# Newly exploited vulnerabilities: week of 18 to 24 May 2026 (week 21)

Source: https://junglewise.ai/threats/exploited/2026-05-18  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2 October 2026, 20:07 UTC. Final: it does not change.  
Data: https://junglewise.ai/threats/exploited/2026-05-18.json  
License: CC BY 4.0 with a link back

In the week of 18 to 24 May 2026, 9 vulnerabilities were newly recorded as exploited in the wild, 9 of them critical. The technology hit most was Microsoft Defender (3), followed by Adobe Acrobat (2) and Adobe Reader (2).

## Newly exploited this week

- [CVE-2026-9082: Drupal Drupal core SQL injection in database abstraction API](https://junglewise.ai/threats/cve-2026-9082-drupal-drupal-core-sql-injection-in-database-abstraction-api) (critical, exploited in the wild, CVSS 9.8, exploited since 22 May 2026, published 20 May 2026)
- [CVE-2026-34926: Trend Micro Apex One directory traversal in on-premise server](https://junglewise.ai/threats/cve-2026-34926-trend-micro-apex-one-directory-traversal-in-on-premise-server) (critical, exploited in the wild, CVSS 6.7, exploited since 21 May 2026, published 21 May 2026)
- [CVE-2025-34291: Langflow CORS misconfiguration enables Account Takeover and RCE](https://junglewise.ai/threats/cve-2025-34291-langflow-cors-misconfiguration-and-account-takeover-leading-to) (critical, exploited in the wild, CVSS 8.8, exploited since 21 May 2026, published 6 Dec 2025)
- [CVE-2026-45498: Microsoft Defender denial of service](https://junglewise.ai/threats/cve-2026-45498-microsoft-defender-denial-of-service) (critical, exploited in the wild, CVSS 4, exploited since 20 May 2026, published 20 May 2026)
- [CVE-2026-41091: Microsoft Defender privilege escalation via improper link resolution](https://junglewise.ai/threats/cve-2026-41091-microsoft-defender-privilege-escalation-via-improper-link) (critical, exploited in the wild, CVSS 7.8, exploited since 20 May 2026, published 20 May 2026)
- [CVE-2009-1537: Microsoft DirectX NULL byte overwrite in QuickTime Movie Parser Filter](https://junglewise.ai/threats/cve-2009-1537-microsoft-directx-null-byte-overwrite-in-quicktime-movie-parser) (critical, exploited in the wild, CVSS 9.3, exploited since 20 May 2026, published 20 May 2026)
- [CVE-2009-3459: Adobe Acrobat and Reader heap overflow in PDF parsing](https://junglewise.ai/threats/cve-2009-3459-adobe-acrobat-and-reader-heap-overflow-in-pdf-parsing) (critical, exploited in the wild, CVSS 9.3, exploited since 20 May 2026, published 20 May 2026)
- [CVE-2010-0806: Microsoft Internet Explorer use-after-free in Peer Objects](https://junglewise.ai/threats/cve-2010-0806-microsoft-internet-explorer-use-after-free-in-peer-objects) (critical, exploited in the wild, CVSS 9.3, exploited since 20 May 2026, published 20 May 2026)
- [CVE-2008-4250: Microsoft Windows buffer overflow in Server service](https://junglewise.ai/threats/cve-2008-4250-microsoft-windows-buffer-overflow-in-server-service) (critical, exploited in the wild, CVSS 10, exploited since 20 May 2026, published 20 May 2026)

## Technologies hit most

1. [Microsoft Defender](https://junglewise.ai/threats/technologies/defender): 3 vulnerabilities
2. [Adobe Acrobat](https://junglewise.ai/threats/technologies/acrobat): 2 vulnerabilities
3. [Adobe Reader](https://junglewise.ai/threats/technologies/reader): 2 vulnerabilities
4. Microsoft DirectX: 2 vulnerabilities
5. [Microsoft Internet Explorer](https://junglewise.ai/threats/technologies/internet-explorer): 2 vulnerabilities
6. Trend Micro Apex One: 2 vulnerabilities
7. [Drupal](https://junglewise.ai/threats/technologies/drupal): 1 vulnerability
8. [Drupal Ajenti Core](https://junglewise.ai/threats/technologies/core): 1 vulnerability
9. [Drupal Core](https://junglewise.ai/threats/technologies/drupal-core): 1 vulnerability
10. [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 1 vulnerability
11. [Langflow](https://junglewise.ai/threats/technologies/langflow): 1 vulnerability
12. [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow): 1 vulnerability
13. [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-): 1 vulnerability
14. [Microsoft Windows 2000](https://junglewise.ai/threats/technologies/windows-2000): 1 vulnerability
15. [Microsoft Windows Server 2003](https://junglewise.ai/threats/technologies/windows-server-2003): 1 vulnerability

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Newly exploited vulnerabilities: week of 18 to 24 May 2026 (week 21)", https://junglewise.ai/threats/exploited/2026-05-18, 2 October 2026.