CVE-2026 list

CVE-2026 records published in June 2026

Page five of eight: records 4,001 to 5,000 of the 7,316 published in June 2026, newest first. The first page carries the figures for June 2026.

CVE-2026 records published in June 2026, newest first: records 4,001 to 5,000 of 7,316
CVE Summary CVSS EPSS Published Signals
CVE-2026-40791WP Time Slots Booking Form WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Exploit codeFix
CVE-2026-40790WP SMS WordPress plugin sensitive data exposure6.5CNA v3.10.3%2026-06-15Fix
CVE-2026-40789Amelia WordPress plugin sensitive data exposure7.5CNA v3.10.4%2026-06-15Fix
CVE-2026-40788ChatBot WordPress plugin broken access control7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-40787Quiz And Survey Master WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-40785AutomatorWP WordPress plugin broken authentication7.1CNA v3.10.4%2026-06-15Fix
CVE-2026-40782WPAdverts WordPress plugin broken access control6.5CNA v3.10.3%2026-06-15Fix
CVE-2026-40781ReviewX WordPress plugin broken authentication7.5CNA v3.10.4%2026-06-15Fix
CVE-2026-40779Link Library WordPress plugin arbitrary file deletion7.7CNA v3.10.5%2026-06-15Fix
CVE-2026-40776WP Event Solution WordPress plugin Unauthenticated missing authorization7.5CNA v3.10.4%2026-06-15Exploit codeFix
CVE-2026-40775Royal MCP WordPress plugin broken access control7.3CNA v3.10.3%2026-06-15Fix
CVE-2026-40774Booking Package WordPress plugin broken access control7.5CNA v3.10.3%2026-06-15Fix
CVE-2026-40773rtMedia for WordPress, BuddyPress and bbPress plugin broken access control6.5CNA v3.10.3%2026-06-15Fix
CVE-2026-40772GeekyBot WordPress plugin arbitrary file upload10.0CNA v3.10.5%2026-06-15Fix
CVE-2026-40771Contest Gallery WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-15Fix
CVE-2026-40770Coupon Affiliates WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-40769Contact Form Extender for Divi WordPress plugin Unauthenticated arbitrary file deletion8.6CNA v3.10.6%2026-06-15Fix
CVE-2026-40767wpForo Forum WordPress plugin broken access control7.5CNA v3.10.4%2026-06-15Fix
CVE-2026-40766MasterStudy LMS WordPress plugin SQL injection8.5CNA v3.10.4%2026-06-15Fix
CVE-2026-40762WPGraphQL WordPress plugin SQL injection7.5CNA v3.10.3%2026-06-15Fix
CVE-2026-40743Tutor LMS WordPress plugin broken access control6.5CNA v3.10.3%2026-06-15Fix
CVE-2026-40741Redsys for WooCommerce Light WordPress plugin broken access control7.5CNA v3.10.3%2026-06-15Fix
CVE-2026-40732Notification for Telegram WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-40727Groundhogg WordPress plugin arbitrary file deletion7.7CNA v3.10.5%2026-06-15Fix
CVE-2026-39594Ultra Addons for WPForms WordPress plugin broken access control6.4CNA v3.10.3%2026-06-15Fix
CVE-2026-39591WP-BusinessDirectory WordPress plugin arbitrary file upload9.9CNA v3.10.5%2026-06-15Fix
CVE-2026-39587WP BASE Booking WordPress plugin privilege escalation8.1CNA v3.10.4%2026-06-15Fix
CVE-2026-39584RepairBuddy WordPress plugin broken access control6.5CNA v3.10.3%2026-06-15Fix
CVE-2026-39583Datalogics Ecommerce Delivery WordPress plugin privilege escalation9.8CNA v3.10.5%2026-06-15Fix
CVE-2026-39579B Blocks WordPress plugin privilege escalation8.8CNA v3.10.4%2026-06-15Fix
CVE-2026-39540Shipment Tracker for Woocommerce WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-06-15Fix
CVE-2026-39534WP Directory Kit WordPress plugin broken access control7.5CNA v3.10.4%2026-06-15Fix
CVE-2026-39533AWP Classifieds WordPress plugin broken access control7.5CNA v3.10.4%2026-06-15Fix
CVE-2026-39532Events Calendar for GeoDirectory WordPress plugin PHP object injection8.8CNA v3.10.5%2026-06-15Fix
CVE-2026-39530SpeakOut! Email Petitions WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-15Fix
CVE-2026-39527WpStream WordPress plugin arbitrary file upload5.4CNA v3.10.3%2026-06-15Fix
CVE-2026-39525Booking Activities WordPress plugin broken access control6.5CNA v3.10.3%2026-06-15Fix
CVE-2026-39524Masteriyo - LMS WordPress plugin Payment bypass vulnerability7.5CNA v3.10.3%2026-06-15Fix
CVE-2026-39519GeekyBot WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-15Fix
CVE-2026-39518EventPrime WordPress plugin insecure direct object references (IDOR)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-39515Motors WordPress plugin broken access control6.5CNA v3.10.4%2026-06-15Fix
CVE-2026-39514Paid Member Subscriptions WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-39513Easy Appointments WordPress plugin broken access control7.5CNA v3.10.4%2026-06-15Fix
CVE-2026-39512GeoDirectory WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-15Fix
CVE-2026-39511WP Photo Album Plus WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-15Fix
CVE-2026-39507Social Slider Feed WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-39503Easy Digital Downloads WordPress plugin broken access control7.5CNA v3.10.3%2026-06-15Fix
CVE-2026-39502Form Maker by 10Web WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-15Fix
CVE-2026-39499Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin PHP object injection7.2CNA v3.10.5%2026-06-15Fix
CVE-2026-39498YayMail WordPress plugin PHP object injection7.2CNA v3.10.5%2026-06-15Fix
CVE-2026-39493Simply Schedule Appointments WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-15Fix
CVE-2026-39492WP Maps WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-15Fix
CVE-2026-39491JupiterX Core WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-06-15Fix
CVE-2026-39489Download Monitor WordPress plugin Non-arbitrary file download4.4CNA v3.10.4%2026-06-15Fix
CVE-2026-39481Modula Image Gallery WordPress plugin PHP object injection7.2CNA v3.10.5%2026-06-15Fix
CVE-2026-39480Backup Migration WordPress plugin sensitive data exposure7.5CNA v3.10.4%2026-06-15Fix
CVE-2026-39478Anti-Malware Security and Brute-Force Firewall WordPress plugin PHP object injection8.8CNA v3.10.5%2026-06-15Fix
CVE-2026-39474Post Duplicator WordPress plugin PHP object injection8.8CNA v3.10.5%2026-06-15Fix
CVE-2026-39472WooCommerce PDF Invoices and Packing Slips WordPress plugin PHP object injection7.2CNA v3.10.5%2026-06-15Fix
CVE-2026-39471ShortPixel Image Optimizer WordPress plugin PHP object injection7.2CNA v3.10.5%2026-06-15Fix
CVE-2026-39470WooCommerce Cart Abandonment Recovery WordPress plugin privilege escalation7.2CNA v3.10.5%2026-06-15Fix
CVE-2026-39468Meta Box WordPress Custom Fields Framework plugin arbitrary file deletion6.8CNA v3.11.3%2026-06-15NucleiFix
CVE-2026-39465Responsive Slider by MetaSlider WordPress plugin remote code execution (RCE)9.1CNA v3.10.8%2026-06-15Fix
CVE-2026-39463ManageWP Worker WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-39451WP Google Review Slider WordPress plugin cross-site scripting (XSS)6.3CNA v3.10.3%2026-06-15Fix
CVE-2026-39450FunnelKit Automations WordPress plugin broken authentication7.1CNA v3.10.4%2026-06-15Fix
CVE-2026-39449Contact Form to Any API WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-39447Simply Schedule Appointments WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-39441Feed KuantoKusta for WooCommerce Free WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-15Fix
CVE-2026-39435CformsII WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-39434CTX Feed WordPress plugin PHP object injection7.2CNA v3.10.5%2026-06-15Fix
CVE-2026-39197Datadog Vector HTTP utility endpoint denial of service6.5CISA ADP v3.10.4%2026-06-15
CVE-2026-39196Datadog Vector KeyPartitioner SQL injection9.8CISA ADP v3.10.5%2026-06-15
CVE-2026-39118Kandji Agent privilege escalation8.4CISA ADP v3.10.2%2026-06-15
CVE-2026-39007Observeinc Observe CSV log export information disclosure7.5CISA ADP v3.10.5%2026-06-15
CVE-2026-39006An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.9.8CISA ADP v3.10.8%2026-06-15
CVE-2026-38812RuoYi code generation module SQL injection9.8CISA ADP v3.10.5%2026-06-15Exploit code
CVE-2026-38329Bludit CMS API file upload plugin missing authorization9.8CISA ADP v3.10.7%2026-06-15
CVE-2026-38065Tenda 5G03 IMS APN function command injection9.8CISA ADP v3.11.8%2026-06-15
CVE-2026-38064Tenda 5G03 dial call function command injection9.8CISA ADP v3.11.8%2026-06-15
CVE-2026-38063Tenda 5G03 radio IA APN function command injection9.8CISA ADP v3.11.8%2026-06-15
CVE-2026-38062Tenda 5G03 RAT mode setting function command injection9.8CISA ADP v3.11.8%2026-06-15
CVE-2026-38061Tenda 5G03 volume setting function command injection9.8CISA ADP v3.11.8%2026-06-15
CVE-2026-38060Tenda 5G03 SIM unlock function command injection9.8CISA ADP v3.11.8%2026-06-15
CVE-2026-37216RuoYi notice creation page cross-site scripting6.1CISA ADP v3.10.3%2026-06-15
CVE-2026-36933Boyleep K11 and y108 factory test feature improper access control6.8CISA ADP v3.10.2%2026-06-15
CVE-2026-36670OpenSIPS Control Panel alias_management.php SQL injection8.8CISA ADP v3.10.4%2026-06-15Exploit code
CVE-2026-36537ThingsBoard OAuth2 login endpoint authentication bypass9.8CISA ADP v3.10.8%2026-06-15
CVE-2026-36521PublicCMS site configuration management module cross-site scripting6.1CISA ADP v3.10.3%2026-06-15
CVE-2026-36213Microvirt MEmu Android Emulator MemuService.exe privilege escalation7.8CISA ADP v3.10.4%2026-06-15Exploit code
CVE-2026-34902WooCommerce Product Table Lite WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-34901iControlWP WordPress plugin privilege escalation9.8CNA v3.10.5%2026-06-15Fix
CVE-2026-34900GiveWP WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-34898Event Tickets Manager for WooCommerce WordPress plugin broken access control7.5CNA v3.10.3%2026-06-15Fix
CVE-2026-34892Rank Math SEO WordPress plugin broken access control6.5CNA v3.10.3%2026-06-15Fix
