Week 21, 2026
18–24 May 2026
Newly exploited 10
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
- Critical 9.8 EPSS 89%
- Critical 9.4 EPSS 93%
-
Medium 6.7
CVE-2026-34926 KEV May 21, 2026 A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to i…EPSS 13%
Trend Micro · TrendAI Apex One as a Service · TrendAI Apex One
-
Critical 9.8
CVE-2008-4250 KEV May 20, 2026 The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attack…EPSS 99%
-
High 8.8
CVE-2009-3459 KEV May 20, 2026 Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code…EPSS 87%
-
High 8.8
CVE-2010-0249 KEV May 20, 2026 Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vi…EPSS 92%
-
High 8.8
CVE-2009-1537 KEV May 20, 2026 Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows X…EPSS 51%
-
High 8.8
CVE-2010-0806 KEV May 20, 2026 Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute …EPSS 82%
- High 7.8 EPSS 8.2%
- Medium 4.0 EPSS 63%
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 10.0
CVE-2026-34910 A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.EPSS 90%
- Critical 9.8 EPSS 89%
-
Critical 10.0
CVE-2026-34908 A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to t…EPSS 89%
-
Critical 10.0
CVE-2026-34909 A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system th…EPSS 69%
- Critical 9.4 EPSS 23%
- Critical 9.8 EPSS 21%
- Critical 9.8 EPSS 20%
-
Critical 9.3
CVE-2026-23734 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slashEPSS 19%
-
Critical 10.0
CVE-2026-48172 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via …EPSS 18%
- Critical 10.0 EPSS 15%
-
Critical 9.8
CVE-2026-6279 Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Han…EPSS 9.9%
-
Critical 9.1
CVE-2026-42508 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsEPSS 6.9%
- Critical 9.1 EPSS 6%
-
Critical 9.8
CVE-2025-71210 A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installa…EPSS 3.8%
Trend Micro · TrendAI Apex One as a Service · TrendAI Apex One
-
Critical 9.8
CVE-2025-71211 A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installa…EPSS 3.8%
Trend Micro · TrendAI Apex One as a Service · TrendAI Apex One
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.8
CVE-2026-45659 Microsoft SharePoint Remote Code Execution VulnerabilityEPSS 80%
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition
- Medium 4.0 EPSS 63%
- High 7.8 EPSS 16%
-
Medium 6.7
CVE-2026-34926 A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to i…EPSS 13%
Trend Micro · TrendAI Apex One as a Service · TrendAI Apex One
- High 8.1 EPSS 11%
- High 8.1 EPSS 9.7%
- High 7.8 EPSS 8.2%
- High 7.8 EPSS 5.4%
Advisories
- Red Hat Security Advisories (RHSA) 27456 critical
- AlmaLinux Security Advisories 1417 critical
- BSI CERT-Bund (WID) 883 critical
- Rocky Linux Security Advisories 805 critical
- SUSE / openSUSE Security Updates 589 critical
- Ubuntu Security Notices (USN) 3415 critical
- CISA ICS & IT advisories 53 critical
- NCSC-NL (Netherlands) 3
- USN-8278-1 linux, linux-aws, linux-aws-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-ibm, linux-ibm-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-raspi, linux-raspi-realtime, linux-realtime, linux-realtime-6.8 vulnerabilities 196 CVEs
- USN-8289-1 linux-nvidia, linux-nvidia-lowlatency vulnerabilities 195 CVEs
- USN-8296-1 linux-fips vulnerabilities 189 CVEs
- USN-8275-1 linux-xilinx-zynqmp vulnerabilities 84 CVEs
- USN-8297-1 linux-gcp-5.15 vulnerabilities 83 CVEs
- RHSA-2026:19348 Red Hat Security Advisory: thunderbird security update 30 CVEs
- RHSA-2026:18134 Red Hat Security Advisory: kernel security update 29 CVEs
- RHSA-2026:19704 Red Hat Security Advisory: firefox security update 25 CVEs
- RHSA-2026:19655 Red Hat Security Advisory: firefox security update 25 CVEs
- RHSA-2026:19542 Red Hat Security Advisory: firefox security update 25 CVEs