Vulnerability Report - May 2026

Introduction

This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform’s community.

It highlights the most frequently mentioned vulnerabilities for May 2026, based on data aggregated from Vulnerability-Lookup, the CISA Known Exploited Vulnerabilities catalog, the CIRCL KEV catalog, the ENISA EUVD feed, and contributor comments and bundles. Sightings come from MISP, Exploit-DB, Bluesky, Mastodon, Telegram, GitHub Gists, The Shadowserver Foundation, Nuclei, SPLOITUS, Metasploit, and more. For further details, please visit this page.

The Month at a Glance

May 2026 was, once again, the month of the Linux kernel “Copy Fail” flaw. CVE-2026-31431 (algif_aead in-place operation regression) more than doubled its activity, drawing 574 sightings – up from 279 in April – and remaining the most observed vulnerability on the platform by a wide margin. Two further Linux kernel networking flaws in the same family of “shared skb fragment” issues, CVE-2026-43284 (xfrm/ESP) and CVE-2026-43500 (rxrpc), also entered the top ranking, underlining sustained scrutiny of the kernel crypto and networking paths.

Edge-security appliances dominated the exploited side of the month. Palo Alto Networks PAN-OS suffered two separate KEV-listed flaws: a critical unauthenticated buffer overflow in the User-ID Authentication Portal (CVE-2026-0300, CVSS 9.3) added to CISA KEV on May 6, and GlobalProtect authentication bypass CVE-2026-0257 added on May 29. Cisco’s Catalyst SD-WAN authentication bypass CVE-2026-20182 (CVSS 10.0) prompted CISA Emergency Directive ED 26-03. WebPros cPanel & WHM CVE-2026-41940 carried over from April as the second-most-sighted issue (320 sightings) and was confirmed in ransomware campaigns by the ENISA / EU CSIRTs Network.

A clear software supply-chain theme emerged: CISA added three “embedded malicious code” entries within a single week – TanStack (CVE-2026-45321), Nx Console (CVE-2026-48027, CWE-506) and Daemon Tools Lite (CVE-2026-8398) – all involving trojanised packages or extensions used to harvest credentials.

The AI stack continued to be a recurring exposure surface. CISA KEV-listed BerriAI LiteLLM SQLi (CVE-2026-42208) and Langflow CVE-2025-34291, while contributors documented an unauthenticated memory-leak in Ollama (CVE-2026-7482, “Bleeding Llama”). NGINX heap overflow CVE-2026-42945 and a long tail of WordPress/Freemius reflected-XSS (CVE-2024-13362) rounded out the high-volume sightings.

The CISA Known Exploited Vulnerabilities catalog added 21 entries during May, spanning fresh edge-appliance and AI-stack RCEs, supply-chain malware, and a notable re-anchoring batch of legacy Microsoft and Adobe issues from 2008-2010 (CVE-2008-4250 / MS08-067, CVE-2010-0249, CVE-2009-3459). The CIRCL KEV catalog added the Linux kernel “Copy Fail” flaw on the basis of incident-response host-log evidence, and the ENISA EUVD KEV catalog surfaced three entries during May, including the cPanel & WHM authentication bypass flagged as ransomware-linked by CERT-PL.

By CWE, the month was characterised by memory-corruption in the kernel and edge appliances (CWE-787, CWE-122), authentication bypass (CWE-565, CWE-287, CWE-306), SQL injection in AI/web tooling (CWE-89), cross-site scripting (CWE-79), and a distinct spike in embedded-malicious-code supply-chain entries (CWE-506).

Top 10 Vendors of the Month

Top 10 Assigners of the Month

Top 10 vulnerabilities of the Month

Known Exploited Vulnerabilities

New entries have been added to major Known Exploited Vulnerabilities catalogs.

Exploited CVE ratio

CISA

More KEV entries from the CISA Catalog.

CIRCL

Added on the basis of incident-response host logs (“seen exploited on a system giving shell access to users”), confirming local privilege escalation in the wild.

More KEV entries from the CIRCL Catalog.

ENISA (EUVD)

The following entries from the ENISA / EU CSIRTs Network (CNW) KEV feed were surfaced in Vulnerability-Lookup during May. The cPanel & WHM authentication bypass is flagged as ransomware-linked by CERT-PL; the Roundcube XSS is attributed to APT activity (UNC1151).

More KEV entries from the ENISA Catalog.

Top 10 Weaknesses of the Month

Insights from Contributors

Community contributions in May combined hands-on mitigation guidance for the “Copy Fail” kernel flaw with deep-dive analysis of emerging AI-stack risks.

• Deny alg_socket to Containers with SELinux to Mitigate CVE-2026-31431 – a detailed, tested walk-through of an SELinux deny rule (alg_socket) for container runtimes, plus RestrictAddressFamilies=~AF_ALG / SystemCallArchitectures=native per-service hardening and Red Hat’s initcall_blacklist boot-argument approach. The recurring theme: AF_ALG / algif_aead is rarely needed by user workloads, so denying it at the container or systemd-unit boundary is a pragmatic mitigation.
• Bleeding Llama: Critical Unauthenticated Memory Leak in Ollama (CVE-2026-7482) – a shared write-up of Cyera Research’s analysis of an out-of-bounds heap read in Ollama’s GGUF quantization path (/api/create), exfiltratable via /api/push to an attacker-controlled URI. With ~300,000 Ollama servers exposed (listening on 0.0.0.0 with no authentication by default), three unauthenticated API calls can leak user prompts, system prompts, and host environment variables.
• CVE-2026-0300 PAN-OS Authentication Portal buffer overflow – a pointer to the Palo Alto Networks advisory for the critical unauthenticated User-ID Authentication Portal overflow.

Contributors also curated a number of vendor advisories into bundles during May, helping group related fixes for triage:

• Unauthenticated Remote Code Execution in Samba printing subsystem and the corresponding Debian DSA 6297-1 samba security update (6 CVEs).
• Security content of iOS / iPadOS 26.5 (61 CVEs) and macOS Tahoe 26.5 (79 CVEs).
• rsync 3.4.3 (7 CVEs), dnsmasq May 2026 advisory (6 CVEs), Firefox 150.0.3 / MFSA 2026-45 (5 CVEs), Moodle May 2026 (7 CVEs), Exim 4.99.2 (4 CVEs), and ImageMagick DSA 6240-1 (15 CVEs).

Thank you

Thank you to all the contributors and our diverse sources!

If you want to contribute to the next report, you can create your account.

Feedback and Support

If you have suggestions, please feel free to open a ticket on our GitHub repository. Your feedback is invaluable to us!
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/

Funding

The main objective of Federated European Team for Threat Analysis (FETTA) is improvement of Cyber Threat Intelligence (CTI) products available to the public and private sector in Poland, Luxembourg, and the European Union as a whole.
Developing actionable CTI products (reports, indicators, etc) is a complex task and requires an in-depth understanding of the threat landscape and the ability to analyse and interpret large amounts of data. Many SOCs and CSIRTs build their capabilities in this area independently, leading to a fragmented approach and duplication of work.

The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. The organization brings to the table its extensive experience in cybersecurity incident management, threat intelligence, and proactive response strategies. With a strong background in developing innovative open source cybersecurity tools and solutions, CIRCL’s contribution to the FETTA project is instrumental in achieving enhanced collaboration and intelligence sharing across Europe.

Press release