{"schema_version":1,"title":"Newly exploited vulnerabilities: week of 4 to 10 May 2026 (week 19)","summary":"In the week of 4 to 10 May 2026, 3 vulnerabilities were newly recorded as exploited in the wild, 3 of them critical. The technology hit most was Berriai LiteLLM (1), followed by Ivanti Endpoint Manager Mobile (1) and Ivanti Endpoint Manager Mobile (EPMM) (1).","url":"https://junglewise.ai/threats/exploited/2026-05-04","json_url":"https://junglewise.ai/threats/exploited/2026-05-04.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/exploited/2026-05-04","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so; exploited_since is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.","kind":"exploited_week","total":3,"period":{"end":"2026-05-10","start":"2026-05-04"},"critical":3,"generated_at":"2026-10-02T20:07:00.213787+00:00","technologies":[{"hub":true,"name":"Berriai LiteLLM","slug":"litellm","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/litellm"},{"hub":true,"name":"Ivanti Endpoint Manager Mobile","slug":"endpoint-manager-mobile","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/endpoint-manager-mobile"},{"hub":true,"name":"Ivanti Endpoint Manager Mobile (EPMM)","slug":"endpoint-manager-mobile-epmm","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/endpoint-manager-mobile-epmm"},{"hub":true,"name":"Ivanti MobileIron Core","slug":"mobileiron-core","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/mobileiron-core"},{"hub":true,"name":"litellm (PyPI)","slug":"pypi-litellm","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/pypi-litellm"},{"hub":false,"name":"Paloaltonetworks Pa-1410","slug":"pa-1410","vulnerabilities":1},{"hub":false,"name":"Paloaltonetworks Pa-1420","slug":"pa-1420","vulnerabilities":1},{"hub":false,"name":"Paloaltonetworks Pa-3410","slug":"pa-3410","vulnerabilities":1},{"hub":false,"name":"Paloaltonetworks Pa-3420","slug":"pa-3420","vulnerabilities":1},{"hub":false,"name":"Paloaltonetworks Pa-3430","slug":"pa-3430","vulnerabilities":1},{"hub":false,"name":"Paloaltonetworks Pa-3440","slug":"pa-3440","vulnerabilities":1},{"hub":false,"name":"Paloaltonetworks Pa-410","slug":"pa-410","vulnerabilities":1},{"hub":false,"name":"Paloaltonetworks Pa-410r","slug":"pa-410r","vulnerabilities":1},{"hub":false,"name":"Paloaltonetworks Pa-410r-5g","slug":"pa-410r-5g","vulnerabilities":1},{"hub":false,"name":"Paloaltonetworks Pa-415","slug":"pa-415","vulnerabilities":1}],"vulnerabilities":[{"cve":"CVE-2026-42208","cvss":9.8,"epss":0.0577,"slug":"cve-2026-42208-berriai-litellm-sql-injection-in-proxy-api-key-verification","title":"BerriAI LiteLLM SQL injection in Proxy API key verification","severity":"critical","exploited":true,"published_at":"2026-05-08T04:16:19.923+00:00","technologies":[{"hub":true,"name":"Berriai LiteLLM","slug":"litellm","vendor":{"name":"Berriai","slug":"berriai"}},{"hub":true,"name":"litellm (PyPI)","slug":"pypi-litellm","vendor":{"name":"PyPI","slug":"pypi"}}],"exploited_since":"2026-05-08T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-42208-berriai-litellm-sql-injection-in-proxy-api-key-verification"},{"cve":"CVE-2026-6973","cvss":7.2,"epss":0.0554,"slug":"cve-2026-6973-ivanti-endpoint-manager-mobile-rce-via-apache-directive-injection","title":"Ivanti Endpoint Manager Mobile RCE via Apache directive injection","severity":"critical","exploited":true,"published_at":"2026-05-07T16:16:23.163+00:00","technologies":[{"hub":true,"name":"Ivanti Endpoint Manager Mobile","slug":"endpoint-manager-mobile","vendor":{"name":"Ivanti","slug":"ivanti"}},{"hub":true,"name":"Ivanti Endpoint Manager Mobile (EPMM)","slug":"endpoint-manager-mobile-epmm","vendor":{"name":"Ivanti","slug":"ivanti"}},{"hub":true,"name":"Ivanti MobileIron Core","slug":"mobileiron-core","vendor":{"name":"Ivanti","slug":"ivanti"}}],"exploited_since":"2026-05-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-6973-ivanti-endpoint-manager-mobile-rce-via-apache-directive-injection"},{"cve":"CVE-2026-0300","cvss":9.8,"epss":0.1443,"slug":"cve-2026-0300-palo-alto-networks-pan-os-buffer-overflow-in-user-id","title":"Palo Alto Networks PAN-OS buffer overflow in User-ID Authentication Portal","severity":"critical","exploited":true,"published_at":"2026-05-06T19:16:35.73+00:00","technologies":[{"hub":false,"name":"Paloaltonetworks Pa-1410","slug":"pa-1410","vendor":{"name":"Paloaltonetworks","slug":"paloaltonetworks"}},{"hub":false,"name":"Paloaltonetworks Pa-1420","slug":"pa-1420","vendor":{"name":"Paloaltonetworks","slug":"paloaltonetworks"}},{"hub":false,"name":"Paloaltonetworks Pa-3410","slug":"pa-3410","vendor":{"name":"Paloaltonetworks","slug":"paloaltonetworks"}},{"hub":false,"name":"Paloaltonetworks Pa-3420","slug":"pa-3420","vendor":{"name":"Paloaltonetworks","slug":"paloaltonetworks"}},{"hub":false,"name":"Paloaltonetworks Pa-3430","slug":"pa-3430","vendor":{"name":"Paloaltonetworks","slug":"paloaltonetworks"}},{"hub":false,"name":"Paloaltonetworks Pa-3440","slug":"pa-3440","vendor":{"name":"Paloaltonetworks","slug":"paloaltonetworks"}}],"exploited_since":"2026-05-06T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-0300-palo-alto-networks-pan-os-buffer-overflow-in-user-id"}],"previous":{"key":"2026-04-27","top":"Microsoft Windows","total":4,"period":{"end":"2026-05-03","start":"2026-04-27"},"critical":4,"url":"https://junglewise.ai/threats/exploited/2026-04-27"},"next":{"key":"2026-05-11","top":"Cisco Catalyst Sd-Wan","total":2,"period":{"end":"2026-05-17","start":"2026-05-11"},"critical":2,"url":"https://junglewise.ai/threats/exploited/2026-05-11"}}