# Newly exploited vulnerabilities: week of 4 to 10 May 2026 (week 19)

Source: https://junglewise.ai/threats/exploited/2026-05-04  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 20:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-05-04.json  
License: CC BY 4.0 with a link back

In the week of 4 to 10 May 2026, 3 vulnerabilities were newly recorded as exploited in the wild, 3 of them critical. The technology hit most was Berriai LiteLLM (1), followed by Ivanti Endpoint Manager Mobile (1) and Ivanti Endpoint Manager Mobile (EPMM) (1).

## Newly exploited this week

- [CVE-2026-42208: BerriAI LiteLLM SQL injection in Proxy API key verification](https://junglewise.ai/threats/cve-2026-42208-berriai-litellm-sql-injection-in-proxy-api-key-verification) (critical, exploited in the wild, CVSS 9.8, exploited since 8 May 2026, published 8 May 2026)
- [CVE-2026-6973: Ivanti Endpoint Manager Mobile RCE via Apache directive injection](https://junglewise.ai/threats/cve-2026-6973-ivanti-endpoint-manager-mobile-rce-via-apache-directive-injection) (critical, exploited in the wild, CVSS 7.2, exploited since 7 May 2026, published 7 May 2026)
- [CVE-2026-0300: Palo Alto Networks PAN-OS buffer overflow in User-ID Authentication Portal](https://junglewise.ai/threats/cve-2026-0300-palo-alto-networks-pan-os-buffer-overflow-in-user-id) (critical, exploited in the wild, CVSS 9.8, exploited since 6 May 2026, published 6 May 2026)

## Technologies hit most

1. [Berriai LiteLLM](https://junglewise.ai/threats/technologies/litellm): 1 vulnerability
2. [Ivanti Endpoint Manager Mobile](https://junglewise.ai/threats/technologies/endpoint-manager-mobile): 1 vulnerability
3. [Ivanti Endpoint Manager Mobile (EPMM)](https://junglewise.ai/threats/technologies/endpoint-manager-mobile-epmm): 1 vulnerability
4. [Ivanti MobileIron Core](https://junglewise.ai/threats/technologies/mobileiron-core): 1 vulnerability
5. [litellm (PyPI)](https://junglewise.ai/threats/technologies/pypi-litellm): 1 vulnerability
6. Paloaltonetworks Pa-1410: 1 vulnerability
7. Paloaltonetworks Pa-1420: 1 vulnerability
8. Paloaltonetworks Pa-3410: 1 vulnerability
9. Paloaltonetworks Pa-3420: 1 vulnerability
10. Paloaltonetworks Pa-3430: 1 vulnerability
11. Paloaltonetworks Pa-3440: 1 vulnerability
12. Paloaltonetworks Pa-410: 1 vulnerability
13. Paloaltonetworks Pa-410r: 1 vulnerability
14. Paloaltonetworks Pa-410r-5g: 1 vulnerability
15. Paloaltonetworks Pa-415: 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 4 to 10 May 2026 (week 19)", https://junglewise.ai/threats/exploited/2026-05-04, 2 October 2026.