CVEs published in May 2026

CVE-2026-43870Critical

CVE-2026-43513High

CVE-2026-41284High

CVE-2026-0265Critical

PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled

CVE-2026-0264Critical

PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution

CVE-2026-0263Critical

PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing

CVE-2026-0262High

PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing

CVE-2026-0261High

PAN-OS: Authenticated Admin Command Injection Vulnerability

CVE-2026-0259High

WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B)

CVE-2026-0258High

PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching

CVE-2026-0256Medium

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

CVE-2026-45292High

Denial of Service due to unbounded memory allocation when parsing oversized baggage

CVE-2026-48526High

Authentication bypass due to forged JSON Web Tokens

CVE-2026-9807Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0…

CVE-2026-44604High

Command injection in rpmuncompress doUntar via unescaped archive top-level directory name in popen shell command

CVE-2026-32998Critical

Veeam Service Provider Console: This vulnerability in Veeam Service Provider Console allows for remote code execution.

CVE-2026-32997High

CVE-2026-32996High

CVE-2026-0300CriticalCISA KEV

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

CVE-2026-8716Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, and 19.0…

CVE-2026-6713Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0…

CVE-2026-42790High

Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

CVE-2026-2237Medium

use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information

CVE-2025-66593Medium

origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation

CVE-2025-66592Medium

origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation

CVE-2025-30028High

vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files

CVE-2025-14713High

Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server

CVE-2025-13593Medium

Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation

CVE-2025-13392High

Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN)

CVE-2025-13167Medium

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors

CVE-2025-12686Critical

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors

CVE-2025-10466Medium

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct limited denial-of-service in SRM

CVE-2024-47272Medium

CVE-2024-47271Medium

CVE-2024-47270Medium

CVE-2024-47269Medium

CVE-2024-47268Medium

CVE-2024-47267Medium

CVE-2024-11399High

CVE-2023-52945High

CVE-2026-41704Medium

BOSH: AgentClient#handle_method (lines 264-303) processes every NATS reply.

CVE-2026-41009Medium

BOSH: When the director sends a long-running request (e.g.

CVE-2026-9999Critical

Inappropriate implementation in ANGLE

CVE-2026-9998High

Integer overflow in Skia

CVE-2026-9997Critical

Use after free in Input

CVE-2026-9996High

Out of bounds read in WebRTC

CVE-2026-9995High

Use after free in WebXR

CVE-2026-9994Critical

Use after free in Core

CVE-2026-9993High

Use after free in Views

CVE-2026-9992Critical

Use after free in Network

CVE-2026-9991High

Inappropriate implementation in Media

CVE-2026-9990High

Use after free in WebAppInstalls

CVE-2026-9989Critical

Inappropriate implementation in Media

CVE-2026-9988Critical

Use after free in WebRTC

CVE-2026-9987High

Insufficient validation of untrusted input in WebAppInstalls

CVE-2026-9986High

Insufficient validation of untrusted input in OptimizationGuide

CVE-2026-9985High

Insufficient validation of untrusted input in Media

CVE-2026-9984High

Use after free in UI

CVE-2026-9983High

Type Confusion in Skia

CVE-2026-9982High

Insufficient validation of untrusted input in ANGLE

CVE-2026-9981High

Inappropriate implementation in Skia

CVE-2026-9980High

Insufficient validation of untrusted input in Printing

CVE-2026-9979High

Insufficient validation of untrusted input in Input

CVE-2026-9978High

Use after free in Glic

CVE-2026-9977Critical

Insufficient validation of untrusted input in WebShare

CVE-2026-9976High

Inappropriate implementation in USB

CVE-2026-9975High

Out of bounds read and write in ANGLE

CVE-2026-9974Critical

Out of bounds write in GPU

CVE-2026-9973High

Out of bounds write in V8

CVE-2026-9972Critical

Uninitialized Use in Gamepad

CVE-2026-9971High

Inappropriate implementation in iOS

CVE-2026-9970Critical

Use after free in WebGL

CVE-2026-9969High

Insufficient validation of untrusted input in ANGLE

CVE-2026-9968High

Integer overflow in V8

CVE-2026-9967Critical

Out of bounds write in GPU

CVE-2026-9966Critical

Integer overflow in XML

CVE-2026-9965High

Out of bounds write in ANGLE

CVE-2026-9964High

Use after free in Bluetooth

CVE-2026-9963High

Uninitialized Use in iOS

CVE-2026-9962Critical

Use after free in WebRTC

CVE-2026-9961High

Use after free in SurfaceCapture

CVE-2026-9960High

Integer overflow in PDFium

CVE-2026-9959High

Race in WebRTC

CVE-2026-9958High

Use after free in PDFium

CVE-2026-9957Critical

Use after free in PDF

CVE-2026-9956High

Use after free in iOS

CVE-2026-9955High

Inappropriate implementation in iOS

CVE-2026-9954High

Use after free in TabStrip

CVE-2026-9953High

Out of bounds read in ANGLE

CVE-2026-9952High

Use after free in WebAudio

CVE-2026-9951Critical

Use after free in UI

CVE-2026-9950High

Insufficient validation of untrusted input in iOS

CVE-2026-9949Critical

Use after free in Core

CVE-2026-9948Critical

Use after free in Views

CVE-2026-9947Critical

Use after free in XML

CVE-2026-9946Critical

Use after free in ANGLE

CVE-2026-9945High

Use after free in Media

CVE-2026-9944High

Uninitialized Use in ANGLE

CVE-2026-9943High

Out of bounds read in WebGL

CVE-2026-9942High

Uninitialized Use in ANGLE