CVEs published May 18 to May 24, 2026
952 CVEs were published May 18 to May 24, 2026, 116 of them critical. CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities catalog.
- CVEs published
- 952
- Critical
- 116
- Added to CISA KEV
- 10
- Busiest day
- Tue, May 19 (205)
- Quietest day
- Sat, May 23 (41)
- May 18, 2026101 CVEs · 13 critical
- May 19, 2026205 CVEs · 29 critical
- May 20, 2026201 CVEs · 21 critical
- May 21, 2026187 CVEs · 15 critical
- May 22, 2026152 CVEs · 26 critical
- May 23, 202641 CVEs · 2 critical
- May 24, 202665 CVEs · 10 critical
Added to CISA KEV 10
- CVE-2008-4250The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta a
- CVE-2009-1537Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows
- CVE-2009-3459Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to exe
- CVE-2010-0249Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2
- CVE-2010-0806Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote at
- CVE-2026-41091Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Malware Protection Engine
- CVE-2026-45498Microsoft Defender Denial of Service VulnerabilityMicrosoft Defender Antimalware Platform
- CVE-2025-34291Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCELangflow
- CVE-2026-34926A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key tableTrend Micro TrendAI Apex One
- CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004Drupal core · drupal +1