# may 2026 > markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt). ![drybrush poster for may 2026, painted from 6,933 published cves](https://media.cvegen.art/posters/2026-05/1280.jpg?v=a158aeb0c8) what the poster shows: 31 days as bands of dry brush, the first day at the top. 23 ran above the 2025 average for their weekday and sweep fast and wide; the other 8 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else. the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2026-05.mp4?v=f5c1702b69) | fact | value | | --- | --- | | cves | 6,933 | | against an average 2025 month | 1.7× | | busiest day | may 27, 714 | | rated critical, cvss 9 or higher | 669 | | critical with no login and no click | 500 | | used in real attacks | 22 | ## may 2026 in numbers may 2026 brought 6,933 cves, 1.7 times an average 2025 month. 23 of its 31 days ran above the 2025 average for that weekday. - 714 on may 27, the busiest day. the linux kernel team published 275 of them at once. - 669 rated critical, cvss 9 or higher. 500 of them can be hit over the network with no login and nothing for a user to click. - 440 in browsers, 9.8 times their 2025 monthly average. no other kind of software grew as fast. - 696 came in three single drops: the linux kernel team 275 on may 27, the linux kernel team 224 on may 6, the linux kernel team 197 on may 8. ## 22 already used in real attacks cisa kev, as of oct 24. ### by product - 3 ubiquiti unifi os, may 22 - 2 palo alto networks pan-os, may 6, 13 - 2 berriai litellm, may 8 - 2 microsoft defender, may 20 - 1 ivanti endpoint manager mobile, may 7 - 1 tanstack, may 12 - 1 cisco catalyst sd-wan, may 14 - 1 microsoft, may 14 - 1 daemon tools lite, may 15 - 1 drupal core, may 20 - 1 litespeed cpanel plugin, may 21 - 1 trend micro apex one, may 21 - 1 microsoft sharepoint server, may 22 - 1 kludex starlette, may 26 - 1 mirasvit full page cache warmer, may 26 - 1 nx console, may 27 - 1 oracle e-business suite, may 28 ### every cve - may 6, palo alto networks pan-os, [cve-2026-0300](https://www.cve.org/CVERecord?id=CVE-2026-0300) - may 7, ivanti endpoint manager mobile (epmm), [cve-2026-6973](https://www.cve.org/CVERecord?id=CVE-2026-6973) - may 8, berriai litellm, [cve-2026-42208](https://www.cve.org/CVERecord?id=CVE-2026-42208) - may 8, berriai litellm, [cve-2026-42271](https://www.cve.org/CVERecord?id=CVE-2026-42271) - may 12, tanstack tanstack, [cve-2026-45321](https://www.cve.org/CVERecord?id=CVE-2026-45321) - may 13, palo alto networks pan-os, [cve-2026-0257](https://www.cve.org/CVERecord?id=CVE-2026-0257) - may 14, cisco catalyst sd-wan, [cve-2026-20182](https://www.cve.org/CVERecord?id=CVE-2026-20182) - may 14, microsoft microsoft, [cve-2026-42897](https://www.cve.org/CVERecord?id=CVE-2026-42897) - may 15, daemon daemon tools lite, [cve-2026-8398](https://www.cve.org/CVERecord?id=CVE-2026-8398) - may 20, microsoft defender, [cve-2026-41091](https://www.cve.org/CVERecord?id=CVE-2026-41091) - may 20, microsoft defender, [cve-2026-45498](https://www.cve.org/CVERecord?id=CVE-2026-45498) - may 20, drupal core, [cve-2026-9082](https://www.cve.org/CVERecord?id=CVE-2026-9082) - may 21, trend micro apex one, [cve-2026-34926](https://www.cve.org/CVERecord?id=CVE-2026-34926) - may 21, litespeed cpanel plugin, [cve-2026-48172](https://www.cve.org/CVERecord?id=CVE-2026-48172) - may 22, ubiquiti unifi os, [cve-2026-34908](https://www.cve.org/CVERecord?id=CVE-2026-34908) - may 22, ubiquiti unifi os, [cve-2026-34909](https://www.cve.org/CVERecord?id=CVE-2026-34909) - may 22, ubiquiti unifi os, [cve-2026-34910](https://www.cve.org/CVERecord?id=CVE-2026-34910) - may 22, microsoft sharepoint server, [cve-2026-45659](https://www.cve.org/CVERecord?id=CVE-2026-45659) - may 26, mirasvit mirasvit full page cache warmer, [cve-2026-45247](https://www.cve.org/CVERecord?id=CVE-2026-45247) - may 26, kludex starlette, [cve-2026-48710](https://www.cve.org/CVERecord?id=CVE-2026-48710) - may 27, nx nx console, [cve-2026-48027](https://www.cve.org/CVERecord?id=CVE-2026-48027) - may 28, oracle e-business suite, [cve-2026-46817](https://www.cve.org/CVERecord?id=CVE-2026-46817) cisa keeps adding older cves when attacks come to light, so this list can still grow. ## this poster | fact | value | | --- | --- | | period | may 1 to 31, 2026 | | cves | 6,933 | | data | cve list v5, cisa kev, drawn 2026-10-24 | | format | 3:4, drawn for 45 × 60 cm | [download jpg, 2000 × 2667](https://media.cvegen.art/posters/2026-05/2000.jpg?v=a158aeb0c8) ## other months - before: [april 2026](https://cvegen.art/2026/04.md), 5,813 cves - after: [june 2026](https://cvegen.art/2026/06.md), 7,949 cves - [all months](https://cvegen.art/index.md)