Week 22, 2026

25 May to 31 May 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 2,069
Critical: 190
High: 875
Added to KEV: 5

Critical 190High 875Medium 947Low 56Not scored 1All 2,069 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
Palo Alto Networks · Cloud NGFW
ExploitedHigh7.8
CVE-2026-45321
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
@tanstack · arktype-adapter
ExploitedCritical9.6
CVE-2026-48027
Compromised Nx Console version 18.95.0
nrwl · nx-console
ExploitedCritical9.3
CVE-2026-8398
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from…
AVB Disc Soft · DAEMON Tools Lite
ExploitedCritical9.3
CVE-2026-48172
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via…
LiteSpeed Technologies · cPanel Plugin
ExploitedCritical10.0

Most severe new CVEsBy CVSS score

CVE-2026-45087
Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode
hahwul · dalfox
Critical10.0
CVE-2026-8054
Unauthenticated SQL Injection in dotCMS Publish Audit API
dotCMS · dotCMS Core
Critical10.0
CVE-2026-49199
Predator Connect W6x: RCE via MQTT
Acer · Predator Connect W6x
Critical10.0
CVE-2026-46840
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable…
Oracle Corporation · Oracle REST Data Services
Critical10.0
CVE-2026-49200
Acer Wave 7 router: Broken Access Control
Acer · Wave 7 router
Critical10.0
CVE-2026-43898
SandboxJS: Sandbox escape via Function.caller leakage of internal call op
nyariv · SandboxJS
Critical10.0
CVE-2026-45631
Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret
Dokploy · dokploy
Critical10.0
CVE-2026-8326
Remote Spark SparkView Path Traversal in RDP Drive Redirection leading to RCE
Remote Spark (https://www.remotespark.com/) · SparkView
Critical10.0
CVE-2026-9508
Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStar
Suprema · BioStar 2 (server)
Critical10.0
CVE-2026-49197
Predator Connect W6x: Improper Authentication
Acer · Predator Connect W6x
Critical10.0

Week 22, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses