# CVEs published 2026-05-31

51 CVEs were published on May 31, 2026: 1 critical, 19 high. Days are UTC.

- [CVE-2026-10204](https://cve.now/CVE-2026-10204.md): OFCMS JSON Query SysUserController.java query sql injection (CVSS 5.3, OFCMS)
- [CVE-2026-10203](https://cve.now/CVE-2026-10203.md): OFCMS JSON Query SystemParamController.java query sql injection (CVSS 5.3, OFCMS)
- [CVE-2026-10202](https://cve.now/CVE-2026-10202.md): OFCMS JSON Query SystemDictController.java query sql injection (CVSS 5.3, OFCMS)
- [CVE-2026-10201](https://cve.now/CVE-2026-10201.md): Assimp UV Channel FBXExporter.cpp WriteObjects divide by zero (CVSS 4.8, Assimp)
- [CVE-2026-10200](https://cve.now/CVE-2026-10200.md): Assimp 4x4 Matrix glTFCommon.h CopyValue heap-based overflow (CVSS 4.8, Assimp)
- [CVE-2026-10199](https://cve.now/CVE-2026-10199.md): Assimp glTF2Asset.h LazyDict null pointer dereference (CVSS 4.8, Assimp)
- [CVE-2026-10198](https://cve.now/CVE-2026-10198.md): Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference (CVSS 4.8, Assimp)
- [CVE-2026-10197](https://cve.now/CVE-2026-10197.md): Assimp TF File glTF2Importer.cpp ImportEmbeddedTextures null pointer dereference (CVSS 4.8, Assimp)
- [CVE-2026-48210](https://cve.now/CVE-2026-48210.md): Possible information disclosure via External Interface (CVSS 5.7, OTRS AG OTRS)
- [CVE-2026-8796](https://cve.now/CVE-2026-8796.md): Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input (CVSS 8.1, YVES Sereal::Decoder)
- [CVE-2026-10194](https://cve.now/CVE-2026-10194.md): OFFIS DCMTK dcmqrscp dcmqrdbi.cc deleteOldestImages heap-based overflow (CVSS 5.3, OFFIS DCMTK)
- [CVE-2026-10193](https://cve.now/CVE-2026-10193.md): OFCMS ComnController ComnController.java query sql injection (CVSS 5.3, OFCMS)
- [CVE-2026-10192](https://cve.now/CVE-2026-10192.md): Tenda W12 httpd set\_local\_time\_0 stack-based overflow (CVSS 8.7, Tenda W12)
- [CVE-2026-10191](https://cve.now/CVE-2026-10191.md): Tenda W12 httpd cgiWifiMacFilterSet stack-based overflow (CVSS 8.7, Tenda W12)
- [CVE-2026-10190](https://cve.now/CVE-2026-10190.md): Tenda W12 Web Management httpd cgiSysWebTimeoutSet denial of service (CVSS 7.1, Tenda W12)
- [CVE-2026-10189](https://cve.now/CVE-2026-10189.md): Tenda W12 httpd cgiSysTimeInfoSet stack-based overflow (CVSS 8.7, Tenda W12)
- [CVE-2026-10188](https://cve.now/CVE-2026-10188.md): Tenda W12 httpd cgistaKickOff stack-based overflow (CVSS 8.7, Tenda W12)
- [CVE-2026-10187](https://cve.now/CVE-2026-10187.md): Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow (CVSS 9.3, Totolink N300RH)
- [CVE-2026-10186](https://cve.now/CVE-2026-10186.md): code-projects Online Hospital Management System patient.php sql injection (CVSS 6.9, code-projects Online Hospital Management System)
- [CVE-2026-10185](https://cve.now/CVE-2026-10185.md): SourceCodester Hospitals Patient Records Management System Users.php save sql injection (CVSS 6.9, SourceCodester Hospitals Patient Records Management System)
- [CVE-2026-10184](https://cve.now/CVE-2026-10184.md): SourceCodester Hospitals Patient Records Management System Users.php delete sql injection (CVSS 6.9, SourceCodester Hospitals Patient Records Management System)
- [CVE-2026-10183](https://cve.now/CVE-2026-10183.md): TRENDnet TEW-432BRP formWlanSetup stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10182](https://cve.now/CVE-2026-10182.md): TRENDnet TEW-432BRP formWlanSetup command injection (CVSS 5.3, TRENDnet TEW-432BRP)
- [CVE-2026-10181](https://cve.now/CVE-2026-10181.md): TRENDnet TEW-432BRP formSysCmd stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-49490](https://cve.now/CVE-2026-49490.md): OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column (CVSS 8.6, OpenCATS)
- [CVE-2026-49489](https://cve.now/CVE-2026-49489.md): OpenCATS - SQL Injection in DataGrid sortDirection Parameter (CVSS 8.4, OpenCATS)
- [CVE-2026-10180](https://cve.now/CVE-2026-10180.md): TRENDnet TEW-432BRP formSysCmd command injection (CVSS 5.3, TRENDnet TEW-432BRP)
