# CVEs published 2026-05-30

51 CVEs were published on May 30, 2026: 1 critical, 32 high. Days are UTC.

- [CVE-2026-10156](https://cve.now/CVE-2026-10156.md): Open5GS nf-instances Endpoint nnrf-handler.c handle\_amf\_info resource consumption (CVSS 5.3, Open5GS)
- [CVE-2026-10155](https://cve.now/CVE-2026-10155.md): Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts\_report\_search sql injection (CVSS 5.1, Bdtask Multi-Store Inventory Management System)
- [CVE-2026-10154](https://cve.now/CVE-2026-10154.md): Dolibarr ERP CRM messaging.php authorization (CVSS 5.3, Dolibarr ERP CRM)
- [CVE-2026-10153](https://cve.now/CVE-2026-10153.md): westboy CicadasCMS AbstractCacheManager.java search cross site scripting (CVSS 5.3, westboy CicadasCMS)
- [CVE-2026-10152](https://cve.now/CVE-2026-10152.md): TaleLin lin-cms-spring-boot book Endpoint BookController.java access control (CVSS 5.3, TaleLin lin-cms-spring-boot)
- [CVE-2026-10127](https://cve.now/CVE-2026-10127.md): Edimax BR-6478AC POST Request formStaDrvSetup command injection (CVSS 5.3, Edimax BR-6478AC)
- [CVE-2026-10126](https://cve.now/CVE-2026-10126.md): Edimax BR-6478AC POST Request formQoS buffer overflow (CVSS 8.7, Edimax BR-6478AC)
- [CVE-2026-10125](https://cve.now/CVE-2026-10125.md): Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow (CVSS 8.7, Edimax BR-6478AC)
- [CVE-2026-10124](https://cve.now/CVE-2026-10124.md): Shibby Tomato Zserv ripd rip\_zebra\_read\_ipv4 stack-based overflow (CVSS 8.7, Shibby Tomato)
- [CVE-2026-8594](https://cve.now/CVE-2026-8594.md): Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters (CVSS 6.2, NEZUMI Text::LineFold)
- [CVE-2026-10123](https://cve.now/CVE-2026-10123.md): TRENDnet TEW-432BRP formSetDomainFilter stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10122](https://cve.now/CVE-2026-10122.md): TRENDnet TEW-432BRP formSetProtocolFilter stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10121](https://cve.now/CVE-2026-10121.md): TRENDnet TEW-432BRP formSetUrlFilter stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2018-25426](https://cve.now/CVE-2018-25426.md): WinMTR 0.91 Denial of Service via Buffer Overflow (CVSS 8.7, WinMTR)
- [CVE-2018-25425](https://cve.now/CVE-2018-25425.md): Yot CMS 3.3.1 SQL Injection via aid and cid Parameters (CVSS 8.8, Yot CMS)
- [CVE-2018-25424](https://cve.now/CVE-2018-25424.md): Gate Pass Management System 2.1 SQL Injection via login-exec.php (CVSS 8.8, Livebms Gate Pass Management System)
- [CVE-2018-25423](https://cve.now/CVE-2018-25423.md): Arm Whois 3.11 Denial of Service via Buffer Overflow (CVSS 6.9, Armcode Arm Whois)
- [CVE-2018-25422](https://cve.now/CVE-2018-25422.md): MOGG web simulator Script All Version SQL Injection via play.php (CVSS 8.8, spider312 MOGG web simulator Script)
- [CVE-2018-25421](https://cve.now/CVE-2018-25421.md): Open STA Manager 2.3 Arbitrary File Download via Path Traversal (CVSS 7.1, Openstamanager Open STA Manager)
- [CVE-2018-25420](https://cve.now/CVE-2018-25420.md): AiOPMSD Final 1.0.0 SQL Injection via watch.php (CVSS 8.8, AiOPMSD Final)
- [CVE-2018-25419](https://cve.now/CVE-2018-25419.md): AiOPMSD Final 1.0.0 SQL Injection via genre.php (CVSS 8.8, AiOPMSD Final)
- [CVE-2018-25418](https://cve.now/CVE-2018-25418.md): AiOPMSD Final 1.0.0 SQL Injection via year.php (CVSS 8.8, AiOPMSD Final)
- [CVE-2018-25417](https://cve.now/CVE-2018-25417.md): AiOPMSD Final 1.0.0 SQL Injection via quality.php (CVSS 8.8, AiOPMSD Final)
- [CVE-2018-25416](https://cve.now/CVE-2018-25416.md): AiOPMSD Final 1.0.0 SQL Injection via country.php (CVSS 8.8, AiOPMSD Final)
- [CVE-2018-25415](https://cve.now/CVE-2018-25415.md): AiOPMSD Final 1.0.0 SQL Injection via director Parameter (CVSS 8.8, AiOPMSD Final)
- [CVE-2018-25414](https://cve.now/CVE-2018-25414.md): AiOPMSD Final 1.0.0 SQL Injection via actor.php (CVSS 8.8, AiOPMSD Final)