CVE-2026-34891IDPay Payment Gateway for Woocommerce WordPress plugin sensitive data exposure7.5CNA v3.10.4%2026-06-15
CVE-2026-34886Simple Membership WordPress plugin broken access control7.5CNA v3.10.3%2026-06-15Fix
CVE-2026-34030Improper branch-code validation in Wertheim SafeController Software allows file path manipulation6.9CNA v4.00.4%2026-06-15
CVE-2026-34029The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll component. An attacker with access to the application files can reverse engineer the DLL and recover the hard-coded cryptographic key. This key6.8CNA v4.00.1%2026-06-15
CVE-2026-34028Unauthenticated direct access to web data in Wertheim SafeController Software exposes files6.9CNA v4.00.5%2026-06-15
CVE-2026-34027Wertheim SafeController Software uploadcustomdocuments endpoint unrestricted file upload5.3CNA v4.00.4%2026-06-15
CVE-2026-34026Wertheim SafeController Software openselfservicedocument endpoint path traversal7.1CNA v4.00.5%2026-06-15
CVE-2026-34025Wertheim SafeController Software login process authentication bypass by spoofing5.3CNA v4.00.4%2026-06-15
CVE-2026-34024Wertheim SafeController Software web application endpoints missing authorization8.6CNA v4.00.4%2026-06-15
CVE-2026-34023Wertheim SafeController Software WebSocket WebMessageBroker incorrect authorization7.1CNA v4.00.5%2026-06-15
CVE-2026-34022Wertheim SafeController Family 65000 communication encryption hard-coded cryptographic key7.1CNA v4.00.1%2026-06-15
CVE-2026-34021Wertheim SafeController 5400 RS-485 communication authentication bypass by replay8.6CNA v4.00.3%2026-06-15
CVE-2026-30121Remotion: Arbitrary file write9.1CISA ADP v3.10.5%2026-06-15Fix
CVE-2026-30120Remotion: Remote code execution (RCE)9.8CISA ADP v3.10.9%2026-06-15Fix
CVE-2026-27407AI Engine WordPress plugin privilege escalation7.2CNA v3.10.5%2026-06-15Fix
CVE-2026-27333Paid Videochat Turnkey Site WordPress plugin deserialization of untrusted data8.1CNA v3.10.4%2026-06-15Fix
CVE-2026-27089WpTravelly WordPress plugin bypass vulnerability vulnerability7.5CNA v3.10.4%2026-06-15Fix
CVE-2026-27053Broadcast Live Video WordPress plugin PHP object injection9.8CNA v3.10.6%2026-06-15Fix
CVE-2026-25440Essential Addons for Elementor WordPress plugin broken access control5.3CNA v3.10.3%2026-06-15Fix
CVE-2026-25425User Registration WordPress plugin broken access control7.5CNA v3.10.4%2026-06-15Fix
CVE-2026-24637PowerPress Podcasting WordPress plugin SQL injection8.5CNA v3.10.3%2026-06-15Fix
CVE-2026-23970Redirection for Contact Form 7 WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-06-15Fix
CVE-2026-20262Cisco Catalyst SD-WAN Manager Directory or path traversal6.5CNA v3.128.2%2026-06-15KEVExploit codeFix
CVE-2026-12223Yealink SIP-T46U Web FastCGI service tftpuploadiperf mod_webd.TFTPUploadIperf command injection5.1CNA v4.01.2%2026-06-15
CVE-2026-12222Yealink SIP-T46U Web FastCGI service bttest mod_webd.BlueToothTest stack-based overflow8.6CNA v4.00.4%2026-06-15
CVE-2026-12221Yealink SIP-T46U Firmware Chunk upload upgrade sprintf stack-based overflow8.6CNA v4.00.4%2026-06-15
CVE-2026-12220Yealink SIP-T46U firmware chunk upload handler stack-based buffer overflow8.6CNA v4.00.4%2026-06-15
CVE-2026-12219Yealink SIP-T46U Web FastCGI service start mod_diagnose.CommandShellByType command injection5.3CNA v4.01.1%2026-06-15
CVE-2026-12218Yealink SIP-T46U Web FastCGI service beforewifitest StartReportInformation stack-based overflow8.6CNA v4.00.4%2026-06-15
CVE-2026-12217DVDFab Virtual Drive Signed Kernel driver dvdfabio.sys privileges management8.5CNA v4.00.1%2026-06-15
CVE-2026-12216svaarala duktape duk_api_bytecode.c memory corruption4.8CNA v4.00.1%2026-06-15
CVE-2026-12214Qihoo 360 Total Security Nucleus Engine monitoring logic protection mechanism failure8.5CNA v4.00.1%2026-06-15
CVE-2026-12213hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization5.3CNA v4.00.2%2026-06-15
CVE-2026-12212hcengineering Huly Platform RPC operations.ts getMailboxSecret access control5.3CNA v4.00.2%2026-06-15
CVE-2026-12211Intelbras iNVU 7016 FT Web syslog path traversal5.1CNA v4.00.4%2026-06-15Fix
CVE-2026-12210universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery5.3CNA v4.00.2%2026-06-15Fix
CVE-2026-12209RubyLouvre avalon Template Filter index.js prototype pollution6.9CNA v4.00.3%2026-06-15
CVE-2026-12208jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution6.9CNA v4.00.3%2026-06-15Fix
CVE-2026-12207medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection5.3CNA v4.00.2%2026-06-15
CVE-2026-12206Grit42 Grit data_table_entity.rb DataTableEntity SQL injection5.3CNA v4.00.2%2026-06-15
CVE-2026-12205Crypt::DSA versions for Perl reused the nonce across signatures, leading to private-key recovery9.1CISA ADP v3.10.3%2026-06-15Fix
CVE-2026-12204ShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization6.9CNA v4.00.3%2026-06-15
CVE-2026-12203HKUDS AI-Trader Research Export agents.csv information disclosure6.9CNA v4.00.4%2026-06-15
CVE-2026-12202Intelliants Subrion CMS blocks endpoint cross-site scripting4.8CNA v4.00.2%2026-06-15
CVE-2026-12201IObit Malware Fighter DLL handler incorrect privilege assignment4.8CNA v4.00.1%2026-06-15
CVE-2026-12200Ritlabs TinyWeb Server header libeay32.dll.html stack-based overflow6.9CNA v4.00.3%2026-06-15
CVE-2026-12198Microweber API endpoint thumbnail_img userfiles_path path traversal6.9CNA v4.00.5%2026-06-15
CVE-2026-12197Ruijie EG105G-P JSON-RPC Diagnose endpoint diagnose nslookup command injection8.6CNA v4.02.4%2026-06-15
CVE-2026-12193VS Revo RevoUninstaller IOCTL RevoDetector.sys IOCtl_Handler heap-based overflow8.5CNA v4.00.1%2026-06-15Fix
CVE-2026-12192GALAYOU Y4 web server buffer overflow8.7CNA v4.00.3%2026-06-15
CVE-2026-12161Devolutions Remote Desktop Manager SSH Elevate Shell feature improper input validation8.8CISA ADP v3.10.4%2026-06-15Fix
CVE-2026-12087Socket versions for Perl have an out-of-bounds heap read9.1CISA ADP v3.10.4%2026-06-15Fix
CVE-2026-12057DoS + remote code execution via PDF JavaScript in Foxit AI8.6CNA v3.10.1%2026-06-15Fix
CVE-2026-11931Insecure permissions on Authentication Token Cache file in Kiro IDE6.8CNA v4.00.1%2026-06-15Fix
CVE-2026-11860OpenSolution Quick.CMS deserialization of untrusted data7.5CNA v4.00.2%2026-06-15Fix
CVE-2026-11832Dancer2::Plugin::Auth::OAuth versions for Perl default to a predictable nonce9.1CISA ADP v3.10.3%2026-06-15Fix
CVE-2026-10634Zephyr TCP connection list iteration use-after-free4.8CNA v3.10.3%2026-06-15Fix
CVE-2026-9863Core Privileged Access Manager (BoKS) upgrade tooling command injection7.5CNA v3.11.0%2026-06-15Fix
CVE-2026-9862Core Privileged Access Manager (BoKS) autoregistration service command injection9.8CNA v3.11.5%2026-06-15Fix
CVE-2026-9691Integration for ActiveCampaign and Contact Form 7 WordPress plugin PHP object injection9.8CNA v3.10.6%2026-06-15Exploit codeFix
CVE-2026-9595webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies5.3CNA v3.10.2%2026-06-15Fix
CVE-2026-9278Form Builder CP WordPress plugin Editor+ stored XSS via form_structure5.4CISA ADP v3.10.3%2026-06-15Fix
CVE-2026-8935Advanced Google Maps for WordPress unauthenticated Administrator account creation9.8CISA ADP v3.10.5%2026-06-15Fix
CVE-2026-8683Overly long URLs crash the Mattermost Desktop App6.5CNA v3.10.4%2026-06-15Fix
CVE-2026-8386WP Go Maps WordPress plugin unauthenticated sensitive information disclosure via Marker ID5.3CISA ADP v3.10.8%2026-06-15NucleiFix
CVE-2026-8385WP Go Maps WordPress plugin unauthenticated sensitive information disclosure5.3CISA ADP v3.10.7%2026-06-15NucleiFix
CVE-2026-8358The Document Foundation LibreOffice heap buffer overflow in spreadsheet tracked-changes import5.4CNA v4.00.2%2026-06-15Fix
CVE-2026-8357The Document Foundation LibreOffice heap buffer overflow in Calc formula compilation5.4CNA v4.00.2%2026-06-15Fix
CVE-2026-8356The Document Foundation LibreOffice stack buffer overflow in PPT presentation import5.4CNA v4.00.2%2026-06-15Fix
CVE-2026-6517Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed6.3CNA v3.10.3%2026-06-15Fix
CVE-2026-6047The Document Foundation LibreOffice heap buffer overflow in OOXML text box element import5.4CNA v4.00.2%2026-06-15Fix
CVE-2026-6045The Document Foundation LibreOffice heap buffer overflow in EMF+ gradient brush import5.4CNA v4.00.2%2026-06-15Fix
CVE-2026-6040The Document Foundation LibreOffice heap use-after-free in ODF number-format blank-width parsing5.4CNA v4.00.2%2026-06-15Fix
CVE-2026-6039The Document Foundation LibreOffice heap buffer overflow in DXF polyline import5.4CNA v4.00.2%2026-06-15Fix
CVE-2026-5482Remote code execution via unrestricted file upload in Responsive FileManager9.3CNA v4.00.7%2026-06-15
CVE-2026-5242Code injection in Mia Technologies' Pizzy Library8.8CNA v3.10.5%2026-06-15Fix
CVE-2026-5233Missing Rate Limiting in Mia Technologies' Pizzy Library7.1CNA v3.10.4%2026-06-15Fix
CVE-2026-5230Improper access control in Mia Technologies' Pizzy Library7.1CNA v3.10.3%2026-06-15Fix
CVE-2026-5079multer vulnerable to denial of service via deeply nested field names7.5CNA v3.10.5%2026-06-15Fix
CVE-2026-5064HP One Agent Software Security Update8.5CNA v4.00.1%2026-06-15Fix
CVE-2026-5038multer vulnerable to denial of service via incomplete cleanup of aborted uploads5.3CNA v3.10.5%2026-06-15Fix
CVE-2026-54421OpenStack Ironic improper removal of sensitive information6.8CNA v3.10.5%2026-06-14Fix
CVE-2026-54420LiteSpeed cPanel plugin UNIX symbolic link (symlink) following8.5CNA v3.10.8%2026-06-14KEVExploit codeFix
CVE-2026-54413iso14229 integer underflow and out-of-bounds read in Handle_0x27_SecurityAccess7.8CNA v4.00.7%2026-06-14
CVE-2026-54412MQTT-C heap out-of-bounds read and integer underflow in mqtt_unpack_publish_response7.8CNA v4.00.7%2026-06-14
