Week 21, 2026

18 May to 24 May 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 952
Critical: 121
High: 332
Added to KEV: 10

Critical 121High 332Medium 429Low 69Not scored 1All 952 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Drupal · Drupal core
ExploitedCritical9.8
CVE-2025-34291
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Langflow · Langflow
ExploitedCritical9.4
CVE-2026-34926
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to…
Trend Micro, Inc. · TrendAI Apex One
ExploitedMedium6.7
CVE-2008-4250
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote…
Product not named
ExploitedCritical9.8
CVE-2010-0806
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute…
Product not named
ExploitedHigh8.8
CVE-2010-0249
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows…
Product not named
ExploitedHigh8.8
CVE-2009-3459
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code…
Product not named
ExploitedHigh8.8
CVE-2009-1537
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows…
Product not named
ExploitedHigh8.8
CVE-2026-41091
Microsoft Defender Elevation of Privilege Vulnerability
Microsoft · Microsoft Malware Protection Engine
ExploitedHigh7.8
CVE-2026-45498
Microsoft Defender Denial of Service Vulnerability
Microsoft · Microsoft Defender Antimalware Platform
ExploitedMedium4.0

Most severe new CVEsBy CVSS score

CVE-2026-34910
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0
CVE-2026-34908
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to…
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0
CVE-2026-34909
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system…
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0
CVE-2026-48172
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via…
LiteSpeed Technologies · cPanel Plugin
ExploitedCritical10.0
CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary…
Chroma · ChromaDB
Critical10.0
CVE-2026-34234
CtrlPanel: Unauthenticated RCE using installer script
Ctrlpanel-gg · panel
Critical10.0
CVE-2026-41104
Microsoft Planetary Computer Pro Information Disclosure Vulnerability
Microsoft · Microsoft Planetary Computer Pro (GeoCatalog)
Critical10.0
CVE-2026-20223
Cisco Secure Workload Unauthorized API Access Vulnerability
Cisco · Cisco Secure Workload
Critical10.0
CVE-2026-23652
Microsoft Power Pages Remote Code Execution Vulnerability
Microsoft · Microsoft Power Pages
Critical10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
golang.org/x/crypto · golang.org/x/crypto/ssh
Critical10.0

Week 21, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses