CVEs published in May 2026

CVE-2026-6787High

Use of Hard-coded Cryptographic Key vulnerability in WatchGuard Agent on Windows allows Inclusion of Code in Existing Process

CVE-2026-41288High

Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated local user to elevate their privileges to NT AUTHORITY\\SYSTEM

CVE-2026-41286High

Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers

CVE-2026-20219Medium

Cisco Slido Insecure Direct Object Reference Vulnerability

CVE-2026-20195Medium

CVE-2026-20193Medium

CVE-2026-20189Medium

Cisco Prime Infrastructure Information Disclosure Vulnerability

CVE-2026-20185High

Cisco SG350 and SG350X Series Managed Switches SNMP Denial of Service Vulnerability

CVE-2026-20172Medium

Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability

CVE-2026-20169High

CVE-2026-20168High

CVE-2026-20167High

CVE-2026-20035High

CVE-2026-20034High

CVE-2026-41287High

Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers

CVE-2026-28780Critical

Apache HTTP Server Vulnerability in NetApp Products

CVE-2025-20205Medium

CVE-2025-20204Medium

CVE-2026-29168High

unrestricted OCSP response leads to resource exhaustion

CVE-2026-6918Critical

Denial of Service in JITServer via crafted TCP message

CVE-2026-6322High

URI authority bypass due to improper delimiter handling

CVE-2020-13949Medium

CVE-2026-43868Critical

Denial of Service via excessive memory allocation

CVE-2026-43869Critical

Security bypass due to improper certificate validation

CVE-2026-6321High

Path traversal vulnerability allows bypass of security policies

CVE-2026-42154High

Denial of Service via uncontrolled memory allocation in remote read endpoint

CVE-2026-42151High

Information disclosure of Azure OAuth client secret via config API

CVE-2026-42812Critical

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and

CVE-2026-42811Critical

In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a…

CVE-2026-42810Critical

Apache Polaris: Apache Polaris accepts literal `*` characters in namespace and table names.

CVE-2026-42809Critical

Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table…

CVE-2026-40682Critical

XML External Entity (XXE) vulnerability via crafted dictionary parsing

CVE-2026-42027Critical

Arbitrary Class Loading via Model Manifest

CVE-2026-42440High

Denial of Service via unbounded array allocation in crafted model files

CVE-2026-40563High

Apache Atlas Apache: Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL…

CVE-2026-29169High

NULL pointer dereference via specially crafted request

CVE-2026-23918High

Remote Code Execution via Double Free in HTTP/2 Protocol

CVE-2026-33006Medium

timing attack allows a bypass of digest authentication

CVE-2026-33007Medium

NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier

CVE-2026-33523Medium

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers

CVE-2026-33857High

off-by-one out-of-bounds reads in AJP getter functions

CVE-2026-34032High

heap-based buffer over-read due to missing null-termination check

CVE-2026-34059High

heap-based buffer over-read and memory disclosure in ajp_parse_data

CVE-2026-24072High

escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier

CVE-2026-33846High

Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly

CVE-2026-7598Critical

integer overflow via large username or password arguments

CVE-2026-42779Critical

CVE-2026-42778Critical

CVE-2026-42404Critical

Information disclosure and network access bypass via PolicyReference API

CVE-2026-42402Critical

Denial of Service via algorithmic complexity in policy normalization

CVE-2026-42403Critical

Denial of Service via circular policy references

CVE-2026-22726Medium

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules.

CVE-2026-42512High

FreeBSD Vulnerability in NetApp Products

CVE-2026-42511High

FreeBSD Vulnerability in NetApp Products

CVE-2026-35547Critical

FreeBSD Vulnerability in NetApp Products