CVE-2026-54411Linux-PAM pam_userdb observable timing discrepancy in plaintext password Comparison6.9CNA v4.00.5%2026-06-14Fix
CVE-2026-54410nanoMODBUS off-by-one buffer overflow in recv_msg_header via Crafted MBAP Length field7.8CNA v4.00.9%2026-06-14
CVE-2026-12191Comma AI Openpilot Pickle modeld.py pickle.loads deserialization8.5CNA v4.00.1%2026-06-14Exploit code
CVE-2026-12190Genspark AI Workspace App custom URL scheme handler improper authorization4.8CNA v4.00.1%2026-06-14
CVE-2026-12189Moovit Bus and Public Transit App custom URL scheme handler improper authorization4.8CNA v4.00.1%2026-06-14
CVE-2026-12188Grit42 Grit GritEntityController grit_entity_controller.rb SQL injection5.3CNA v4.00.2%2026-06-14
CVE-2026-12187GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection8.7CNA v4.01.9%2026-06-14Fix
CVE-2026-12186GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection8.7CNA v4.02.0%2026-06-14Fix
CVE-2026-12176SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site scripting5.3CNA v4.00.3%2026-06-14
CVE-2026-11527Config::IniFiles versions for Perl allow OS command injection and file overwrite8.6CISA ADP v3.11.1%2026-06-14Fix
CVE-2026-11526GD versions for Perl allow OS command injection and file overwrite9.8CISA ADP v3.11.4%2026-06-14Fix
CVE-2026-54231Red Hat Automatic Bug Reporting Tool post-create event scripts content injection5.5CNA v3.10.2%2026-06-13Fix
CVE-2026-54230Red Hat Automatic Bug Reporting Tool post-create event scripts symlink following7.0CNA v3.10.2%2026-06-13Fix
CVE-2026-54229Red Hat Enterprise Linux 7 Extended Lifecycle Support race condition7.0CNA v3.10.1%2026-06-13Fix
CVE-2026-54228Red Hat Enterprise Linux 7 Extended Lifecycle Support time-of-check time-of-use race condition7.8CNA v3.10.1%2026-06-13Fix
CVE-2026-12183Nefteprodukttekhnika BUK TS-G Gas Station Automation System authentication bypass9.3CNA v4.00.4%2026-06-13Fix
CVE-2026-12175CodeAstro Student Attendance Management System createStudents.php SQL injection5.1CNA v4.00.2%2026-06-13
CVE-2026-12174D-Link DCS-935L HTTP rhea snprintf format string8.7CNA v4.00.6%2026-06-13
CVE-2026-12089WS Optimize All-in-One Speed Booster and Cache Tools WordPress plugin arbitrary file read4.9CNA v3.10.3%2026-06-13Fix
CVE-2026-11769Operator Namespaced User path traversal6.4CNA v4.00.4%2026-06-13Fix
CVE-2026-11624Google MCP Toolbox for Databases has an origin validation error9.4CNA v4.00.2%2026-06-13Fix
CVE-2026-11443Allegra downloadAttachment cross-site scripting authentication bypass4.6CNA v3.00.8%2026-06-13Fix
CVE-2026-11442Allegra exportReport directory traversal information disclosure6.5CNA v3.01.3%2026-06-13Fix
CVE-2026-9848WP Ticket WordPress plugin SQL injection7.5CNA v3.10.6%2026-06-13Fix
CVE-2026-9629Canvas WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-06-13Fix
CVE-2026-9134FooGallery WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-06-13Fix
CVE-2026-9109GPTranslate WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-06-13Fix
CVE-2026-9062Agile Store Locator WordPress plugin Admin+ arbitrary file read via path traversal3.4CISA ADP v3.10.4%2026-06-13Fix
CVE-2026-9061Agile Store Locator WordPress plugin Admin+ stored XSS via logo_name3.5CISA ADP v3.10.2%2026-06-13Fix
CVE-2026-6428Koha SQL injection in reports/catalogue_out.pl via Filter URL parameter5.6CNA v4.00.4%2026-06-13Fix
CVE-2026-5513Online Scheduling and Appointment Booking System WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2026-06-13Exploit codeFix
CVE-2026-3297Page Builder: Pagelayer Drag and Drop website builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-06-13Fix
CVE-2026-2470Pagelayer WordPress plugin incorrect authorization to authenticated Mail Relay Configuration4.3CNA v3.10.3%2026-06-13Fix
CVE-2026-1291Meow Gallery WordPress plugin missing authorization to authenticated (Author+) shortcode creation4.3CNA v3.10.2%2026-06-13Fix
CVE-2026-54398MISP object edit authorization bypass allows unauthorized sharing group assignment5.3CNA v4.00.4%2026-06-12Fix
CVE-2026-54397MISP event editing allows unauthorized assignment to undisclosed sharing groups6.1CNA v4.00.4%2026-06-12Fix
CVE-2026-54396MISP AuthKey edit endpoint allows authenticated user email enumeration5.3CNA v4.00.4%2026-06-12Fix
CVE-2026-54395MISP UiBeta event index reflected XSS in advanced filter popup5.3CNA v4.00.4%2026-06-12Fix
CVE-2026-54394MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files5.3CNA v4.00.4%2026-06-12Fix
CVE-2026-54393MISP Overmind theme stored XSS via unvalidated homepage setting5.1CNA v4.00.6%2026-06-12Fix
CVE-2026-54362MISP template builder exposes non-visible custom galaxies across organisations5.3CNA v4.00.4%2026-06-12Fix
CVE-2026-54361MISP handling of collections mass assignment8.8CNA v4.00.4%2026-06-12Fix
CVE-2026-54360MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups8.4CNA v4.00.4%2026-06-12Fix
CVE-2026-54359MISP automation endpoints cross-site request forgery7.1CNA v4.00.3%2026-06-12Fix
CVE-2026-54358MISP organization administrators can target site administrator accounts for password reset7.5CNA v4.00.4%2026-06-12Fix
CVE-2026-54357MISP An improper authorization5.1CNA v4.00.4%2026-06-12Fix
CVE-2026-54133Jmespath.php has CompilerRuntime code injection via unescaped function names9.8CNA v3.10.6%2026-06-12Fix
CVE-2026-54057Kitty vulnerable to command injection via unsanitized OSC 21 query reply7.3CNA v4.00.2%2026-06-12Fix
CVE-2026-54056Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging7.6CNA v3.10.4%2026-06-12Fix
CVE-2026-54055Kitty has an arbitrary file write via Symlink race condition in File Transmission protocol5.0CNA v3.10.1%2026-06-12Fix
CVE-2026-53982Capgo Cap-go Console Account Deletion DoS via Device Identifier Association7.1CNA v4.00.6%2026-06-12Fix
CVE-2026-53981Capgo Cap-go account takeover via Unauthenticated Email Change Mechanism7.2CNA v4.00.5%2026-06-12Fix
CVE-2026-53868Capgo denial of service via Unverified Email Account Registration and Deletion8.7CNA v4.00.5%2026-06-12Fix
CVE-2026-53867Capgo Orphaned File Retention via Profile Image Replacement5.3CNA v4.00.3%2026-06-12Fix
CVE-2026-53839OpenClaw Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validation6.0CNA v4.00.5%2026-06-12Fix
CVE-2026-53838OpenClaw Node Pairing State Mutation via Reconnection6.0CNA v4.00.4%2026-06-12Fix
CVE-2026-53837OpenClaw Missing Channel Type Validation in Mattermost Event Handlers5.3v3.10.3%2026-06-12Fix
CVE-2026-53836OpenClaw Allowlist Bypass via PowerShell Encoded-Command Aliases8.7CNA v4.00.8%2026-06-12Fix
CVE-2026-53835OpenClaw Config-Write Enforcement Bypass in Feishu Dynamic-Agent Bindings2.3CNA v4.00.3%2026-06-12Fix
CVE-2026-53834OpenClaw authorization bypass in QQBot Pre-dispatch Slash commands6.5NVD v3.10.3%2026-06-12Fix
CVE-2026-53833QQBot for OpenClaw authorization bypass via QQBot Streaming command6.5NVD v3.10.3%2026-06-12Fix
CVE-2026-53832OpenClaw Identity Header Forgery via Trusted-Proxy Configuration7.1v3.10.1%2026-06-12Fix
CVE-2026-53831OpenClaw arbitrary file read via Shell Expansion in system.run Safe-bin Allowlist8.1v3.10.3%2026-06-12Fix
CVE-2026-53830OpenClaw Webhook Secret Revocation Bypass via secrets.reload6.0CNA v4.00.4%2026-06-12Fix
CVE-2026-53829OpenClaw Command Truncation in Exec Approval Display8.5CNA v4.00.4%2026-06-12Fix
CVE-2026-53828OpenClaw Native command authorization bypass via Owner-Command Enforcement7.7CNA v4.00.5%2026-06-12Fix
CVE-2026-53827OpenClaw credential exposure via Model-Supplied Loopback URLs in message.action Forwarding6.0CNA v4.00.4%2026-06-12Fix
CVE-2026-53826OpenClaw information disclosure via Sandboxed Session Spawn2.3CNA v4.00.3%2026-06-12Fix
CVE-2026-53825OpenClaw arbitrary Local File Read via memory-wiki Ingest with operator.write Scope7.1CNA v4.00.6%2026-06-12Fix
CVE-2026-53824Mattermost plugin for OpenClaw Slash Token Revocation Lag via Monitor Refresh Delay6.0CNA v4.00.3%2026-06-12Fix
CVE-2026-53823OpenClaw privilege escalation via Mutable Slack Display Names in allowFrom8.6CNA v4.00.4%2026-06-12Fix
CVE-2026-53822OpenClaw command Argument Modification via Shell Wrapper Between Approval and Execution8.7CNA v4.02.0%2026-06-12Fix
CVE-2026-53821OpenClaw Scope Elevation in trusted-proxy Control UI WebSocket8.7CNA v4.00.5%2026-06-12Fix
CVE-2026-53820OpenClaw Exec Denylist Bypass in Bundle MCP Loopback Session Spawn6.9CNA v4.00.1%2026-06-12Fix
CVE-2026-53787Amasty Order Attributes for Magento 2 unauthenticated arbitrary file upload9.3CNA v4.06.5%2026-06-12NucleiExploit codeFix
CVE-2026-53726Parse Server relation query handler insecure direct object reference6.9CNA v4.00.5%2026-06-12Fix
CVE-2026-53725Parse Server login and verifyPassword endpoints information disclosure5.9CNA v4.00.4%2026-06-12Fix
CVE-2026-53724parse-community parse-server parse Server: Stored XSS2.1CNA v4.00.5%2026-06-12Fix
CVE-2026-53722Nuxt NuxtLink component reflected cross-site scripting5.1CNA v4.00.3%2026-06-12Fix
CVE-2026-53721Nuxt route-rule middleware vulnerability8.8CNA v4.00.5%2026-06-12Fix
CVE-2026-53609Apostrophe has Server-Side prototype pollution in apos.util.set9.1CNA v3.10.4%2026-06-12Fix
CVE-2026-53608@apostrophecms/seo vulnerable to stored XSS8.7CNA v3.10.4%2026-06-12Fix
CVE-2026-53607@apostrophecms/file pretty-URL vulnerable to unauthenticated SSRF via host header3.7CNA v3.10.3%2026-06-12Fix
CVE-2026-53606ApostropheCMS sanitize-html URI scheme validation cross-site scripting5.4CNA v3.10.2%2026-06-12Fix
CVE-2026-53568Frappe: Stored XSS in Frappe Report/List view via set_link_title_field_value6.9CNA v4.00.4%2026-06-12Fix
CVE-2026-53523Nezha Monitoring: OAuth2 Redirect URL host header injection6.8CNA v3.10.3%2026-06-12Fix
CVE-2026-53522Nezha Monitoring: Unbounded WebSocket Streams resource exhaustion DoS6.5CNA v3.10.4%2026-06-12Fix
