May 2026 Patch Tuesday: no zero-days but plenty to fix

This month’s Patch Tuesday remedies 137 security vulnerabilities, including 31 marked critical by Microsoft, with no zero-days actively exploited in the wild. Microsoft defines a zero-day as “a flaw in software for which no official patch or security update is available yet.” This month, Microsof...

GHSA-G24F-MGC3-JWWC

creationtimestamp| type| source ---|---|--- 2026-04-22 23:20:31+00:00| seen| Telegram/n2iRBZnq9E7ZcL0orkFwrYjYuWJ0gfdHv4rT79OW1qv3c...

CVE-2026-34275

creationtimestamp| type| source ---|---|--- 2026-04-21 23:29:31+00:00| seen| Telegram/EOnjNYApXgYHJan5J2dTdjjTaiwT5fD5DgY21SwpLPKRuSg...

CVE-2026-6058

creationtimestamp| type| source ---|---|--- 2026-04-21 02:17:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjxw4b2jk52h...

Mozilla Firefox ESR < 115.35

The version of Firefox ESR installed on the remote Windows host is prior to 115.35. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-31 advisory. - Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140....

CVE-2026-40340

creationtimestamp| type| source ---|---|--- 2026-04-18 01:31:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqc5bweaq2q...

FreeBSD : chromium -- security fixes (d93c247b-4dba-43ce-b5c0-ac5bd03bea8d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d93c247b-4dba-43ce-b5c0-ac5bd03bea8d advisory. Chrome Releases reports: This update includes 31 security fixes: Tenable has extracted the...

CVE-2026-41266

creationtimestamp| type| source ---|---|--- 2026-04-15 21:42:29+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-4jpm-cgx2-8h37 2026-04-23 21:26:14+00:00| published-proof-of-concept| Telegram/LhBAsLXZuywUMfmIXbSwPnWzjb6RJaoGfmWe6gs8QchtB8o 2026-04-2...

CVE-2026-28291

CVE-2026-28291 affects the Node.js package simple-git up to version 3.31.1, where an attacker can execute arbitrary commands by abusing Git option parsing. The flaw stems from an incomplete fix for CVE-2022-25860: Git’s flexible option parsing allows combinations such as -vu, -4u, -nu to bypass t...

CVE-2025-58920

creationtimestamp| type| source ---|---|--- 2026-04-10 14:26:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5jpp42p32j 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8...

GHSA-WPC6-37G7-8Q4W OpenClaw: Shell init-file options could satisfy exec allowlist script matching

Summary Before OpenClaw 2026.3.31, exec allowlist matching could treat shell init-file wrapper invocations as if the approved script itself were being executed. Shell options such as --rcfile, --init-file, and --startup-file could therefore inherit allowlist trust from a matched script path even...

EUVD-2026-19607

Weaver Fanwei E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft PO...

EUVD-2026-19354

Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan RAT. Users of @usebruno/cli who ran...

GHSA-RX4H-526Q-4458

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:56+00:00| seen| Telegram/8TNuFRjRJBw5r6zwiOXWdT-cqnzTtiBnsbsFB7NS1OTWS8...

CVE-2026-35054

creationtimestamp| type| source ---|---|--- 2026-03-31 23:16:41+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-35054...

CVE-2026-5213

creationtimestamp| type| source ---|---|--- 2026-03-31 22:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifb7btvxu24 2026-03-31 23:20:32+00:00| published-proof-of-concept| Telegram/fnqeA0DSzUxsfUgrLtw39NRieZko7R6ZhEkNfy6t9mpSrc 2026-04-01 03:49:16+00:00| seen|...

CVE-2026-34441

creationtimestamp| type| source ---|---|--- 2026-03-31 22:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mif6pjyp7v22...

CVE-2026-34956

creationtimestamp| type| source ---|---|--- 2026-03-31 21:34:34+00:00| seen| https://bsky.app/profile/shindo.bsky.social/post/3mif4xv3rhs2q 2026-05-05 17:13:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml4op447mx2p 2026-05-20 14:10:07+00:00| seen|...

GHSA-WP76-GG32-8258

creationtimestamp| type| source ---|---|--- 2026-03-31 21:19:25+00:00| published-proof-of-concept| Telegram/KAeZyql0w7ADSWCNfrKYv7UvYEMEw072WjtVkInGvWCcTc...

CVE-2026-4800

creationtimestamp| type| source ---|---|--- 2026-03-31 20:07:29+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3miey44uyhk2f 2026-03-31 21:19:34+00:00| seen| Telegram/OA0BhF0tC6EPmRi9BAj0aaRm3q83l75bwQVc9b2koDj48CY 2026-04-01 05:05:35+00:00| seen|...