CVE Tools
Sign in
month report

May 2026

Data as of Jun 29, 2026, 05:00 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

May 2026 closed with 7,365 published CVEs — +68.9% YoY . 642 criticals, 21 added to CISA KEV (2 ransomware-linked). linux led volume, mostly via linux. Biggest breakout: google at ×7.9 their 12-month median. Top weakness class — CWE-79 (601 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
7,365
+14.4% MoM+68.9% YoY
Severity mix
642 / 2,735
critical / high
KEV added
21
2 ransomware-linked
Nuclei coverage
0.6%
41 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
13.4
n=30
Within 7 days
36.7%
Within 30 days
93.3%
Days → KEV (median)
2
n=19
Detection gap

KEV pressure, no Nuclei coverage

May 2026 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in May 2026

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

79XSS89SQL Injection862Missing Authorization416Use After Free22Path Traversal78OS Command Injection476NULL Pointer Dereference125Out-of-bounds Read94Code Injection20Improper Input Validationlinux9611563google4112931455сообщество свободного программного обеспечения1271126261414515microsoft corp715021612333microsoft5228526437google inc3339131apple172155apache software foundation4242267npm34322apache4242267ооо «русбитех-астра»818136openclaw1621

Most discussed CVEs — May 2026

No CVE mentions in the news this month yet.

