# CVEs published 2026-05-24

65 CVEs were published on May 24, 2026: 10 critical, 17 high. Days are UTC.

- [CVE-2026-9407](https://cve.now/CVE-2026-9407.md): Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-9406](https://cve.now/CVE-2026-9406.md): Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-9405](https://cve.now/CVE-2026-9405.md): Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-9404](https://cve.now/CVE-2026-9404.md): Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-9403](https://cve.now/CVE-2026-9403.md): Edimax BR-6675nD POST Request formWlSiteSurvey buffer overflow (CVSS 8.7, Edimax BR-6675nD)
- [CVE-2026-48832](https://cve.now/CVE-2026-48832.md): action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. (CVSS 3.5, SPIP)
- [CVE-2026-9402](https://cve.now/CVE-2026-9402.md): Edimax BR-6675nD POST Request formWlanMP command injection (CVSS 5.3, Edimax BR-6675nD)
- [CVE-2026-9401](https://cve.now/CVE-2026-9401.md): Edimax BR-6675nD POST Request formWanTcpipSetup buffer overflow (CVSS 8.7, Edimax BR-6675nD)
- [CVE-2026-9400](https://cve.now/CVE-2026-9400.md): Edimax BR-6675nD POST Request formUSBStorage command injection (CVSS 5.3, Edimax BR-6675nD)
- [CVE-2026-9399](https://cve.now/CVE-2026-9399.md): Edimax BR-6675nD POST Request formsetPPPoE buffer overflow (CVSS 8.7, Edimax BR-6675nD)
- [CVE-2026-48831](https://cve.now/CVE-2026-48831.md): Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. (CVSS 7.3, WineHQ Wine)
- [CVE-2026-9398](https://cve.now/CVE-2026-9398.md): Besen BS20 EV Charging Station BLE/WiFi authentication replay (CVSS 2.3, Besen BS20 EV Charging Station)
- [CVE-2026-9397](https://cve.now/CVE-2026-9397.md): Besen BS20 EV Charging Station OTA Update Installation improper authorization (CVSS 9.2, Besen BS20 EV Charging Station)
- [CVE-2026-9396](https://cve.now/CVE-2026-9396.md): Besen BS20 EV Charging Station Firmware Version Check ui layer (CVSS 6.3, Besen BS20 EV Charging Station)
- [CVE-2026-9395](https://cve.now/CVE-2026-9395.md): Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials (CVSS 5.1, Besen BS20 EV Charging Station)
- [CVE-2026-9394](https://cve.now/CVE-2026-9394.md): Besen BS20 EV Charging Station Bluetooth Low Energy weak password (CVSS 2.3, Besen BS20 EV Charging Station)
- [CVE-2026-9393](https://cve.now/CVE-2026-9393.md): H3C Magic B0 aspForm Edit\_BasicSSID\_5G buffer overflow (CVSS 8.7, H3C Magic B0)
- [CVE-2026-9389](https://cve.now/CVE-2026-9389.md): Tenda F456 L7Im frmL7ImForm buffer overflow (CVSS 8.7, Tenda F456)
- [CVE-2026-9388](https://cve.now/CVE-2026-9388.md): Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-9387](https://cve.now/CVE-2026-9387.md): Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-9386](https://cve.now/CVE-2026-9386.md): Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-9385](https://cve.now/CVE-2026-9385.md): Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-4372](https://cve.now/CVE-2026-4372.md): Arbitrary Remote Code Execution via \`\_attn\_implementation\_internal\` Config Injection in huggingface/transformers (CVSS 7.8, huggingface/transformers · transformers)
- [CVE-2026-9384](https://cve.now/CVE-2026-9384.md): Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection (CVSS 9.3, Totolink A8000RU)
- [CVE-2026-9383](https://cve.now/CVE-2026-9383.md): itsourcecode Electronic Judging System login.php sql injection (CVSS 6.9, itsourcecode Electronic Judging System)
- [CVE-2026-9382](https://cve.now/CVE-2026-9382.md): Edimax BR-6675nD POST Request formPPTPSetup buffer overflow (CVSS 8.7, Edimax BR-6675nD)
- [CVE-2026-9381](https://cve.now/CVE-2026-9381.md): Edimax BR-6675nD POST Request formPPPoESetup buffer overflow (CVSS 8.7, Edimax BR-6675nD)
- [CVE-2026-9380](https://cve.now/CVE-2026-9380.md): Edimax BR-6675nD POST Request formL2TPSetup buffer overflow (CVSS 8.7, Edimax BR-6675nD)
- [CVE-2026-9379](https://cve.now/CVE-2026-9379.md): Edimax BR-6675nD POST Request formWpsStart command injection (CVSS 5.3, Edimax BR-6675nD)
- [CVE-2026-9378](https://cve.now/CVE-2026-9378.md): Edimax BR-6675nD POST Request formHwSet command injection (CVSS 5.3, Edimax BR-6675nD)
- [CVE-2026-9377](https://cve.now/CVE-2026-9377.md): SourceCodester SUP Online Shopping productedit.php cross site scripting (CVSS 4.8, SourceCodester SUP Online Shopping)
- [CVE-2026-9376](https://cve.now/CVE-2026-9376.md): JPress UCenter Article Submission Endpoint doWriteSave improper authorization (CVSS 5.3, JPress)
- [CVE-2026-9374](https://cve.now/CVE-2026-9374.md): yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted upload (CVSS 5.3, yangzongzhuan RuoYi-Vue)
- [CVE-2026-9373](https://cve.now/CVE-2026-9373.md): JeecgBoot OpenAPI Endpoint call improper authentication (CVSS 6.3, JeecgBoot)
- [CVE-2026-9372](https://cve.now/CVE-2026-9372.md): ItzCrazyKns Vane Model Provider API route.ts server-side request forgery (CVSS 6.9, ItzCrazyKns Vane)