CVE-2026-53521nezhahq Nezha Monitoring DDNS profile handling incorrect authorization6.4CNA v3.10.3%2026-06-12Fix
CVE-2026-53520nezhahq Nezha Monitoring dashboard host claiming improper access control6.5CNA v3.10.4%2026-06-12Fix
CVE-2026-53519Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key9.1CNA v3.12.3%2026-06-12NucleiExploit codeFix
CVE-2026-53408Zoom Communications Zoom Workplace handler for Custom URL Scheme improper authorization8.1CNA v3.10.4%2026-06-12Fix
CVE-2026-53407Zoom Communications Zoom Workplace handler for Custom URL Scheme improper authorization8.1CNA v3.10.4%2026-06-12Fix
CVE-2026-53406Zoom Remote Control for Zoom Contact Center privilege escalation7.8CNA v3.10.1%2026-06-12Fix
CVE-2026-50645Apache CXF: No restriction on attachment headers per message7.5v3.10.5%2026-06-12Fix
CVE-2026-50634Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry6.5CISA ADP v3.10.4%2026-06-12Fix
CVE-2026-50633Apache CXF: JNDI injection vulnerability in DispatchMDBMessageListenerImpl8.1CISA ADP v3.11.3%2026-06-12Fix
CVE-2026-50632Apache CXF: JNDI injection vulnerability in JMSConfigFactory8.1CISA ADP v3.11.1%2026-06-12Fix
CVE-2026-50631Apache CXF: OAuth2: TOCTOU race condition in Refresh Token Processing7.4CISA ADP v3.10.4%2026-06-12Fix
CVE-2026-50630Apache CXF: OAuth2: HTTP response splitting via WWW-Authenticate Realm injection6.5CISA ADP v3.10.6%2026-06-12Fix
CVE-2026-50629Apache CXF: OAuth2: Log injection via Unsanitized Client Identifier5.3CISA ADP v3.10.7%2026-06-12Fix
CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control9.8v3.10.7%2026-06-12Fix
CVE-2026-50627Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator9.1v3.10.4%2026-06-12Fix
CVE-2026-50623Apache CXF: Authentication bypass in OAuth2 TokenIntrospectionService4.8CISA ADP v3.10.5%2026-06-12Fix
CVE-2026-50560Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature6.9CNA v4.00.5%2026-06-12Fix
CVE-2026-50552Koel: Server-side request forgery (SSRF) in radio station creation due to missing validation bail6.3CNA v3.10.3%2026-06-12Fix
CVE-2026-50287Missing authentication for critical function in @agenticmail/mcp8.7CNA v4.00.5%2026-06-12Fix
CVE-2026-50244Naxclow IoT Platform missing authorization6.9CNA v4.00.3%2026-06-12
CVE-2026-50108Naxclow IoT Platform missing authorization8.7CNA v4.00.4%2026-06-12
CVE-2026-50101Naxclow IoT Platform Not using password aging9.2CNA v4.00.4%2026-06-12
CVE-2026-50099Naxclow IoT Platform insertion of sensitive information into externally-accessible file or directory5.1CNA v4.00.2%2026-06-12
CVE-2026-50091Aqara Home Android SDK hard-coded keys7.4NVD v3.10.4%2026-06-12
CVE-2026-50090Aqara OAuth redirect_uri validation bypass6.1NVD v3.10.4%2026-06-12
CVE-2026-50089Aqara IAM/SSO Gateway open redirect6.1CNA v3.10.3%2026-06-12
CVE-2026-50088Aqara Developer Portal cross-origin resource sharing4.7NVD v3.10.3%2026-06-12
CVE-2026-50087Aqara IAM/SSO Gateway cross-origin resource sharing6.1NVD v3.10.3%2026-06-12
CVE-2026-50086Aqara unauthenticated AES oracle9.8NVD v3.10.4%2026-06-12
CVE-2026-50085Aqara Board IoT insecure debug API9.8NVD v3.10.6%2026-06-12
CVE-2026-50084Aqara Cloud Production API missing authorization6.5NVD v3.10.4%2026-06-12
CVE-2026-50083Aqara hard-coded OAuth client credentials9.8NVD v3.10.5%2026-06-12
CVE-2026-50082Aqara Developer Portal insecure authentication token5.3NVD v3.10.4%2026-06-12
CVE-2026-50026Frappe: Lack of permissions checks in relink and set_email_password endpoints6.9CNA v4.00.4%2026-06-12Fix
CVE-2026-50020Netty HttpObjectDecoder request line parsing HTTP request smuggling5.3CNA v3.10.4%2026-06-12Fix
CVE-2026-50011Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length7.5CNA v3.10.8%2026-06-12Fix
CVE-2026-50010Netty's wrapping plain trust manager silently disables hostname verification7.5CNA v3.10.7%2026-06-12Fix
CVE-2026-50009Netty QUIC stateless reset token material exposed through header-visible connection IDs4.8CNA v3.10.3%2026-06-12Fix
CVE-2026-50008Parse Server batch endpoint route allow list incorrect authorization6.9CNA v4.00.6%2026-06-12Fix
CVE-2026-49993Nuxt webpack and rspack dev server vulnerability5.9CNA v4.00.3%2026-06-12Fix
CVE-2026-49875Apache CXF: XML external entity (XXE) injection in W3CMultiSchemaFactory and EndpointReferenceUtils9.8v3.10.5%2026-06-12Fix
CVE-2026-49482ClipBucket subtitle edit endpoint vulnerability4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-49397Nezha's private services are enumerable via per-server endpoints, leaking name and timing data5.3CNA v3.10.3%2026-06-12Fix
CVE-2026-49396Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents7.1CNA v3.10.2%2026-06-12Fix
CVE-2026-49347Quest Bot ticket creation resource exhaustion5.3CNA v4.00.4%2026-06-12Fix
CVE-2026-48914Red Hat Enterprise Linux 10 qemu-kvm: Heap buffer overflow in virtio-blk scsi request handling6.7CNA v3.10.2%2026-06-12Fix
CVE-2026-48748Netty HTTP/3 QPACK Blocked Streams memory exhaustion7.5CNA v3.10.7%2026-06-12Fix
CVE-2026-48613phpBB profile field migration SQL injection7.1CNA v3.00.3%2026-06-12
CVE-2026-48612phpBB cross-site request forgery8.0CNA v3.00.2%2026-06-12
CVE-2026-48611phpBB OAuth implementation improper authentication9.8CNA v3.02.9%2026-06-12NucleiExploit code
CVE-2026-48610Ubiquiti UDM improper access control8.1CNA v3.10.4%2026-06-12Fix
CVE-2026-48558SimpleHelp authentication bypass9.5CNA v4.05.7%2026-06-12KEVNucleiMetasploitExploit codeFix
CVE-2026-48485Quest Bot /warns command improper output encoding2.1CNA v4.00.4%2026-06-12Fix
CVE-2026-48165MariaDB: Unsafe usage of `wsrep_sst_receive_address` values on the joiner side8.0CNA v3.11.6%2026-06-12Fix
CVE-2026-48163MariaDB: Wsrep SST unsafe parameter handling on the donor side (rsync)8.0CNA v3.11.1%2026-06-12Fix
CVE-2026-48119Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services7.1CNA v3.10.4%2026-06-12Fix
CVE-2026-48059Netty HAProxy PROXY protocol TLV parsing memory leak8.7CNA v4.00.9%2026-06-12Fix
CVE-2026-48043Netty HTTP/2 decompressor frame listener memory leak5.3CNA v3.10.9%2026-06-12Fix
CVE-2026-48006Netty's lack of Lifecycle Cleanup leads to Pooled ByteBuf leak in RedisArrayAggregator8.7CNA v4.00.8%2026-06-12Fix
CVE-2026-47965Adobe Acrobat Reader out-of-bounds write7.8CNA v3.10.3%2026-06-12Fix
CVE-2026-47739Frappe: Stored XSS in Note6.9CNA v4.00.4%2026-06-12Fix
CVE-2026-47691Netty has Insufficient Bailiwick Validation for NS Records8.7CNA v3.10.4%2026-06-12Fix
CVE-2026-47370Ubiquiti UniFi OS Server improper input validation9.9CNA v3.11.4%2026-06-12Fix
CVE-2026-47369Ubiquiti UniFi OS Server improper input validation9.9CNA v3.10.5%2026-06-12Fix
CVE-2026-47368Ubiquiti UniFi OS Server path traversal8.6CNA v3.10.5%2026-06-12Fix
CVE-2026-47367Ubiquiti UID Enterprise Agent improper input validation9.9CNA v3.11.4%2026-06-12Fix
CVE-2026-47366phpBB privilege escalation7.2CNA v3.00.5%2026-06-12
CVE-2026-47365WebPros WordPress-Toolkit argument injection9.9CNA v3.10.7%2026-06-12Fix
CVE-2026-47268Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host6.4CNA v3.10.3%2026-06-12Fix
CVE-2026-47264Discourse tag info endpoint information disclosure5.3CNA v3.10.4%2026-06-12Fix
CVE-2026-47263Discourse webhook event redelivery information disclosure4.3CNA v3.10.4%2026-06-12Fix
CVE-2026-47260Koel vulnerable to SSRF via Podcast Episode Enclosure URLs7.7CNA v3.10.4%2026-06-12Fix
CVE-2026-47248Parse Server GraphQL validation error messages vulnerability6.9CNA v4.00.5%2026-06-12Fix
CVE-2026-47244Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced5.3CNA v3.10.5%2026-06-12Fix
CVE-2026-47236Solidtime team page vulnerability4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-47225Improper Search Cache Isolation for Scoped Search API Keys in Typesense6.0CNA v4.00.4%2026-06-12Fix
CVE-2026-47224NanaZip: Heap buffer-overflow read in NanaZip LVM metadata CRC check4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-47223NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser5.4CNA v3.10.3%2026-06-12Fix
CVE-2026-47222NanaZip: Heap out-of-bounds read in NanaZip AVB property descriptor parser5.4CNA v3.10.3%2026-06-12Fix
CVE-2026-47216Typesense: Unauthenticated denial of service in the Typesense /multi_search endpoint8.7CNA v4.00.5%2026-06-12Fix
CVE-2026-47210vm2 sandbox escape via JSPI-backed Promise `.finally` species bypass9.8CNA v3.10.8%2026-06-12Fix
CVE-2026-47209Vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection8.6CNA v3.10.5%2026-06-12Fix
CVE-2026-47208vm2 is vulnerable to Sandbox Breakout through Promise Species10.0CNA v3.10.8%2026-06-12Fix
CVE-2026-47200Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`6.3CNA v4.00.3%2026-06-12Fix
CVE-2026-47197duck-organization Quest Bot moderation commands missing authorization7.2CNA v4.00.4%2026-06-12Fix
CVE-2026-47196duck-organization quest-bot quest Bot: Empty automod rule causes every guild message to be deleted8.4CNA v4.00.4%2026-06-12Fix
CVE-2026-47195duck-organization Quest Bot purge and slowmode commands incorrect authorization7.1CNA v4.00.4%2026-06-12Fix
CVE-2026-47190Metal3 IP Address Manager controller service account vulnerability4.4CNA v3.10.4%2026-06-12Fix
CVE-2026-47182Frappe: Broken access control on Private files5.3CNA v4.00.4%2026-06-12Fix
CVE-2026-47141patriksimek vm2 NodeVM observability builtins leak host process and HTTP request data6.9CNA v4.00.5%2026-06-12Fix
CVE-2026-47140patriksimek vm2 NodeVM builtin denylist protection mechanism failure10.0CNA v3.10.8%2026-06-12Fix
CVE-2026-47139patriksimek vm2 NodeVM network builtin exclusions bypass via internal _http_client and _http_server8.6CNA v3.10.5%2026-06-12Fix
CVE-2026-47138parse-community parse-server parse Server: Pre-authentication denial of service8.7CNA v4.00.9%2026-06-12Fix
CVE-2026-47137vm2 has a patch bypass: Nesting:true without explicit require still allows full RCE10.0CNA v3.10.7%2026-06-12Fix