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1linux·
    1,028 CVE43 critCVSS 6.5
    linux (1028) · linux kernel (1016)
  • 2google↑3
    380 CVE13 critCVSS 6.9
    ×7.9
    chrome (370) · google chrome (127) · android (7)
  • 3microsoft·
    278 CVE26 critCVSS 7.4
    KEV 3
    microsoft edge (110) · windows server 2025 (server core installation) (66) · windows server 2025 (66)
  • 4сообщество свободного программного обеспечения↑25
    266 CVE25 critCVSS 7.2
    KEV 2Nuclei 11PoC 1
    debian gnu/linux (105) · open webui (36) · linux (36)
  • 5apple↑57
    100 CVECVSS 6.8
    macos (91) · ipados (70) · iphone os (70)
  • 6redhat↑6
    95 CVE6 critCVSS 7.1
    Nuclei 1
    red hat enterprise linux (36) · red hat enterprise linux 10 (24) · red hat enterprise linux 9 (24)
  • 7apache software foundation↑3
    87 CVE19 critCVSS 7.3
    ×4.1
    apache ofbiz (17) · http server (11) · apache http server (11)
  • 8npm↓6
    86 CVE
    openclaw (33) · flowise (15) · @hulumi/policies (4)
  • 9ооо «русбитех-астра»—
    84 CVECVSS 5.8
    astra linux special edition (84) · parsec (7) · linux astra modules (5)
  • 10apache↑1
    80 CVE18 critCVSS 7.3
    ×4.0
    ofbiz (17) · http server (11) · cloudstack (7)
  • 11openclaw↓7
    75 CVE8 critCVSS 7.2
    openclaw (70) · crabbox (5)
  • 12edimax—
    59 CVECVSS 7.8
    ×7.9
    ew-7438rpn (24) · br-6675nd (12) · br-6478ac (11)
  • 13open-webui—
    59 CVE1 critCVSS 6.6
    Nuclei 2
    open-webui (59)
  • 14openwebui—
    59 CVE1 critCVSS 6.6
    Nuclei 2
    open webui (59)
  • 15ао «ивк»—
    57 CVE3 critCVSS 7.0
    альт сп 10 (56) · альт 8 сп (30)
  • 16f5—
    53 CVE1 critCVSS 7.0
    ×5.9
    big-ip (44) · big-ip ssl orchestrator (23) · big-ip application security manager (23)
  • 17adobe↓2
    52 CVE2 critCVSS 6.8
    commerce b2b (15) · magento open source (15) · adobe commerce (15)
  • 18totolink↓11
    50 CVE31 critCVSS 8.8
    a8000ru (26) · ca750-poe (9) · n300rh (7)
  • 19amd—
    49 CVECVSS 7.4
    ×3.3
    amd ryzen™ embedded 8000 series processors (18) · amd ryzen™ 7035 series processors with radeon™ graphics (formerly codenamed "rembrandt r") (12) · amd ryzen™ 8040 series mobile processors with radeon™ graphics (formerly codenamed "hawk point") (12)
  • 20ibm·
    49 CVE6 critCVSS 6.8
    http server (8) · db2 (6) · aspera high-speed transfer server (4)
  • 21edimax technology co., ltd.—
    46 CVECVSS 7.9
    NEW
    edimax ew-7438rpn (19) · edimax br-6675nd (13) · edimax br-6478ac (9)
  • 22concrete cms—
    44 CVECVSS 7.0
    NEW
    concrete cms (44)
  • 23crates.io↑29
    44 CVE
    gix (4) · diesel (3) · lemmy_api (3)
  • 24mozilla↓5
    44 CVE9 critCVSS 8.0
    firefox (43) · thunderbird (37) · firefox esr (4)
  • 25open ises—
    44 CVECVSS 6.4
    NEW
    tickets (37) · open ises project (7)
  • 26packagist↓10
    43 CVE1 critCVSS 9.1
    phpmyfaq/phpmyfaq (24) · thorsten/phpmyfaq (24) · azuracast/azuracast (3)
  • 27helmholz—
    42 CVECVSS 6.6
    ×4.7
    myrex24v2 (40) · myrex24v2.virtual (40) · rex100 (2)
  • 28mb connect line—
    42 CVECVSS 6.6
    ×4.7
    mbconnect24 (40) · mymbconnect24 (40) · mbnet/mbnet.rokey (2)
  • 29go↓16
    41 CVE
    github.com/lin-snow/ech0 (7) · github.com/kong/kubernetes-ingress-controller/v3 (2) · github.com/metal3-io/ironic-standalone-operator (2)
  • 30open5gs—
    38 CVECVSS 4.5
    ×4.0
    open5gs (38)
  • 31pypi↓17
    37 CVECVSS 7.3
    PoC 1
    stigmem-node (6) · wger (4) · edumfa (3)
  • 32concretecms—
    36 CVECVSS 7.0
    NEW×5.1
    concrete cms (36)
  • 33mattermost↑113
    36 CVECVSS 5.1
    ×3.8
    mattermost (36) · mattermost server (24) · mattermost desktop (2)
  • 34canonical↑17
    34 CVE5 critCVSS 6.9
    ubuntu (20) · ubuntu linux (12) · multipass (2)
  • 35sourcecodester↓18
    34 CVECVSS 5.8
    hospitals patient records management system (6) · sup online shopping (5) · student grades management system (4)
  • 36netatalk—
    33 CVE1 critCVSS 5.8
    NEW
    netatalk (33)
  • 37nvidia↑34
    33 CVE1 critCVSS 7.3
    gpu display driver (12) · geforce (12) · nvidia rtx, quadro, nvs (12)
  • 38hpe—
    32 CVECVSS 7.1
    hpe aruba networking wireless operating system (aos) (27) · arubaos (aos) (5)
  • 39oracle↓33
    32 CVE9 critCVSS 7.7
    rest data services (10) · oracle rest data services (10) · e-business suite (7)
  • 40gitlab↑2
    31 CVECVSS 5.6
    gitlab (31)
  • 41golang↑39
    30 CVE8 critCVSS 7.2
    ×4.3
    crypto (13) · go (11) · net (6)
  • 42ооо «ред софт»—
    28 CVE4 critCVSS 7.4
    ред ос (28)
  • 43arubanetworks—
    27 CVECVSS 7.1
    arubaos (27) · sd-wan (26)
  • 44palo alto networks—
    27 CVE8 critCVSS 8.1
    ×3.9KEV 2Nuclei 1PoC 27
    prisma access (9) · cloud ngfw (9) · pan-os (9)
  • 45trendnet↑120
    26 CVECVSS 7.1
    NEW×4.3
    tew-432brp (20) · tew-821dap (6) · tew-821dap firmware (6)
  • 46gitlab inc.↑40
    25 CVECVSS 5.9
    gitlab (25)
  • 47hcl—
    24 CVECVSS 4.3
    aion (9) · bigfix service management (sm) (8) · dfxanalytics (5)
  • 48paloaltonetworks—
    24 CVE8 critCVSS 8.1
    ×3.0KEV 2Nuclei 1PoC 24
    pan-os (9) · prisma access agent (4) · globalprotect app (3)
  • 49code-projects↓41
    23 CVECVSS 5.9
    employee management system (9) · online hospital management system (3) · online music site (2)
  • 50jetbrains—
    22 CVECVSS 5.9
    teamcity (12) · youtrack (5) · intellij idea (4)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-79601·
2CWE-89382·
3CWE-862311↑1
4CWE-416305↑3
5CWE-22236↓2
6CWE-78219↓1
7CWE-476208↑19
8CWE-125202↑7
9CWE-94199·
10CWE-20195↑9
11CWE-77187↓1
12CWE-918187↓6
13CWE-284177↓2
14CWE-74166↓6
15CWE-119165↓1
16CWE-787160·
17CWE-863160↓5
18CWE-639137·
19CWE-352135↑5
20CWE-121129↑1