- [CVE-2026-10179](https://cve.now/CVE-2026-10179.md): TRENDnet TEW-432BRP formSetWlanEncrypt stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10178](https://cve.now/CVE-2026-10178.md): code-projects Online Music Site AdminEditAlbum.php sql injection (CVSS 6.9, code-projects Online Music Site)
- [CVE-2026-10177](https://cve.now/CVE-2026-10177.md): Aider-AI Aider AWS EC2 Metadata Endpoint api\_docs.py requests.get server-side request forgery (CVSS 5.3, Aider-AI Aider · aider-chat)
- [CVE-2026-10176](https://cve.now/CVE-2026-10176.md): Aider-AI Aider Code Generation Workflow sql injection (CVSS 5.3, Aider-AI Aider)
- [CVE-2026-10175](https://cve.now/CVE-2026-10175.md): Aider-AI Aider Architect Mode auth.py editor\_coder.run code injection (CVSS 5.3, Aider-AI Aider · aider-chat)
- [CVE-2026-10174](https://cve.now/CVE-2026-10174.md): Aider-AI Aider Pre-commit Hook args.py protection mechanism (CVSS 5.3, Aider-AI Aider)
- [CVE-2026-10173](https://cve.now/CVE-2026-10173.md): Orthanc Explorer 2 URL StudyList.vue cross site scripting (CVSS 5.3, Orthanc Explorer)
- [CVE-2026-10172](https://cve.now/CVE-2026-10172.md): Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload (CVSS 5.3, Bdtask Multi-Store Inventory Management System)
- [CVE-2026-10171](https://cve.now/CVE-2026-10171.md): code-projects Online Music Site AdminUpdateAlbum.php sql injection (CVSS 5.1, code-projects Online Music Site)
- [CVE-2026-10170](https://cve.now/CVE-2026-10170.md): code-projects Visitor Management System phone\_0.php sql injection (CVSS 5.3, code-projects Visitor Management System)
- [CVE-2026-10169](https://cve.now/CVE-2026-10169.md): OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax\_forgot\_password password recovery (CVSS 6.3, OUSL-GROUP-BrinaryBrains School Student Management System)
- [CVE-2026-10168](https://cve.now/CVE-2026-10168.md): OUSL-GROUP-BrinaryBrains School Student Management System Parents.php marks resource injection (CVSS 5.3, OUSL-GROUP-BrinaryBrains School Student Management System)
- [CVE-2026-10167](https://cve.now/CVE-2026-10167.md): OUSL-GROUP-BrinaryBrains School Student Management System MY\_Controller Login.php sign\_auth\_cookie improper authentication (CVSS 6.9, OUSL-GROUP-BrinaryBrains School Student Management System)
- [CVE-2026-10166](https://cve.now/CVE-2026-10166.md): Edimax BR-6478AC POST Request formWlbasic command injection (CVSS 5.3, Edimax BR-6478AC)
- [CVE-2026-10165](https://cve.now/CVE-2026-10165.md): Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow (CVSS 8.7, Edimax BR-6478AC)
- [CVE-2026-10164](https://cve.now/CVE-2026-10164.md): Edimax BR-6478AC POST Request formUSBFolder buffer overflow (CVSS 8.7, Edimax BR-6478AC)
- [CVE-2026-8382](https://cve.now/CVE-2026-8382.md): Advanced Custom Fields (ACF®) \<= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '\_post\_title' and '\_post\_content' Parameters (CVSS 5.3, wpengine Advanced Custom Fields)
- [CVE-2026-10163](https://cve.now/CVE-2026-10163.md): Edimax BR-6478AC POST Request formUSBAccount buffer overflow (CVSS 8.7, Edimax BR-6478AC)
- [CVE-2026-10162](https://cve.now/CVE-2026-10162.md): TRENDnet TEW-432BRP formSetPassword stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10161](https://cve.now/CVE-2026-10161.md): TRENDnet TEW-432BRP formResetStatistic stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10160](https://cve.now/CVE-2026-10160.md): TRENDnet TEW-432BRP formSetEnableWizard stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10159](https://cve.now/CVE-2026-10159.md): TRENDnet TEW-432BRP formSysLog stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10158](https://cve.now/CVE-2026-10158.md): TRENDnet TEW-432BRP formPortFw stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-10157](https://cve.now/CVE-2026-10157.md): Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication (CVSS 6.9, Open5GS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.