This Week in Threats: May 19–Jun 02, 2026

Weekly Threat Summary

16 vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) catalog this period. The highest CVSS score is 10.0.

This week includes 9 critical-severity vulnerabilities (CVSS 9.0+) that require immediate attention.

This Week's Vulnerabilities

CVE-2008-4250 — Microsoft Windows Buffer Overflow Vulnerability

• CVSS Score: 10.0 (CRITICAL)
• Date Added: 2026-05-20
• Description: Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-48172 — LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

• CVSS Score: 9.8 (CRITICAL)
• Date Added: 2026-05-26
• Description: LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin,...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-8398 — Daemon Tools Lite Embedded Malicious Code Vulnerability

• CVSS Score: 9.8 (CRITICAL)
• Date Added: 2026-05-27
• Description: Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-45321 — TanStack Unspecified Vulnerability

• CVSS Score: 9.6 (CRITICAL)
• Date Added: 2026-05-27
• Description: TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-48027 — Nx Console Embedded Malicious Code Vulnerability

• CVSS Score: 9.3 (CRITICAL)
• Date Added: 2026-05-27
• Description: Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2010-0806 — Microsoft Internet Explorer Use-After-Free Vulnerability

• CVSS Score: 9.3 (CRITICAL)
• Date Added: 2026-05-20
• Description: Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2009-3459 — Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

• CVSS Score: 9.3 (CRITICAL)
• Date Added: 2026-05-20
• Description: Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2009-1537 — Microsoft DirectX NULL Byte Overwrite Vulnerability

• CVSS Score: 9.3 (CRITICAL)
• Date Added: 2026-05-20
• Description: Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-0257 — Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

• CVSS Score: 9.1 (CRITICAL)
• Date Added: 2026-05-29
• Description: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-34291 — Langflow Origin Validation Error Vulnerability

• CVSS Score: 8.8 (HIGH)
• Date Added: 2026-05-21
• Description: Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2010-0249 — Microsoft Internet Explorer Use-After-Free Vulnerability

• CVSS Score: 8.8 (HIGH)
• Date Added: 2026-06-03
• Description: Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-41091 — Microsoft Defender Link Following Vulnerability

• CVSS Score: 7.8 (HIGH)
• Date Added: 2026-05-20
• Description: Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2024-21182 — Oracle WebLogic Server Unspecified Vulnerability

• CVSS Score: 7.5 (HIGH)
• Date Added: 2026-06-01
• Description: Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-34926 — Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

• CVSS Score: 6.7 (MEDIUM)
• Date Added: 2026-05-21
• Description: Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-9082 — Drupal Core SQL Injection Vulnerability

• CVSS Score: 6.5 (MEDIUM)
• Date Added: 2026-05-22
• Description: Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code...
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2026-45498 — Microsoft Defender Denial of Service Vulnerability

• CVSS Score: 4.0 (MEDIUM)
• Date Added: 2026-05-20
• Description: Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
• Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What This Means for You

If you run any of the affected products, patch immediately. Critical-severity vulnerabilities are actively exploited in the wild — CISA adds them to the KEV catalog specifically because they represent real, current threats.

Use the CVSS Calculator to assess how these scores apply to your specific environment.

Cert Study Angles

These CVEs map directly to certification exam objectives. Use them as real-world case studies:

CompTIA Security+

• CVE-2008-4250 → D2 Threats & Vulnerabilities
• CVE-2026-48172 → D2 Threats & Vulnerabilities
• CVE-2009-3459 → D2 Threats & Vulnerabilities
• CVE-2026-0257 → D2 Threats & Vulnerabilities
• CVE-2024-21182 → D4 Security Operations
• CVE-2026-9082 → D2 Threats & Vulnerabilities

ISC2 CISSP

• CVE-2008-4250 → D6 Security Assessment
• CVE-2026-48172 → D6 Security Assessment
• CVE-2026-8398 → D6 Security Assessment
• CVE-2026-45321 → D6 Security Assessment
• CVE-2026-48027 → D6 Security Assessment
• CVE-2010-0806 → D6 Security Assessment
• CVE-2009-3459 → D6 Security Assessment
• CVE-2009-1537 → D6 Security Assessment
• CVE-2026-0257 → D4 Communication & Network, D5 IAM, D6 Security Assessment
• CVE-2025-34291 → D6 Security Assessment
• CVE-2010-0249 → D6 Security Assessment
• CVE-2026-41091 → D6 Security Assessment
• CVE-2024-21182 → D4 Communication & Network, D6 Security Assessment
• CVE-2026-34926 → D6 Security Assessment
• CVE-2026-9082 → D6 Security Assessment
• CVE-2026-45498 → D6 Security Assessment

Cisco CCNA

• CVE-2024-21182 → D5 Security Fundamentals

See all CVEs mapped to your cert: Exploit Tracker

Tools to Help

• CVSS Calculator — Score these vulnerabilities for your specific environment
• Exploit Tracker — Filter KEV vulnerabilities by certification relevance
• Study Tracker — Track your exam objective completion
• Security+ Practice Quiz — Test your knowledge of vulnerability types and mitigations

Stay Updated

This roundup is published every Tuesday. Bookmark the FixTheVuln Blog to stay on top of the latest threats — or subscribe via RSS.