{"schema_version":1,"title":"Newly exploited vulnerabilities: week of 18 to 24 May 2026 (week 21)","summary":"In the week of 18 to 24 May 2026, 9 vulnerabilities were newly recorded as exploited in the wild, 9 of them critical. The technology hit most was Microsoft Defender (3), followed by Adobe Acrobat (2) and Adobe Reader (2).","url":"https://junglewise.ai/threats/exploited/2026-05-18","json_url":"https://junglewise.ai/threats/exploited/2026-05-18.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/exploited/2026-05-18","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","method":"A vulnerability is exploited in the wild when the CISA Known Exploited Vulnerabilities catalogue lists it or a vendor advisory says so; exploited_since is CISA's date added where it came from the catalogue, else the day Junglewise learned of it.","kind":"exploited_week","total":9,"period":{"end":"2026-05-24","start":"2026-05-18"},"critical":9,"generated_at":"2026-10-02T20:07:00.213787+00:00","technologies":[{"hub":true,"name":"Microsoft Defender","slug":"defender","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/defender"},{"hub":true,"name":"Adobe Acrobat","slug":"acrobat","vulnerabilities":2,"url":"https://junglewise.ai/threats/technologies/acrobat"},{"hub":true,"name":"Adobe Reader","slug":"reader","vulnerabilities":2,"url":"https://junglewise.ai/threats/technologies/reader"},{"hub":false,"name":"Microsoft DirectX","slug":"directx","vulnerabilities":2},{"hub":true,"name":"Microsoft Internet Explorer","slug":"internet-explorer","vulnerabilities":2,"url":"https://junglewise.ai/threats/technologies/internet-explorer"},{"hub":false,"name":"Trend Micro Apex One","slug":"apex-one-on-premise","vulnerabilities":2},{"hub":true,"name":"Drupal","slug":"drupal","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/drupal"},{"hub":true,"name":"Drupal Ajenti Core","slug":"core","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/core"},{"hub":true,"name":"Drupal Core","slug":"drupal-core","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/drupal-core"},{"hub":true,"name":"drupal/core (Packagist)","slug":"packagist-drupal-core","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/packagist-drupal-core"},{"hub":true,"name":"Langflow","slug":"langflow","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/langflow"},{"hub":true,"name":"langflow (PyPI)","slug":"pypi-langflow","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/pypi-langflow"},{"hub":true,"name":"Microsoft Windows","slug":"windows-","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/windows-"},{"hub":true,"name":"Microsoft Windows 2000","slug":"windows-2000","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/windows-2000"},{"hub":true,"name":"Microsoft Windows Server 2003","slug":"windows-server-2003","vulnerabilities":1,"url":"https://junglewise.ai/threats/technologies/windows-server-2003"}],"vulnerabilities":[{"cve":"CVE-2026-9082","cvss":9.8,"epss":0.157,"slug":"cve-2026-9082-drupal-drupal-core-sql-injection-in-database-abstraction-api","title":"Drupal Drupal core SQL injection in database abstraction API","severity":"critical","exploited":true,"published_at":"2026-05-20T20:16:41.23+00:00","technologies":[{"hub":true,"name":"Drupal Ajenti Core","slug":"core","vendor":{"name":"Drupal","slug":"drupal"}},{"hub":true,"name":"Drupal","slug":"drupal","vendor":{"name":"Drupal","slug":"drupal"}},{"hub":true,"name":"Drupal Core","slug":"drupal-core","vendor":{"name":"Drupal","slug":"drupal"}},{"hub":true,"name":"drupal/core (Packagist)","slug":"packagist-drupal-core","vendor":{"name":"Packagist","slug":"packagist"}}],"exploited_since":"2026-05-22T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-9082-drupal-drupal-core-sql-injection-in-database-abstraction-api"},{"cve":"CVE-2026-34926","cvss":6.7,"slug":"cve-2026-34926-trend-micro-apex-one-directory-traversal-in-on-premise-server","title":"Trend Micro Apex One directory traversal in on-premise server","severity":"critical","exploited":true,"published_at":"2026-05-21T14:16:45.213+00:00","technologies":[{"hub":false,"name":"Trend Micro Apex One","slug":"apex-one-on-premise","vendor":{"name":"Trend Micro","slug":"trend-micro"}}],"exploited_since":"2026-05-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-34926-trend-micro-apex-one-directory-traversal-in-on-premise-server"},{"cve":"CVE-2025-34291","cvss":8.8,"epss":0.9281,"slug":"cve-2025-34291-langflow-cors-misconfiguration-and-account-takeover-leading-to","title":"Langflow CORS misconfiguration enables Account Takeover and RCE","severity":"critical","exploited":true,"published_at":"2025-12-06T00:31:36+00:00","technologies":[{"hub":false,"name":"Trend Micro Apex One","slug":"apex-one-on-premise","vendor":{"name":"Trend