May 2026 CVE Landscape
- CVEs
- CVE-2008-4250CVE-2009-1537CVE-2009-3459CVE-2010-0249CVE-2010-0806CVE-2025-34291CVE-2026-0257CVE-2026-0300CVE-2026-20182CVE-2026-31431CVE-2026-34926CVE-2026-41091CVE-2026-42208CVE-2026-42897CVE-2026-45321CVE-2026-45498CVE-2026-48027CVE-2026-48172CVE-2026-6973CVE-2026-8398CVE-2026-9082CVE-2026-26980
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2008-4250 | Remote Code Execution Buffer Overflow in Microsoft Windows Server Service | — | 99% | KEV | — KEV |
| CVE-2009-1537 | Null Byte Overwrite RCE in Microsoft DirectX QuickTime Parser (quartz.dll) | — | 51% | KEV | — KEV |
| CVE-2009-3459 | Heap-Based Buffer Overflow in Adobe Acrobat and Reader Enables RCE via PDFs | — | 87% | KEV | — KEV |
| CVE-2010-0249 | Use-After-Free Remote Code Execution in Microsoft Internet Explorer | — | 92% | KEV | — KEV |
| CVE-2010-0806 | Use-After-Free RCE in Microsoft Internet Explorer (CVE-2010-0806) | — | 82% | KEV | — KEV |
| CVE-2025-34291 | CORS Origin Validation Flaw in Langflow Enables Account Takeover and RCE | 9.4 | 93% | KEVPoC | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 95% | KEVRansomware | KEV |
| CVE-2026-0300 | Unauthenticated Out-of-bounds Write RCE in Palo Alto Networks PAN-OS | 9.3 | 42% | KEV | KEV |
| CVE-2026-20182 | Authentication Bypass in Cisco Catalyst SD-WAN Control Components | 10.0 | 92% | KEV | KEV |
| CVE-2026-26980 | Unauthenticated SQL Injection in Ghost CMS Allows Arbitrary Database Reads | 7.5 | 70% | ||
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface | 7.8 | 98% | KEVPoC ×12 | KEV |
| CVE-2026-34926 | Directory Traversal in Trend Micro Apex One (On-Premise) Server | 6.7 | 13% | KEV | KEV |
CVE-2026-45498+1 related CVE | Denial-of-Service Vulnerability in Microsoft Defender Antimalware Platform | 7.5 group max | 63% | KEV | KEV |
| CVE-2026-42208 | SQL Injection in BerriAI LiteLLM Proxy Exploited in the Wild | 9.3 | 89% | KEVPoC | KEV |
| CVE-2026-42897 | Cross-Site Scripting in Microsoft Exchange Server Actively Exploited by Laundry Bear | 6.1 | 71% | KEV | KEV |
| CVE-2026-45321 | Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages | 9.6 | 3% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-48027 | Malicious Code Embedded in Nx Console VS Code Extension 18.95.0 | 9.3 | 2% | KEVRansomwarePoC | KEV |
| CVE-2026-48172 | Privilege Escalation (Possible Root) in LiteSpeed cPanel Plugin | 10.0 | 18% | KEV | KEV |
| CVE-2026-6973 | Authenticated RCE in Ivanti Endpoint Manager Mobile (EPMM) | 7.2 | 34% | KEV | KEV |
| CVE-2026-8398 | Trojanized Installer Backdoor in DAEMON Tools Lite (Supply Chain Compromise) | 9.3 | 1% | KEVPoC | KEV |
| CVE-2026-9082 | Actively Exploited SQL Injection in Drupal Core | 9.8 | 89% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | web-telegram.ug | m logs in Enumerates running processes Sends DNS request to web-telegram[.]ug Further technical details associated with this activity, |
| ipv4 | 65.111.25.67 | hreat actor shifted to a second adjacent egress IP address, 65[.]111[.]25[.]67 , after a 21-minute pause. The second IP belonged to |
| ipv4 | 65.111.27.132 | ey-management endpoints. For Phase 1, the threat actor used 65[.]111[.]27[.]132 to conduct schema enumeration against a reachable Lit |
| sha256 | 7790fd1035266000ed6d6cc35822f7683f5271663af8a5b5effadff85316df6d | indows registry Drops files named UtilifySetup.tmp (SHA256: 7790fd1035266000ed6d6cc35822f7683f5271663af8a5b5effadff85316df6d) and Grape.exe Enumerates files and directories Retrieves s |
From the original article
10 min read at recordedfuture.com
In May 2026, Insikt Group® identified 41 high-impact vulnerabilities that should be prioritized for remediation , all of which had a Very Critical Recorded Future Risk Score. This represents an 11% increase from last month. These vulnerabilities affected products from 20 vendors.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.