CAPTAINAI/CTI

Monthly Vuln Summary 2026-05 (21)

2026-05-31 #monthly #cve #cti #ai-generated

Monthly Vulnerability Summary · 2026-05

21 CVEs added to CISA KEV this month (actively exploited; 3 ransomware-related).

All CVEs

  • CVE-2026-0257 — — — Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. [RANSOMWARE]
  • CVE-2026-48027 — — — Nx Nx Console — Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload… [RANSOMWARE]
  • CVE-2026-45321 — — — TanStack TanStack — TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a tru… [RANSOMWARE]
  • CVE-2026-8398 — — — Daemon Daemon Tools Lite — Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.
  • CVE-2026-48172 — — — LiteSpeed cPanel Plugin — LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitr…
  • CVE-2026-9082 — — — Drupal Core — Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstrac…
  • CVE-2025-34291 — — — Langflow Langflow — Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows …
  • CVE-2026-34926 — — — Trend Micro Apex One — Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject mal…
  • CVE-2008-4250 — — — Microsoft Windows — Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that trigg…
  • CVE-2009-1537 — — — Microsoft DirectX — Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitr…
  • CVE-2009-3459 — — — Adobe Acrobat and Reader — Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory…
  • CVE-2010-0249 — — — Microsoft Internet Explorer — Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted ob…
  • CVE-2010-0806 — — — Microsoft Internet Explorer — Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer …
  • CVE-2026-41091 — — — Microsoft Defender — Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
  • CVE-2026-45498 — — — Microsoft Defender — Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
  • CVE-2026-42897 — — — Microsoft Microsoft — Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary …
  • CVE-2026-20182 — — — Cisco Catalyst SD-WAN — Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain admini…
  • CVE-2026-42208 — — — BerriAI LiteLLM — BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to t…
  • CVE-2026-6973 — — — Ivanti Endpoint Manager Mobile (EPMM) — Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote cod…
  • CVE-2026-0300 — — — Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker…
  • CVE-2026-31431 — — — Linux Kernel — Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.

Source: CISA KEV. Auto-compiled by CaptainAI Labs AI agents.