Micro","slug":"trend-micro"}},{"hub":true,"name":"Langflow","slug":"langflow","vendor":{"name":"Langflow","slug":"langflow"}},{"hub":true,"name":"langflow (PyPI)","slug":"pypi-langflow","vendor":{"name":"PyPI","slug":"pypi"}}],"exploited_since":"2026-05-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-34291-langflow-cors-misconfiguration-and-account-takeover-leading-to"},{"cve":"CVE-2026-45498","cvss":4,"slug":"cve-2026-45498-microsoft-defender-denial-of-service","title":"Microsoft Defender denial of service","severity":"critical","exploited":true,"published_at":"2026-05-20T13:16:36.78+00:00","technologies":[{"hub":true,"name":"Microsoft Defender","slug":"defender","vendor":{"name":"Microsoft","slug":"microsoft"}}],"exploited_since":"2026-05-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-45498-microsoft-defender-denial-of-service"},{"cve":"CVE-2026-41091","cvss":7.8,"slug":"cve-2026-41091-microsoft-defender-privilege-escalation-via-improper-link","title":"Microsoft Defender privilege escalation via improper link resolution","severity":"critical","exploited":true,"published_at":"2026-05-20T13:16:29.173+00:00","technologies":[{"hub":true,"name":"Microsoft Defender","slug":"defender","vendor":{"name":"Microsoft","slug":"microsoft"}}],"exploited_since":"2026-05-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2026-41091-microsoft-defender-privilege-escalation-via-improper-link"},{"cve":"CVE-2009-1537","cvss":9.3,"epss":0.6808,"slug":"cve-2009-1537-microsoft-directx-null-byte-overwrite-in-quicktime-movie-parser","title":"Microsoft DirectX NULL byte overwrite in QuickTime Movie Parser Filter","severity":"critical","exploited":true,"published_at":"2026-05-20T00:00:00+00:00","technologies":[{"hub":false,"name":"Microsoft DirectX","slug":"directx","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft Windows 2000","slug":"windows-2000","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft Windows Server 2003","slug":"windows-server-2003","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft Windows XP","slug":"windows-xp","vendor":{"name":"Microsoft","slug":"microsoft"}}],"exploited_since":"2026-05-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2009-1537-microsoft-directx-null-byte-overwrite-in-quicktime-movie-parser"},{"cve":"CVE-2009-3459","cvss":9.3,"epss":0.8703,"slug":"cve-2009-3459-adobe-acrobat-and-reader-heap-overflow-in-pdf-parsing","title":"Adobe Acrobat and Reader heap overflow in PDF parsing","severity":"critical","exploited":true,"published_at":"2026-05-20T00:00:00+00:00","technologies":[{"hub":true,"name":"Adobe Acrobat","slug":"acrobat","vendor":{"name":"Adobe","slug":"adobe"}},{"hub":true,"name":"Adobe Reader","slug":"reader","vendor":{"name":"Adobe","slug":"adobe"}}],"exploited_since":"2026-05-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2009-3459-adobe-acrobat-and-reader-heap-overflow-in-pdf-parsing"},{"cve":"CVE-2010-0806","cvss":9.3,"epss":0.8948,"slug":"cve-2010-0806-microsoft-internet-explorer-use-after-free-in-peer-objects","title":"Microsoft Internet Explorer use-after-free in Peer Objects","severity":"critical","exploited":true,"published_at":"2026-05-20T00:00:00+00:00","technologies":[{"hub":true,"name":"Microsoft Internet Explorer","slug":"internet-explorer","vendor":{"name":"Microsoft","slug":"microsoft"}}],"exploited_since":"2026-05-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2010-0806-microsoft-internet-explorer-use-after-free-in-peer-objects"},{"cve":"CVE-2008-4250","cvss":10,"epss":0.9348,"slug":"cve-2008-4250-microsoft-windows-buffer-overflow-in-server-service","title":"Microsoft Windows buffer overflow in Server service","severity":"critical","exploited":true,"published_at":"2026-05-20T00:00:00+00:00","technologies":[{"hub":true,"name":"Adobe Acrobat","slug":"acrobat","vendor":{"name":"Adobe","slug":"adobe"}},{"hub":true,"name":"Microsoft Defender","slug":"defender","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":false,"name":"Microsoft DirectX","slug":"directx","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Microsoft Internet Explorer","slug":"internet-explorer","vendor":{"name":"Microsoft","slug":"microsoft"}},{"hub":true,"name":"Adobe Reader","slug":"reader","vendor":{"name":"Adobe","slug":"adobe"}},{"hub":true,"name":"Microsoft Windows","slug":"windows-","vendor":{"name":"Microsoft","slug":"microsoft"}}],"exploited_since":"2026-05-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2008-4250-microsoft-windows-buffer-overflow-in-server-service"}],"previous":{"key":"2026-05-11","top":"Cisco Catalyst Sd-Wan","total":2,"period":{"end":"2026-05-17","start":"2026-05-11"},"critical":2,"url":"https://junglewise.ai/threats/exploited/2026-05-11"},"next":{"key":"2026-05-25","top":"TanStack","total":5,"period":{"end":"2026-05-31","start":"2026-05-25"},"critical":5,"url":"https://junglewise.ai/threats/exploited/2026-05-25"}}