- [CVE-2026-9371](https://cve.now/CVE-2026-9371.md): ItzCrazyKns Vane API route.ts missing authentication (CVSS 6.3, ItzCrazyKns Vane)
- [CVE-2026-9370](https://cve.now/CVE-2026-9370.md): ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable salt (CVSS 6.3, ulisesbocchio jasypt-spring-boot · com.github.ulisesbocc… +1)
- [CVE-2026-9369](https://cve.now/CVE-2026-9369.md): NousResearch hermes-agent CLI web-dashboard web\_server.py \_discover\_dashboard\_plugins comparison (CVSS 4.8, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-9368](https://cve.now/CVE-2026-9368.md): NousResearch hermes-agent Environment Variable code\_execution\_tool.py execute\_code sandbox (CVSS 6.9, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-9367](https://cve.now/CVE-2026-9367.md): NousResearch hermes-agent terminal\_tool approval.py detect\_dangerous\_command os command injection (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2026-9366](https://cve.now/CVE-2026-9366.md): NousResearch hermes-agent prompt\_builder.py \_scan\_context\_content injection (CVSS 6.9, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-9365](https://cve.now/CVE-2026-9365.md): Ettercap GG Dissector ec\_gg.c FUNC\_DECODER heap-based overflow (CVSS 6.3, Ettercap)
- [CVE-2026-9364](https://cve.now/CVE-2026-9364.md): projectworlds Online Art Gallery Shop adminHome.php sql injection (CVSS 6.9, projectworlds Online Art Gallery Shop)
- [CVE-2026-9363](https://cve.now/CVE-2026-9363.md): Edimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injection (CVSS 5.3, Edimax EW-7438RPn)
- [CVE-2026-9362](https://cve.now/CVE-2026-9362.md): Edimax EW-7438RPn Setting formConnectionSetting command injection (CVSS 5.3, Edimax EW-7438RPn)
- [CVE-2026-9361](https://cve.now/CVE-2026-9361.md): Edimax EW-7438RPn POST Request formAccep formAccept command injection (CVSS 5.3, Edimax EW-7438RPn)
- [CVE-2026-9360](https://cve.now/CVE-2026-9360.md): Edimax EW-7438RPn POST Request formwlencrypt24g buffer overflow (CVSS 8.7, Edimax EW-7438RPn)
- [CVE-2026-9359](https://cve.now/CVE-2026-9359.md): Edimax EW-7438RPn POST Request formHwSet command injection (CVSS 5.3, Edimax EW-7438RPn)
- [CVE-2026-9358](https://cve.now/CVE-2026-9358.md): postcss-selector-parser AST Serialization container.js toString recursion (CVSS 5.3, postcss-selector-parser)
- [CVE-2026-9357](https://cve.now/CVE-2026-9357.md): vBulletin Login cross site scripting (CVSS 5.1, vBulletin)
- [CVE-2026-9356](https://cve.now/CVE-2026-9356.md): SourceCodester Hospitals Patient Records Management System manage\_history.php sql injection (CVSS 6.9, SourceCodester Hospitals Patient Records Management System)
- [CVE-2026-9355](https://cve.now/CVE-2026-9355.md): SourceCodester Hospitals Patient Records Management System Master.php save\_patient\_history sql injection (CVSS 6.9, SourceCodester Hospitals Patient Records Management System)
- [CVE-2026-9354](https://cve.now/CVE-2026-9354.md): NousResearch hermes-agent Slack Agent/Mattermost Agent escape output (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2026-9353](https://cve.now/CVE-2026-9353.md): NousResearch hermes-agent Skills Guard Multi-Word Prompt skills\_guard.py injection (CVSS 6.9, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-3515](https://cve.now/CVE-2026-3515.md): Argument Injection in prefecthq/prefect (CVSS 8.5, prefecthq/prefect · prefect)
- [CVE-2026-9352](https://cve.now/CVE-2026-9352.md): NousResearch hermes-agent Messaging Gateway local.py \_make\_run\_env information disclosure (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2026-9351](https://cve.now/CVE-2026-9351.md): NousResearch hermes-agent read\_file Tool file\_tools.py \_is\_blocked\_device path traversal (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2026-9350](https://cve.now/CVE-2026-9350.md): NousResearch hermes-agent Batch Runner approval.py check\_all\_command\_guards authorization (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2026-9349](https://cve.now/CVE-2026-9349.md): calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure (CVSS 6.9, calcom cal.diy)
- [CVE-2026-48829](https://cve.now/CVE-2026-48829.md): In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanyi (CVSS 7.5, GNU SASL)
- [CVE-2026-9348](https://cve.now/CVE-2026-9348.md): Edimax EW-7438RPn webs mp stack-based overflow (CVSS 8.7, Edimax EW-7438RPn)
- [CVE-2026-9347](https://cve.now/CVE-2026-9347.md): Edimax EW-7438RPn webs formWizSurvey os command injection (CVSS 5.3, Edimax EW-7438RPn)
- [CVE-2026-9346](https://cve.now/CVE-2026-9346.md): Edimax EW-7438RPn webs formWirelessTbl buffer overflow (CVSS 8.7, Edimax EW-7438RPn)
- [CVE-2026-9345](https://cve.now/CVE-2026-9345.md): Edimax EW-7438RPn webs formWizSurvey buffer overflow (CVSS 8.7, Edimax EW-7438RPn)
- [CVE-2026-9344](https://cve.now/CVE-2026-9344.md): Edimax EW-7438RPn webs formWpsStart stack-based overflow (CVSS 8.7, Edimax EW-7438RPn)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.