9 vulnerabilities scored HIGH or above on May 22, 2026.
- CRITICAL: 4
- HIGH: 5
[CRITICAL] linux/linux_kernel
CVE-2026-9054 | CVSS 9.2
The Linux kernel is vulnerable to a denial-of-service condition (CVE-2026-9054, CVSS 9.2 CRITICAL) where specially crafted TCP, IL, RUDP, or GRE packets with malformed headers can trigger a kernel panic. Network-facing Linux systems are at immediate risk, particularly those processing untrusted or internet-routed traffic. Administrators should apply kernel patches from the vendor advisory without delay and consider implementing network segmentation to limit exposure to potentially malicious packet sources.
[CRITICAL] nginx/nginx
CVE-2026-9256 | CVSS 9.2
NGINX Plus and NGINX Open Source versions prior to specified patch levels contain a critical vulnerability (CVE-2026-9256, CVSS 9.2) in the rewrite module where overlapping PCRE regex captures with multiple replacement references can be exploited by unauthenticated attackers. Organizations running affected NGINX versions should prioritize immediate patching to versions 37.0.1.1 or later for Plus, or 1.31.1 or later for Open Source. Review the vendor advisory for version-specific guidance and apply updates without delay to eliminate exposure.
[CRITICAL] iina/iina
CVE-2026-47114 | CVSS 8.6
IINA before version 1.4.3 is vulnerable to remote command execution (CVE-2026-47114, CVSS 8.6) through malicious iina://open URLs containing mpv_-prefixed query parameters, allowing attackers to execute arbitrary commands as the current macOS user after browser protocol approval. Users running IINA should immediately update to version 1.4.3 or later to remediate this actively exploitable vulnerability. Exercise caution when clicking links from untrusted sources that attempt to open IINA, and verify update completion before resuming normal use.
[CRITICAL] berriai/litellm
CVE-2026-47102 | CVSS 8.7
LiteLLM prior to version 1.83.10 contains a privilege escalation vulnerability (CVE-2026-47102, CVSS 8.7) where the /user/update endpoint allows users to modify their own role to proxy_admin, granting full administrative access to all users, teams, keys, models, and prompt history. Organizations deploying LiteLLM should immediately upgrade to version 1.83.10 or later and audit access logs for evidence of unauthorized privilege escalation. Review and restrict user permissions for the /user/update endpoint and monitor for any unauthorized administrative activity.
[HIGH] ubiquiti/unifi_os
CVE-2026-34909 | CVSS 10.0
UniFi OS devices are vulnerable to a critical path traversal attack (CVE-2026-34909, CVSS 10.0) that allows network-adjacent attackers to access underlying system files and manipulate accounts on affected devices. Organizations running UniFi OS should consult the vendor advisory for affected versions and apply patches immediately. Restrict network access to UniFi OS management interfaces to trusted administrative networks and segment these devices from untrusted network segments.
[HIGH] repute_infosystems/bookingpress_appointment_booking_pro
CVE-2026-6960 | CVSS 9.8
BookingPress Pro for WordPress versions up to 5.6 contain an arbitrary file upload vulnerability (CVE-2026-6960, CVSS 9.8) that allows unauthenticated attackers to upload arbitrary files when a signature custom field is present on the booking form, potentially enabling remote code execution. WordPress administrators using BookingPress Pro should immediately update to the latest patched version and audit the server for unauthorized file uploads. If the signature field is not required, disable it as a temporary mitigation while updates are applied.
[HIGH] easyelements/easy_elements_for_elementor
CVE-2026-9018 | CVSS 8.8
Easy Elements for Elementor versions up to 1.4.5 are vulnerable to privilege escalation (CVE-2026-9018, CVSS 8.8) where an unauthenticated AJAX handler allows attackers to create user accounts with arbitrary metadata, including administrative capabilities. WordPress administrators running this plugin should immediately update to the latest patched version and audit user accounts for unauthorized privilege escalation. Review and restrict access to AJAX handlers or disable the plugin if not actively in use.
[HIGH] wedevs/wp_erp_pro
CVE-2026-4834 | CVSS 7.5
WP ERP Pro for WordPress versions up to 1.5.1 contain a SQL injection vulnerability (CVE-2026-4834, CVSS 7.5) in the search_key parameter that allows unauthenticated attackers to extract sensitive information from the database due to insufficient input escaping and lack of prepared statements. WordPress administrators using WP ERP Pro should immediately update to the latest patched version and review database logs for evidence of unauthorized queries. Monitor the system for suspicious activity and consider implementing Web Application Firewall rules to detect and block SQL injection attempts.
[HIGH] docker/docker_desktop
CVE-2026-5817 | CVSS 8.8
Docker Desktop on macOS versions prior to 4.68.0 are vulnerable to arbitrary code execution (CVE-2026-5817, CVSS 8.8) when using the vllm-metal inference backend, which loads model tokenizers without sandboxing and with trust_remote_code enabled, allowing malicious models from OCI registries to execute code on the host. macOS users running Docker Desktop with Model Runner capabilities should immediately update to version 4.68.0 or later. Carefully vet and verify models obtained from untrusted OCI registries and restrict network access for containers that pull models.