CVE-2026-47135vm2 has a sandbox escape8.7CNA v3.10.4%2026-06-12Fix
CVE-2026-47131vm2 has a sandbox escape issue10.0CNA v3.10.6%2026-06-12Fix
CVE-2026-47124Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members6.5CNA v3.10.4%2026-06-12Fix
CVE-2026-47120Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks7.1CNA v3.10.4%2026-06-12Fix
CVE-2026-46717Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection7.7CNA v3.10.4%2026-06-12Fix
CVE-2026-46716Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /API/v1/cron9.9CNA v3.10.5%2026-06-12Fix
CVE-2026-46690spearman unbounded-spsc queue sender out-of-bounds read5.8CNA v3.10.1%2026-06-12
CVE-2026-46342Nuxt nuxt island renderer cache poisoning2.3CNA v4.00.1%2026-06-12Fix
CVE-2026-46340Netty: SCTP reassembly nests buffers without bound7.5CNA v3.10.8%2026-06-12Fix
CVE-2026-45833ChromaDB has a code injection8.8NVD v3.10.6%2026-06-12Exploit code
CVE-2026-45832ChromaDB insecure direct object reference8.8NVD v3.10.5%2026-06-12
CVE-2026-45831ChromaDB incorrect authorization8.8NVD v3.10.4%2026-06-12
CVE-2026-45830ChromaDB insecure direct object reference8.8NVD v3.10.5%2026-06-12
CVE-2026-45775Discourse: Cross-site backup access via path traversal in multisite local backups6.8CNA v3.10.5%2026-06-12Fix
CVE-2026-45674Netty vulnerable to DNS cache poisoning via Missing Bailiwick Checks in CNAME Records8.7CNA v3.10.3%2026-06-12Fix
CVE-2026-45673Netty: DNS cache poisoning due to Predictable PRNG and Default Static Source Port6.8CNA v3.10.4%2026-06-12Fix
CVE-2026-45670Nuxt: Dev server exposes built source over LAN to malicious sites5.9CNA v4.00.4%2026-06-12Fix
CVE-2026-45669Nuxt: Reflected XSS in `navigateTo` external redirect5.3CNA v4.00.3%2026-06-12Fix
CVE-2026-45536Netty: Unix-socket fd receive leaks descriptors when peer sends two at once4.0CNA v3.10.2%2026-06-12Fix
CVE-2026-45416Netty: SNI handler pre-allocates MiB from nine attacker bytes7.5CNA v3.11.6%2026-06-12Fix
CVE-2026-45170CyberArk Software, a Palo Alto Networks Vendor PAM improper certificate validation7.5CNA v4.00.2%2026-06-12Fix
CVE-2026-45169CyberArk Software, a Palo Alto Networks PAM SH Vault denial of service8.7CNA v4.00.6%2026-06-12Fix
CVE-2026-45085Discourse: Chat misauthorization and information disclosure5.3CNA v3.10.4%2026-06-12Fix
CVE-2026-45014Apostrophe vulnerable to stored cross-site scripting5.3CNA v4.00.4%2026-06-12
CVE-2026-45013ApostropheCMS Apostrophe password reset flow vulnerability8.1CNA v3.10.4%2026-06-12
CVE-2026-45012Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget7.6CNA v3.10.3%2026-06-12
CVE-2026-45011Apostrophe has stored XSS via javascript: URL in Image Widget Link7.3CNA v3.10.4%2026-06-12
CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`9.3CNA v3.10.7%2026-06-12Fix
CVE-2026-44976Frappe: IDOR in update_onboarding_step5.3CNA v4.00.4%2026-06-12Fix
CVE-2026-44975Frappe: Missing authorization on reset form tours5.3CNA v4.00.4%2026-06-12Fix
CVE-2026-44967opentelemetry-cpp OTLP HTTP exporter memory exhaustion5.3CNA v3.10.3%2026-06-12Fix
CVE-2026-44894Netty's Default QUIC token handler accepts any client-supplied token7.5CNA v3.10.2%2026-06-12Fix
CVE-2026-44893Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length7.5CNA v3.10.9%2026-06-12Fix
CVE-2026-44892Netty has a vulnerable Default Configuration which leads to denial of service7.5CNA v3.10.5%2026-06-12Fix
CVE-2026-44786Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users7.5CNA v3.10.4%2026-06-12Fix
CVE-2026-44785Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-44784Discourse: Non-staff group owners can see email password in plaintext through group history6.5CNA v3.10.4%2026-06-12Fix
CVE-2026-44783Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts5.4CNA v3.10.2%2026-06-12Fix
CVE-2026-44782Discourse: GroupPostSerializer leaks hidden full names through reaction post association4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-44780Discourse: Category queue reviewers can read raw incoming emails from queued posts4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-44779Discourse: Bot debug endpoints disclose whisper translation audit logs4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-44208Frappe: IDOR in `submit_discussion`6.9CNA v4.00.4%2026-06-12Fix
CVE-2026-44207Frappe: Insecure direct object reference for email accounts6.9CNA v4.00.4%2026-06-12Fix
CVE-2026-44206Frappe: DB Schema Enumeration via Frappe-Authorization-Source6.9CNA v4.00.4%2026-06-12Fix
CVE-2026-44205Frappe: Stored cross-site scripting (XSS) in User Profile through Image upload6.9CNA v4.00.4%2026-06-12Fix
CVE-2026-44173MariaDB: File privilege was not checked for subqueries in the FROM clause5.0CNA v3.10.8%2026-06-12Fix
CVE-2026-44172MariaDB: Mysql_real_escape_string incorrectly handled big56.9CNA v4.01.0%2026-06-12Fix
CVE-2026-44171MariaDB: Path traversal in mbstream6.3CNA v3.10.2%2026-06-12Fix
CVE-2026-44170MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL6.3CNA v4.01.7%2026-06-12Fix
CVE-2026-44169MariaDB Server stored routine privilege check incorrect authorization4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-44168MariaDB: Wsrep SST unsafe parameter handling on the donor side8.0CNA v3.11.0%2026-06-12Fix
CVE-2026-43872actualbudget actual actual-server has a path traversal5.3CNA v4.00.5%2026-06-12Fix
CVE-2026-42947Naxclow IoT Platform authorization bypass through user-controlled key8.7CNA v4.00.4%2026-06-12
CVE-2026-42932Naxclow IoT Platform generation of predictable numbers or identifiers6.9CNA v4.00.3%2026-06-12
CVE-2026-42890actual allows Electron to Run as Node4.8CNA v4.00.2%2026-06-12Fix
CVE-2026-42853@apostrophecms/cli: Command injection in apos create via Unsanitized Password Input6.5CNA v3.10.6%2026-06-12
CVE-2026-42851kovidgoyal kitty @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE7.8CNA v3.10.2%2026-06-12Fix
CVE-2026-42850Kitty has a shell command injection7.4CNA v4.00.4%2026-06-12Fix
CVE-2026-42604Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`6.9CNA v4.00.6%2026-06-12Fix
CVE-2026-42306Moby: Race condition in Docker cp allows bind mount redirection to host path7.2CNA v3.10.1%2026-06-12Fix
CVE-2026-41581Frappe vulnerable to possible SQL injection via get_blog_list6.9CNA v4.00.4%2026-06-12Fix
CVE-2026-41568Moby: Race condition in Docker cp allows creation of arbitrary empty files on the host6.1CNA v3.10.1%2026-06-12Fix
CVE-2026-41158GPU DDK Backed sparse PMRs are not handled by deferred free mechanism after shrink7.8CISA ADP v3.10.2%2026-06-12Fix
CVE-2026-41157GPU DDK OOB write in CalculateNPOTTwiddleSparsePageMap3D9.8CISA ADP v3.10.5%2026-06-12Fix
CVE-2026-41155GPU DDK SharedSecMem mapped into all GPU virtual address spaces5.5CISA ADP v3.10.1%2026-06-12
CVE-2026-40677AMD Management Console (AMC) man-in-the-middle7.7CNA v4.00.5%2026-06-12
CVE-2026-34195Imagination Technologies Graphics DDK sparse memory allocation out-of-bounds write8.8CISA ADP v3.10.5%2026-06-12Fix
CVE-2026-28742Naxclow IoT Platform use of hard-coded cryptographic key9.2CNA v4.00.5%2026-06-12
CVE-2026-24618Hash Elements WordPress plugin sensitive data exposure4.3CNA v3.10.2%2026-06-12Fix
CVE-2026-20746PingDirectory copying of virtual attributes leads to memory exhaustion6.3CNA v4.00.3%2026-06-12Fix
CVE-2026-12143form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)8.7CNA v4.00.7%2026-06-12Fix
CVE-2026-12131CodeAstro Human Resource Management System Payroll Invoice Payroll.php SQL injection5.3CNA v4.00.3%2026-06-12
CVE-2026-12130CodeAstro Human Resource Management System Projects Management Add_Projects cross-site scripting5.1CNA v4.00.2%2026-06-12
CVE-2026-12129CodeAstro Human Resource Management System Dashboard add_tod cross-site scripting5.1CNA v4.00.2%2026-06-12
CVE-2026-12068Avira Password Manager credential disclosure via cross-origin autofill in Firefox7.4CNA v3.10.3%2026-06-12
CVE-2026-12066PbootCMS Password MemberController.php retrieve password recovery6.9CNA v4.00.3%2026-06-12
CVE-2026-12065Groww Stock improper authorization1.0CNA v4.00.1%2026-06-12
CVE-2026-12060Hepta Platforms Heptabase exposed dangerous method6.9CNA v4.00.3%2026-06-12Fix
CVE-2026-12059Cellopoint｜CelloOS improper access control8.7CNA v4.00.5%2026-06-12Fix
CVE-2026-12058vivo PcSuite reliance on untrusted input in a security decision5.3CNA v4.00.2%2026-06-12
CVE-2026-12043Heap double free in AWS Common Runtime aws-c-http8.7CNA v4.00.4%2026-06-12Fix
CVE-2026-11967Arbitrary code execution in MobaXterm Personal Edition (Portable)8.5CNA v4.00.1%2026-06-12Fix
CVE-2026-11933MongoDB post-authentication use-after-free in server-side JavaScript BSON-to-array conversion8.7CNA v4.00.4%2026-06-12Fix
CVE-2026-11879Arbitrary code execution in MobaXterm Personal Edition (Portable)8.5CNA v4.00.1%2026-06-12Fix
CVE-2026-11849IEI Integration Corp｜iRM-IEI Remote Management hard-coded credentials9.3CNA v4.00.4%2026-06-12Fix
CVE-2026-11848IEI Integration Corp｜ iRM-IEI Remote Management missing authentication7.9CNA v4.00.3%2026-06-12Fix
CVE-2026-11847Integration Corp｜iVEC-IEI Virtualization Edge Computer arbitrary file deletion5.3CNA v4.00.3%2026-06-12Fix
CVE-2026-11846IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer arbitrary file deletion7.2CNA v4.00.4%2026-06-12Fix
CVE-2026-11845IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer OS command injection8.6CNA v4.01.0%2026-06-12Fix
CVE-2026-11844IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer arbitrary file read6.9CNA v4.00.4%2026-06-12Fix
CVE-2026-11535vivo PcSuite An unauthorized access9.4CNA v4.00.2%2026-06-12
CVE-2026-10715camaleon_cms camaleon CMS improper authorization in draft autosave endpoint5.1CNA v4.00.2%2026-06-12