- [CVE-2018-25413](https://cve.now/CVE-2018-25413.md): AiOPMSD Final 1.0.0 SQL Injection via search.php (CVSS 8.8, AiOPMSD Final)
- [CVE-2018-25412](https://cve.now/CVE-2018-25412.md): Delta Sql 1.8.2 Arbitrary File Upload via docs\_upload.php (CVSS 9.3, Deltasql Delta Sql)
- [CVE-2018-25411](https://cve.now/CVE-2018-25411.md): MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php (CVSS 8.8, M-Gb MGB OpenSource Guestbook)
- [CVE-2018-25410](https://cve.now/CVE-2018-25410.md): SIM-PKH 2.4.1 SQL Injection via media.php id Parameter (CVSS 7.1, Simpkh SIM-PKH)
- [CVE-2018-25409](https://cve.now/CVE-2018-25409.md): SIM-PKH 2.4.1 Arbitrary File Upload via aksi\_pengurus.php (CVSS 8.7, Simpkh SIM-PKH)
- [CVE-2018-25408](https://cve.now/CVE-2018-25408.md): The Open ISES Project 3.30A Path Traversal Arbitrary File Download (CVSS 8.7, Openises Open ISES Project)
- [CVE-2018-25407](https://cve.now/CVE-2018-25407.md): eNdonesia Portal 8.7 SQL Injection via mod.php (CVSS 8.8, eNdonesia Portal)
- [CVE-2018-25406](https://cve.now/CVE-2018-25406.md): eNdonesia Portal 8.7 SQL Injection via mod.php (CVSS 8.8, eNdonesia Portal)
- [CVE-2018-25405](https://cve.now/CVE-2018-25405.md): eNdonesia Portal 8.7 SQL Injection via mod.php (CVSS 8.8, eNdonesia Portal)
- [CVE-2026-10120](https://cve.now/CVE-2026-10120.md): TRENDnet TEW-432BRP formSetFirewallRule stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10119](https://cve.now/CVE-2026-10119.md): TRENDnet TEW-432BRP formSetMACFilter stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10117](https://cve.now/CVE-2026-10117.md): Open5GS nghttp2-server.c ogs\_pool\_id\_calloc denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-46242](https://cve.now/CVE-2026-46242.md): eventpoll: fix ep\_remove struct eventpoll / struct file UAF (CVSS 7.8, Linux)
- [CVE-2026-10116](https://cve.now/CVE-2026-10116.md): Open5GS ue-authentications Endpoint ogs-timer.c ogs\_sbi\_xact\_add denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-10115](https://cve.now/CVE-2026-10115.md): Open5GS Shared NF-profile nnrf-handler.c denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-10114](https://cve.now/CVE-2026-10114.md): Open5GS Shared NF-profile nnrf-handler.c handle\_scp\_info out-of-bounds write (CVSS 5.3, Open5GS)
- [CVE-2026-7459](https://cve.now/CVE-2026-7459.md): Simple History – Track, Log, and Audit WordPress Changes \<= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint (CVSS 7.5, eskapism Simple History – Track, Log, and Audit WordPress C…)
- [CVE-2026-7465](https://cve.now/CVE-2026-7465.md): Spectra Gutenberg Blocks \<= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes (CVSS 8.8, brainstormforce Spectra Gutenberg Blocks – Website Builder…)
- [CVE-2026-9757](https://cve.now/CVE-2026-9757.md): GEO my WP \<= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters (CVSS 7.5, ninjew GEO my WP)
- [CVE-2026-10113](https://cve.now/CVE-2026-10113.md): Open5GS Shared NF-profile nnrf-handler.c denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-10112](https://cve.now/CVE-2026-10112.md): sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting (CVSS 4.8, sambitraj STUDENT-MANAGEMENT-SYSTEM)
- [CVE-2026-10111](https://cve.now/CVE-2026-10111.md): sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection (CVSS 6.9, sambitraj STUDENT-MANAGEMENT-SYSTEM)
- [CVE-2026-5071](https://cve.now/CVE-2026-5071.md): can: Local Denial of Service via SocketCAN Send (CVSS 6.1, zephyrproject-rtos Zephyr)
- [CVE-2026-10110](https://cve.now/CVE-2026-10110.md): code-projects Student Details Management System index.php sql injection (CVSS 6.9, code-projects Student Details Management System)
- [CVE-2026-48840](https://cve.now/CVE-2026-48840.md): Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memor (CVSS 5.3, Exim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.