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems2,693 CVE
    259 crit45 KEV64 vendorsCVSS 7.4
    linux (1064) · debian gnu/linux (105) · astra linux special edition (84)
  • OSS Libraries1,175 CVE
    253 crit95 KEV346 vendorsCVSS 9.1
    openimageio (20) · libheif (13) · netty (13)
  • Web & CMS Plugins1,134 CVE
    122 crit20 KEV668 vendorsCVSS 7.2
    hape pkh (6) · gravity forms (5) · royal addons for elementor – addons and templates kit for elementor (5)
  • Networking Infrastructure791 CVE
    353 crit202 KEV110 vendorsCVSS 7.8
    open5gs (38) · arubaos (27) · a8000ru (26)
  • Consumer Software729 CVE
    77 crit27 KEV115 vendorsCVSS 7.8
    chrome (370) · google chrome (127) · microsoft edge (110)
  • Enterprise Software591 CVE
    127 crit73 KEV175 vendorsCVSS 8.1
    tickets (47) · grafana (20) · mantisbt (17)
  • Cloud & SaaS400 CVE
    78 crit133 vendorsCVSS 8.8
    budibase (21) · gotenberg (13) · n8n (12)
  • Security Products343 CVE
    100 crit24 KEV131 vendorsCVSS 7.7
    misp (13) · cmc (10) · bandit (7)
  • AI / ML274 CVE
    58 crit12 KEV97 vendorsCVSS 7.8
    open webui (59) · open-webui (59) · praisonai (17)
  • ICS / OT / IoT226 CVE
    262 crit2 KEV69 vendorsCVSS 7.7
    mbconnect24 (40) · mymbconnect24 (40) · myrex24v2 (40)
  • DevTools & CI223 CVE
    18 crit1 KEV71 vendorsCVSS 7.3
    gitlab (31) · teamcity (12) · n8n-mcp (6)
  • Hardware Firmware215 CVE
    15 crit41 vendorsCVSS 8.5
    hpe aruba networking wireless operating system (aos) (27) · amd ryzen™ embedded 8000 series processors (18) · amd ryzen™ 7035 series processors with radeon™ graphics (formerly codenamed "rembrandt r") (12)
  • Communications184 CVE
    27 crit63 vendorsCVSS 7.4
    mattermost (43) · mattermost server (24) · freepbx (4)
  • Databases122 CVE
    22 crit1 KEV57 vendorsCVSS 7.6
    pgadmin 4 (16) · oracle rest data services (10) · ckan (4)
  • Mobile Apps21 CVE
    16 vendorsCVSS 8.0
    heym (3) · mobile application (2) · color notes (1)
  • Unclassified223 CVE
    42 crit4 KEV119 vendorsCVSS 7.0
    субд «tantor» (10) · powerflex manager (appliance) (8) · powerflex manager (rack) (8)
Weakness × Sector

Which weaknesses hit which solution categories in May 2026

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

79XSS89SQL Injection862Missing Authorization416Use After Free22Path Traversal78OS Command Injection476NULL Pointer Dereference125Out-of-bounds Read94Code Injection20Improper Input ValidationOperating Systems75615971315098327Web & CMS Plugins257141142381014811OSS Libraries53304310552125363139Consumer Software3371014617103381470Networking Infrastructure9814910741820514Enterprise Software95682212011223013Cloud & SaaS291528121212145Security Products1811792737911AI / ML1872621121148ICS / OT / IoT125011012251