Week 19, 2026
4 May to 10 May 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,659
- Critical
- 185
- High
- 590
- Added to KEV
- 3
Critical 185High 590Medium 813Low 69Not scored 2All 1,659 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-42208
LiteLLM: SQL injection in Proxy API key verification
BerriAI · litellm
ExploitedCritical9.3 - CVE-2026-6973
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to…
Ivanti · Endpoint Manager Mobile
ExploitedHigh7.2 - CVE-2026-0300
PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
Palo Alto Networks · Cloud NGFW
ExploitedCritical9.3
Most severe new CVEsBy CVSS score
- CVE-2026-7411
In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote…
Eclipse Foundation · Eclipse BaSyx
Critical10.0 - CVE-2026-40281
Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values
gotenberg · gotenberg
Critical10.0 - CVE-2026-42826
Azure DevOps Information Disclosure Vulnerability
Microsoft · Azure DevOps
Critical10.0 - CVE-2026-42369
GeoVision GV-VMS V20 WebCam Server stack overflow vulnerability
GeoVision Inc. · GV-VMS V20.0.2
Critical10.0 - CVE-2026-42298
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
gitroomhq · postiz-app
Critical10.0 - CVE-2026-41070
openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access
jkroepke · openvpn-auth-oauth2
Critical10.0 - CVE-2026-6213
Remote Spark SparkView RCE
Remote Spark (https://www.remotespark.com/) · SparkView
Critical10.0 - CVE-2026-42160
Data Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backend
sovity · dataspace-portal
Critical10.0 - CVE-2026-42287
Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions
emlog · emlog
Critical10.0 - CVE-2026-42364
GeoVision LPC2011/LPC2211 Web Interface / DdnsSetting.cgi OS command injection vulnerability
GeoVision Inc. · GV-LPC2011/LPC2211
Critical9.9