizationNousResearch hermes-agent
- CVE-2026-9349calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosurecalcom cal.diy
- CVE-2026-9347Edimax EW-7438RPn webs formWizSurvey os command injectionEdimax EW-7438RPn