CVE-2026-10557Yarbo Android/iOS Mobile application and Cloud Infrastructure use of hard-coded credentials9.3CNA v4.00.4%2026-06-12Fix
CVE-2026-9641Crypt::PBKDF2 versions for Perl have a weak default algorithm and number of iterations5.3CISA ADP v3.10.3%2026-06-12Fix
CVE-2026-9638Crypt::PBKDF2 versions for Perl generate insecure random values for salts7.5CISA ADP v3.10.5%2026-06-12Fix
CVE-2026-9271KeepInMind - Dashboard Notes WordPress plugin Contributor+ stored XSS5.9CISA ADP v3.10.6%2026-06-12Exploit codeFix
CVE-2026-9269Secure Copy Content Protection and Content Locking WordPress plugin stored XSS3.5CISA ADP v3.10.2%2026-06-12Fix
CVE-2026-9266Moxa UC-1200A Series missing cryptographic step7.0CNA v4.00.1%2026-06-12Fix
CVE-2026-9125The Ultimate Video Player For WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-06-12Fix
CVE-2026-8828ChromaDB insecure direct object reference8.8CNA v4.00.4%2026-06-12
CVE-2026-8694Improper access control on the API documentation endpoint in PowerShell Universal5.3CISA ADP v3.10.4%2026-06-12Fix
CVE-2026-7387Mattermost group syncable endpoints allow privilege escalation via scheme_admin8.8CNA v3.10.4%2026-06-12Fix
CVE-2026-7368Yarbo Android/iOS Mobile application and Cloud Infrastructure missing authorization8.6CNA v4.00.4%2026-06-12Fix
CVE-2026-7184Mattermost Remote Cluster PATCH API leaks authentication tokens6.5CNA v3.10.4%2026-06-12Fix
CVE-2026-6961Path traversal via unsanitized FileInfo.Name in Mattermost federation sync7.6CNA v3.10.5%2026-06-12Fix
CVE-2026-6853OTP Bypass in Başbelen Group's Pause+ Mobile App9.8CNA v3.10.6%2026-06-12Fix
CVE-2026-6739Mattermost: Delegated admins could patch protected default system roles6.7CNA v3.10.5%2026-06-12Fix
CVE-2026-6689Mattermost Server team creation missing authorization4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-6676Avira Antivirus engine heap buffer OOB write when scanning a malformed POSIX tar archive7.8CNA v3.10.2%2026-06-12Fix
CVE-2026-6211Arbitrary file upload in Global IT's WEOLL8.7CNA v3.10.4%2026-06-12Fix
CVE-2026-6046Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server5.3CNA v3.10.3%2026-06-12Fix
CVE-2026-5792Authentication bypass in Hedef Media's Related Marketing Cloud (RMC)6.5CNA v3.10.4%2026-06-12
CVE-2026-4870IBM Qiskit SDK classical expression parser uncontrolled recursion7.5CNA v3.10.5%2026-06-12Fix
CVE-2026-3840Path traversal in kedro-org/kedro7.1CNA v3.00.2%2026-06-12
CVE-2026-3433Mattermost fails to scope role_updated websocket events to authorized team and channel members4.3CNA v3.10.3%2026-06-12Fix
CVE-2026-1836Redmine login form recoverable password storage5.3CNA v4.00.1%2026-06-12Fix
CVE-2026-53912Cerebrate self-registration password hash exposure via inbox and audit log views5.1CNA v4.00.4%2026-06-11Fix
CVE-2026-53911Cerebrate CRUD edit endpoint insecure direct object reference6.3CNA v4.00.4%2026-06-11Fix
CVE-2026-53901Cerebrate allows mass assignment of record identifiers during object creation8.7CNA v4.00.4%2026-06-11Fix
CVE-2026-53819OpenClaw arbitrary Homebrew Executable Execution via Workspace .env Override7.8v3.10.4%2026-06-11Fix
CVE-2026-53818OpenClaw Owner-Only Tool Policy Bypass via MCP Loopback6.9CNA v4.00.1%2026-06-11Fix
CVE-2026-53817OpenClaw Control UI Locality spoofing in Device Pairing8.7CNA v4.00.4%2026-06-11Fix
CVE-2026-53816OpenClaw Exec Lifecycle Event Forgery via Paired Node8.6CNA v4.00.5%2026-06-11Fix
CVE-2026-53815OpenClaw Channel Allowlist Bypass in Message Read Actions7.1CNA v4.00.4%2026-06-11Fix
CVE-2026-53814OpenClaw privilege escalation via Hook-Triggered CLI MCP Tool Authority8.7CNA v4.00.4%2026-06-11Fix
CVE-2026-53813OpenClaw arbitrary Artifact Loading via Fake Package Root Resolution7.3CNA v4.00.2%2026-06-11Fix
CVE-2026-53812OpenClaw Private-Network Navigation Bypass via Browser Act Interactions4.9CNA v4.00.4%2026-06-11Fix
CVE-2026-53811OpenClaw privilege escalation via Mutable Display Names in Matrix allowFrom7.7CNA v4.00.4%2026-06-11Fix
CVE-2026-53810OpenClaw arbitrary code execution via Unscanned Marketplace Runtime Extension Metadata7.7CNA v4.00.6%2026-06-11Fix
CVE-2026-53809OpenClaw Provider Alias Confusion in Embedded Runner Policy4.8CNA v4.00.1%2026-06-11Fix
CVE-2026-53808OpenClaw Approval Policy Bypass in Skill Workshop Apply Flow6.0CNA v4.00.3%2026-06-11Fix
CVE-2026-53807OpenClaw authorization bypass in Telegram Interactive Callbacks via commands.allowFrom7.7CNA v4.00.5%2026-06-11Fix
CVE-2026-53806OpenClaw Shell Option Parsing Bypass in Exec Revalidation7.7CNA v4.00.6%2026-06-11Fix
CVE-2026-53782Summarize SSRF via podcast:transcript URL fetch6.3CNA v4.00.5%2026-06-11Fix
CVE-2026-53781Summarize Disk Exhaustion via Uncapped Media Download5.3CNA v4.00.6%2026-06-11Fix
CVE-2026-53777Perry path traversal via ArtifactReady WebSocket8.6CNA v4.00.5%2026-06-11Fix
CVE-2026-53723Guzzlehttp/guzzle-services' XML Request Serialization vulnerable to XML injection5.8CNA v3.10.3%2026-06-11Fix
CVE-2026-53702Red Hat Enterprise Linux 10 GStreamer H.265 codec parser library stack-based buffer overflow6.5CNA v3.10.4%2026-06-11Fix
CVE-2026-53701GStreamer H.266/VVC PPS parser out-of-bounds write6.5CNA v3.10.4%2026-06-11Fix
CVE-2026-53661boruta-server sent sensitive session cookies without the Secure attribute8.8CNA v4.00.3%2026-06-11Fix
CVE-2026-53423Unauthenticated denial of service via BEAM atom table exhaustion in membrane_mp4_plugin5.9CNA v4.00.2%2026-06-11Fix
CVE-2026-52860Vim: Arbitrary code execution via Python Omni-Completion7.5CNA v4.00.4%2026-06-11Fix
CVE-2026-52859Vim: Out-of-bounds read in Terminal Screen Snapshot6.9CNA v4.00.6%2026-06-11Fix
CVE-2026-52858Vim: Arbitrary code execution via Python Omni-Completion7.3CNA v4.00.2%2026-06-11Fix
CVE-2026-50245Brickcom Cameras missing authentication for critical function8.3CNA v4.00.2%2026-06-11
CVE-2026-50005Brickcom Cameras use of default credentials8.3CNA v4.00.3%2026-06-11
CVE-2026-49982Tmp: Type-confusion bypass of _assertPath in Tmp@ allows path traversal8.2CNA v3.10.6%2026-06-11Fix
CVE-2026-49973nesquena hermes-webui hermes WebUI unauthenticated password takeover via /API/settings9.2CNA v4.00.7%2026-06-11Fix
CVE-2026-49949CodexBar credential leakage via HTTP Redirect6.0CNA v4.00.4%2026-06-11Fix
CVE-2026-49261MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`10.0CNA v3.11.7%2026-06-11Fix
CVE-2026-49214Guzzlehttp/psr7 has CRLF injection via URI host component5.3CNA v3.10.3%2026-06-11Fix
CVE-2026-49060Hippoo Mobile App for WooCommerce WordPress plugin privilege escalation9.8CNA v3.11.6%2026-06-11NucleiFix
CVE-2026-48998Guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation5.3CNA v3.10.3%2026-06-11Fix
CVE-2026-48547lingdojo kana-dojo KanaDojo command injection via patchNotesData.json in release.yml8.5CNA v4.01.4%2026-06-11Fix
CVE-2026-48546lingdojo kana-dojo KanaDojo sandbox escape RCE via messages.cjs8.5CNA v4.00.7%2026-06-11Fix
CVE-2026-47250mcp-server-kubernetes kubectl_generic tool argument injection6.1CNA v3.10.3%2026-06-11Fix
CVE-2026-47238MacWarrior clipbucket-v5 ClipBucket: IDOR in videos subtitle editor6.5CNA v3.10.3%2026-06-11Fix
CVE-2026-47189duck-organization Quest Bot AutoMod rule removal insecure direct object reference8.3CNA v4.00.4%2026-06-11Fix
CVE-2026-47188duck-organization Quest Bot unban and unwarn commands improper output encoding2.3CNA v4.00.4%2026-06-11Fix
CVE-2026-47181PenguinMod-BackendApi: NoSQL injection in Password Reset endpoint allows account takeover8.7CNA v4.00.3%2026-06-11Fix
CVE-2026-47177duck-organization Quest Bot ticket transcript export information disclosure5.7CNA v4.00.4%2026-06-11Fix
CVE-2026-47176duck-organization Quest Bot logging module information disclosure5.7CNA v4.00.4%2026-06-11Fix
CVE-2026-47175duck-organization Quest Bot moderation reason fields improper output encoding2.3CNA v4.00.4%2026-06-11Fix
CVE-2026-47174duck-organization Duck Site deployment workflow inclusion of untrusted functionality9.5CNA v4.00.4%2026-06-11Fix
CVE-2026-47173duck-organization Quest Bot ticket reason field improper output encoding6.3CNA v4.00.4%2026-06-11Fix
CVE-2026-47172duck-organization Quest Bot deployment workflow inclusion of untrusted functionality9.5CNA v4.00.4%2026-06-11Exploit codeFix
CVE-2026-47171duck-organization Quest Bot reminder messages improper output encoding8.8CNA v4.00.4%2026-06-11Fix
CVE-2026-47170Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint7.7CNA v3.10.4%2026-06-11Fix
CVE-2026-47169duck-organization Quest Bot AutoRole feature vulnerability7.5CNA v4.00.4%2026-06-11Fix
CVE-2026-47167Vim: Vimscript code injection in cucumber filetype plugin via crafted step-definition regex5.1CNA v4.00.1%2026-06-11Fix
CVE-2026-47163duck-organization quest-bot quest Bot: Unprivileged users can create and remove AutoMod rules7.2CNA v4.00.4%2026-06-11Fix
CVE-2026-47162Vim: Vimscript code injection in netrw NetrwBookHistSave via crafted directory name7.3CNA v4.00.3%2026-06-11Fix
CVE-2026-47157subzeroid aiograpi signup challenge path handling server-side request forgery6.5CNA v3.10.3%2026-06-11Fix
CVE-2026-46698stefanbohacek fediverse-embeds-wordpress-plugin Fediverse Embeds: Public-nonce SSRF5.3CNA v3.10.4%2026-06-11Fix
CVE-2026-46697stefanbohacek fediverse-embeds-wordpress-plugin fediverse Embeds: Unauthenticated SSRF / open proxy7.5CNA v3.10.4%2026-06-11Fix
CVE-2026-46622SolidInvoice API token records vulnerability8.1CNA v3.10.3%2026-06-11Fix
CVE-2026-46519mcp-server-kubernetes tool access control incorrect authorization8.8CNA v3.10.6%2026-06-11Fix
CVE-2026-46489SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS8.1CNA v3.10.4%2026-06-11Fix
CVE-2026-45802FPDI: Memory exhaustion and endless loop in FPDI leads to denial of service6.0CNA v4.00.5%2026-06-11Fix
CVE-2026-45418MacWarrior clipbucket-v5 ClipBucket: Blind SQL injection in subtitle_edit.php8.8CNA v3.10.4%2026-06-11Fix
CVE-2026-45178Idira Secrets Manager Self-Hosted: Improper access control in Internal Cluster endpoints8.4CNA v4.00.5%2026-06-11Fix
CVE-2026-45177Idira Secrets Manager SaaS Edge: Authentication bypass of an internal validation mechanism9.1CNA v4.00.7%2026-06-11Fix
CVE-2026-45176Idira Endpoint Privilege Manager Agent: Local privilege escalation8.9CNA v4.00.2%2026-06-11Fix
CVE-2026-45175Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation processes. A local attacker could potentially bypass built-in security controls or cryptographic validations. Under specific circumstances, this could allow the attacker to8.5CNA v4.00.2%2026-06-11Fix
CVE-2026-45174Idira Endpoint Privilege Manager Linux Agent: Potential bypass of agent Daemon Initialization8.5CNA v4.00.2%2026-06-11Fix
CVE-2026-45173Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation failure8.4CNA v4.00.2%2026-06-11Fix
CVE-2026-45172Idira Privileged Session Manager for SSH: Arbitrary command execution8.7CNA v4.00.8%2026-06-11Fix
CVE-2026-45171Idira Privileged Session Manager: Potential code execution due to an Incomplete Input Validation8.7CNA v4.00.7%2026-06-11Fix
CVE-2026-45060MacWarrior clipbucket-v5 ClipBucket: Blind SQL injection in progress_video.php9.8CNA v3.10.5%2026-06-11Fix
CVE-2026-44890Netty has Unbounded Direct Memory Consumption in its RedisDecoder7.5CNA v3.10.8%2026-06-11Fix
CVE-2026-44705Tmp: Path traversal via unsanitized prefix/postfix enables directory escape7.7CNA v4.00.5%2026-06-11Fix
CVE-2026-44496Axios: Regular expression denial of service (ReDoS) via Cookie Name injection7.5CNA v3.11.0%2026-06-11Fix
CVE-2026-44495Axios: Credential Theft and Response Hijacking via prototype pollution Gadget in Config Merge7.0CNA v3.11.0%2026-06-11Fix
CVE-2026-44494Axios: Full man-in-the-middle via prototype pollution Gadget in `config.proxy`8.7CNA v3.10.9%2026-06-11Fix
CVE-2026-44492Axios: ShouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass8.6CNA v3.10.8%2026-06-11Fix
CVE-2026-44490Axios: DoS and header injection via prototype pollution Read-Side Gadgets in axios merge functions4.8CNA v3.10.4%2026-06-11Fix
CVE-2026-44489Axios: Proxy-authorization header injection via prototype pollution Incomplete Null-Prototype Fix3.7CNA v3.10.3%2026-06-11Fix
CVE-2026-44488Axios: Allocation of resources without limits or throttling in axios7.5CNA v3.10.9%2026-06-11Fix
CVE-2026-44487Axios Node.js HTTP adapter information disclosure8.2CNA v4.00.8%2026-06-11Fix
CVE-2026-44486Axios Node.js HTTP adapter information disclosure7.5CNA v3.10.8%2026-06-11Fix
CVE-2026-44250Netty: Memory exhaustion in RedisArrayAggregator due to Deeply Nested Arrays7.5CNA v3.10.8%2026-06-11Fix
CVE-2026-44249Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking8.1CNA v3.11.3%2026-06-11Fix
CVE-2026-42846MacWarrior clipbucket-v5 ClipBucket: Remote Play URL command injection9.8CNA v3.10.9%2026-06-11Fix
CVE-2026-42653SliceWP WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-11Fix
CVE-2026-42647JoomSport WordPress plugin SQL injection9.3CNA v3.11.3%2026-06-11NucleiFix
CVE-2026-41856VMware Spring for GraphQL controller annotation detection improper access control7.5CNA v3.10.4%2026-06-11Fix
CVE-2026-41700Cross-Site WebSocket Hijacking in Spring for GraphQL8.1CNA v3.10.2%2026-06-11Fix
CVE-2026-41699Unsafe deserialization in Spring GraphQL8.1CNA v3.10.7%2026-06-11Fix
CVE-2026-41005UAA accepts SAML Encrypted Assertions authentication bypass9.0CNA v3.10.2%2026-06-11
CVE-2026-41001Spring Boot Predictable Temp Directory in Artemis Auto-configuration5.3CNA v3.10.1%2026-06-11Fix
CVE-2026-41000Spring Web Services WSS4J validation does not use configured replay cache3.7CNA v3.10.3%2026-06-11Fix
CVE-2026-40999Spring WS SSRF via unvalidated WS-Addressing reply destinations8.6CNA v3.10.4%2026-06-11Fix
CVE-2026-40998Spring Web Services jaxp13 XPath XXE via StreamSource and SAXSource8.2CNA v3.10.4%2026-06-11Fix
CVE-2026-40997SOAP security faults leak Spring Security account state5.3CNA v3.10.5%2026-06-11Fix
CVE-2026-40996Spring Web Services inbound WS-Security allows RSA PKCS#1 key transport by default4.8CNA v3.10.1%2026-06-11Fix
CVE-2026-40995X.509 authentication bypasses Spring Security account checks5.4CNA v3.10.2%2026-06-11Fix
CVE-2026-40994Spring Web Services Wss4jSecurityInterceptor disables WS-I BSP validation by default8.2CNA v3.10.3%2026-06-11Fix
CVE-2026-40992Spring Boot Mail Auto-Configuration Does not Enable SSL Hostname Verification5.0CNA v3.10.2%2026-06-11Fix
CVE-2026-40987VMware Spring Integration remote file synchronizer path traversal7.1CNA v3.10.3%2026-06-11Exploit codeFix
CVE-2026-40986Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML4.8CNA v3.10.3%2026-06-11Fix
CVE-2026-40985Data Binding vulnerability in Spring Web Flow with Unified EL parser6.4CNA v3.10.3%2026-06-11Fix
CVE-2026-39494Product Filter by WBW WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-11Fix
CVE-2026-38581damasac thaipalliative_lte SQL injection9.8CISA ADP v3.10.6%2026-06-11
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools missing authentication for critical function9.8CNA v3.196.7%2026-06-11KEVNucleiExploit codeFix
CVE-2026-12035Google Chrome Views use-after-free8.8CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12034Google Chrome sandbox escape8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12033Google Chrome VideoCapture out-of-bounds read5.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12032Google Chrome Passwords inappropriate implementation3.1CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12031Google Chrome Views inappropriate implementation8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12030Google Chrome GPU out-of-bounds write8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12029Google Chrome Video use-after-free8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12028Google Chrome GPU use-after-free8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12027Google Chrome Headless inappropriate implementation9.6CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12026Google Chrome Video out-of-bounds read6.5v3.10.2%2026-06-11Fix
CVE-2026-12025Google Chrome improper input validation5.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12024Google Chrome DevTools insufficient policy enforcement6.5CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12023Google Chrome GPU use-after-free8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12022Google Chrome race condition8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12020Google Chrome Autofill use-after-free8.8CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12019Google ChromeOS heap-based buffer overflow8.3CISA ADP v3.10.3%2026-06-11Fix
CVE-2026-12018Google Chrome Mojo inappropriate implementation8.8CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12017Google Chrome extensions inappropriate implementation3.1CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12016Google Chrome DevTools inappropriate implementation8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12015Google Chrome Autofill use-after-free5.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12014Google Chrome Cast use-after-free8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12012Google Chrome Network use-after-free8.1CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12011Google Chrome WebMIDI use-after-free8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12010Google Chrome GPU heap-based buffer overflow8.3CISA ADP v3.10.3%2026-06-11Fix
CVE-2026-12009Google Chrome sandbox escape8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12008Google Chrome DigitalCredentials use-after-free8.3CISA ADP v3.10.2%2026-06-11Fix
CVE-2026-12007Google Chrome Core use-after-free8.8CISA ADP v3.10.3%2026-06-11Fix
CVE-2026-11986Red Hat Keycloak admin UI extension bulk role mapping deletion authorization bypass4.9CNA v3.10.3%2026-06-11Fix
CVE-2026-11956TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute6.3CNA v4.00.2%2026-06-11
CVE-2026-11945PostgreSQL Anonymizer: SQL injection in the rules import functions6.4CNA v3.10.2%2026-06-11Fix
CVE-2026-11850Red Hat Hardened Images integer underflow5.0CNA v3.10.3%2026-06-11Fix
CVE-2026-11839Arbitrary file upload in Basarsoft's Rotaban9.9CNA v3.10.3%2026-06-11Fix
CVE-2026-11816Path traversal in keras-team/Keras8.1CNA v3.00.6%2026-06-11Fix
CVE-2026-11774Red Hat Directory Server SASL I/O layer of integer overflow7.6CNA v3.10.7%2026-06-11Fix
CVE-2026-11561SSTI in Soagen Informatics' Apinizer9.8CNA v3.10.4%2026-06-11Fix
CVE-2026-10847Local privilege escalation vulnerability in Check Point Identity Agent Full for Windows OS7.8CNA v3.10.1%2026-06-11Fix
CVE-2026-10795UpdraftPlus: WP Backup and Migration WordPress plugin unauthenticated authentication bypass8.1CNA v3.13.6%2026-06-11NucleiExploit codeFix
CVE-2026-10733Improper restriction of rendered UI layers or frames in GitLab4.3CNA v3.10.2%2026-06-11Fix
CVE-2026-10087Improper neutralization of input during web page generation (cross-site scripting) in GitLab8.7CNA v3.10.3%2026-06-11Fix
CVE-2026-9694Improper neutralization of Substitution Characters in GitLab2.6CNA v3.10.3%2026-06-11Fix
CVE-2026-9648The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonat9.1CISA ADP v3.10.3%2026-06-11Fix
CVE-2026-9204Server-side request forgery (SSRF) in GitLab5.3CNA v3.10.4%2026-06-11Fix
CVE-2026-8589Improper neutralization of input during web page generation (cross-site scripting) in GitLab7.3CNA v3.10.4%2026-06-11Fix
CVE-2026-8464Path traversal in Neuron Soft Golem OEE MES8.3CNA v4.00.3%2026-06-11Fix
CVE-2026-8406OS4ED openSIS-Classic openSIS Classic insecure direct object reference in Sent Mail7.1CNA v4.00.4%2026-06-11
CVE-2026-7870IBM i is affected by privilege escalation []8.8CNA v3.10.5%2026-06-11Fix
CVE-2026-7852Unrestricted file upload in Limatek's LimRAD NAC9.8CNA v3.10.5%2026-06-11Fix
CVE-2026-7787IBM Langflow OSS Unauthenticated Session History Access via Public Flow Execution7.5CNA v3.10.4%2026-06-11Fix
CVE-2026-7250Allocation of resources without limits or throttling in GitLab7.5CNA v3.10.6%2026-06-11Fix
CVE-2026-6976Authorization bypass through user-controlled key in GitLab3.7CNA v3.10.2%2026-06-11Fix
CVE-2026-6338HTTP request smuggling in Kong Enteprise Gateway4.9CNA v4.00.5%2026-06-11Fix
CVE-2026-6277Incorrect authorization in GitLab4.3CNA v3.10.4%2026-06-11Fix
CVE-2026-6269Incorrect authorization in GitLab5.4CNA v3.10.3%2026-06-11Fix
CVE-2026-6250Authenticated format string injection on TP-Link Tapo C1107.0CNA v4.00.9%2026-06-11Fix
CVE-2026-5497Unbounded Frame Count in video/jpeg Base64 Data URL Processing leads to OOM DoS in vllm-project/vLLM7.5CNA v3.00.9%2026-06-11Fix
CVE-2026-4764Privilege escalation in Dialogflow CX via Playbook Import9.4CNA v4.00.4%2026-06-11Fix
CVE-2026-4096IBM DevOps Plan Host header handling HTTP header injection6.5CNA v3.10.3%2026-06-11Fix
CVE-2026-3553Incorrect authorization in GitLab3.1CNA v3.10.3%2026-06-11Fix
CVE-2026-3341IBM Langflow Desktop DNS Rebinding Bypasses SSRF Protection allowing Access to Internal services5.4CNA v3.10.2%2026-06-11Fix
CVE-2026-3329Nexus Repository Manager improper restriction of excessive authentication attempts8.7CNA v4.00.6%2026-06-11Fix
CVE-2026-2827Open User Map PRO WordPress plugin unauthenticated stored cross-site scripting4.7CNA v3.10.2%2026-06-11Fix
CVE-2026-1500Allocation of resources without limits or throttling in GitLab6.5CNA v3.10.3%2026-06-11Fix
CVE-2026-53742Simple Link Directory stored XSS via Embed shortcode attributes5.1CNA v4.00.2%2026-06-10
CVE-2026-53741Simple Link Directory stored XSS via sld_no_results_found option5.1CNA v4.00.2%2026-06-10
CVE-2026-53740Yoast Duplicate Post stored cross-site scripting via Scheduled Republish Notice5.1CNA v4.00.2%2026-06-10
CVE-2026-53739Yoast Duplicate Post cross-site request forgery via duplicate_post_dismiss_notice5.1CNA v4.00.1%2026-06-10
CVE-2026-53738Copy and Delete Posts privilege escalation via cdp_action_handling handler7.2CNA v4.00.4%2026-06-10
CVE-2026-53737Juicer stored cross-site scripting via Unescaped API Response5.3CNA v4.00.3%2026-06-10
CVE-2026-53736Easy Twitter Feeds cross-site request forgery via duplicate_post action5.1CNA v4.00.1%2026-06-10Fix
CVE-2026-53698Silverpeas mishandles the Personal space feature that is selected when no componentId is set6.5CNA v3.10.5%2026-06-10
CVE-2026-53694NoMachine potential local privileges escalation through argument injection in the nxchmod.sh script7.3CNA v4.00.2%2026-06-10Fix
CVE-2026-53693MISP BSimVis stored cross-site scripting in tag and cluster rendering paths6.9CNA v4.00.4%2026-06-10
CVE-2026-53689sahlberg libnfs improper quantity validation7.1CNA v3.10.4%2026-06-10Fix
CVE-2026-53674BuddyPress REGEXP injection via @Mention Username Resolution7.1CNA v4.00.7%2026-06-10
CVE-2026-53634Sharp: Missing authorization Check in Quick Creation command endpoints4.3CNA v3.10.4%2026-06-10Fix
CVE-2026-53476Kubev2v Assisted Migration Agent VDDK tarball extraction link following9.6CNA v3.10.4%2026-06-10Fix
CVE-2026-53475Kubev2v Assisted Migration Agent vCenter TLS connections improper certificate validation9.3CNA v3.10.5%2026-06-10Fix
CVE-2026-53474Kebev2v Migration Assessment migration-planner: Second-order SQL injection via rvtools upload9.6CNA v3.10.5%2026-06-10Fix
CVE-2026-53473Kubev2v Migration Planner UI migration-planner-ui-app: Stored XSS7.3CNA v3.10.3%2026-06-10
CVE-2026-53471Kebev2v Migration Assessment migration-planner: Agent API ignores JWT source_id claim9.6CNA v3.10.5%2026-06-10Fix
CVE-2026-53470Kebev2v Migration Assessment migration-planner: Getsourcedownloadurl missing organization check9.6CNA v3.10.5%2026-06-10Fix
CVE-2026-53469Kebev2v Migration Assessment migration-planner: Unprotected delete endpoint wipes all tenant data9.1CNA v3.10.5%2026-06-10Fix
CVE-2026-53465ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame image6.2CNA v3.10.2%2026-06-10Fix
CVE-2026-53464ImageMagick: Memory leak in wand option parser when providing invalid arguments4.0CNA v3.10.2%2026-06-10Fix
CVE-2026-53463ImageMagick: Null pointer dereference in distort operation when passing incorrect arguments4.3CNA v3.10.3%2026-06-10Fix
CVE-2026-53462ImageMagick has a use-after-free when allocation in CheckPrimitiveExtent fails5.9CNA v3.10.4%2026-06-10Fix
CVE-2026-53461ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop7.5CNA v3.10.6%2026-06-10Fix
CVE-2026-53460ImageMagick: Policy Bypass can trigger out-of-Memory condition7.5CNA v3.10.6%2026-06-10Fix
CVE-2026-53442Jenkins missing encryption5.3CISA ADP v3.10.2%2026-06-10Fix
CVE-2026-53441Jenkins: Stored XSS vulnerability in node offline cause description5.4v3.10.3%2026-06-10Fix
CVE-2026-53440Jenkins: Open redirect phishing attacks possible via from parameter in Delegate to servlet container4.3CISA ADP v3.10.4%2026-06-10Fix
CVE-2026-53439Jenkins exposes other users' timezone and view names to users with Overall/Read permission4.3CISA ADP v3.10.3%2026-06-10Fix
CVE-2026-53438Jenkins: Missing permission check allows unauthorized cancellation of queue items4.3CISA ADP v3.10.3%2026-06-10Fix
CVE-2026-53437Jenkins open redirect through Newline/Tab Characters in Redirect URL4.3CISA ADP v3.10.7%2026-06-10Fix
CVE-2026-53436Jenkins open redirect via Relative Path Segments in Post-Login Redirect URL4.3CISA ADP v3.10.4%2026-06-10Fix
CVE-2026-53435Jenkins deserialization of untrusted data8.8CISA ADP v3.12.2%2026-06-10Reported exploitedEmerging ThreatsExploit codeFix
CVE-2026-52759Ghidra denial of service via Uncontrolled Memory Allocation in Mach-O parser6.7CNA v4.00.2%2026-06-10Fix
CVE-2026-52758Ghidra SQL injection via Unescaped Filter Values in BSim Search8.7CNA v4.00.6%2026-06-10Fix
CVE-2026-52757Ghidra Heap-use-after-free in HighVariable::merge during decompilation4.6CNA v4.00.2%2026-06-10Fix
CVE-2026-52756Ghidra unauthenticated path traversal in Debugger ISF Server6.5v3.10.6%2026-06-10Fix
CVE-2026-52755Ghidra path traversal via Zip Slip in Theme Import8.4CNA v4.00.2%2026-06-10Fix
CVE-2026-52754Ghidra authentication bypass via Null Signature in PKIAuthenticationModule8.7CNA v4.00.5%2026-06-10Fix
CVE-2026-52753Ghidra Out-of-Memory in Rust Symbol Demangler via Malformed Symbol6.7CNA v4.00.2%2026-06-10Fix
CVE-2026-52752Ghidra path traversal in Extension Installer via ZIP Entry Names8.4CNA v4.00.2%2026-06-10Fix
CVE-2026-52751Ghidra remote code execution via Unfiltered RMI deserialization in Shared Project Connection8.6CNA v4.01.1%2026-06-10Fix
CVE-2026-52750Ghidra command injection via URL Annotation Click7.3CNA v4.00.7%2026-06-10Fix
CVE-2026-52726Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone yields RCE7.5CNA v3.10.7%2026-06-10Fix
CVE-2026-50639Metrics::Any::Adapter::SignalFx versions for Perl does not protect against metric injections6.5CISA ADP v3.10.4%2026-06-10Fix
CVE-2026-50638Metrics::Any::Adapter::DogStatsd versions for Perl does not protect against metric injections9.1CISA ADP v3.10.6%2026-06-10Fix
CVE-2026-50637Metrics::Any::Adapter::Statsd versions for Perl does not protect against metric injections8.2CISA ADP v3.10.5%2026-06-10Fix
CVE-2026-50570Fission pod spec capability validation improper privilege management8.5CNA v3.10.5%2026-06-10Fix
CVE-2026-50569Fission HTTP trigger admission improper input validation4.3CNA v3.10.4%2026-06-10Fix
CVE-2026-50568Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape3.6CNA v3.10.1%2026-06-10Fix
CVE-2026-50567Fission zip archive extraction path traversal7.7CNA v3.10.4%2026-06-10Fix
CVE-2026-50566Fission environment container security context execution with unnecessary privileges9.9CNA v3.10.5%2026-06-10Fix
CVE-2026-50565Fission builder pod service account token execution with unnecessary privileges4.9CNA v3.10.4%2026-06-10Fix
CVE-2026-50564Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape9.9CNA v3.10.5%2026-06-10Fix
CVE-2026-50563Fission Container Executor Function PodSpec injection leading to Node Escape9.9CNA v3.10.5%2026-06-10Fix
CVE-2026-50545Fission Environment CRD PodSpec injection leading to Node Escape and Cluster takeover9.9CNA v3.10.5%2026-06-10Fix
CVE-2026-50223Apache OFBiz code injection8.8CISA ADP v3.11.1%2026-06-10Fix
CVE-2026-50131Fedify public URL validation server-side request forgery8.6CNA v3.10.4%2026-06-10Fix
CVE-2026-50127Weblate SSRF: Outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)5.9CNA v3.10.5%2026-06-10Fix
CVE-2026-49824Fission Function admission webhook incorrect authorization8.5CNA v3.10.4%2026-06-10Fix
CVE-2026-49823Fission: Cross-namespace Package read via unvalidated PackageRef in function admission webhook7.7CNA v3.10.4%2026-06-10Fix
CVE-2026-49822Fission KubernetesWatchTrigger improper access control7.7CNA v3.10.4%2026-06-10Fix
CVE-2026-49821Fission Package environment reference missing authorization7.7CNA v3.10.4%2026-06-10Fix
CVE-2026-49760Erlang OTP stack buffer overflow in ei_s_print_term at Very Large Integer6.9CNA v4.00.1%2026-06-10Fix
CVE-2026-49759Erlang OTP stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash8.8CNA v4.00.5%2026-06-10Fix
CVE-2026-49498Ghidra SQL injection in PostgreSQL Password Change via Unescaped Username8.7CNA v4.00.5%2026-06-10Fix
CVE-2026-49497Ghidra path traversal via .gnu_debuglink in DWARF External Debug File Resolution4.6CNA v4.00.2%2026-06-10Fix
CVE-2026-49496Ghidra Heap-use-after-free in SleighBuilder::generatePointerAdd via Vector Reallocation6.9CNA v4.00.2%2026-06-10Fix
CVE-2026-49495Ghidra denial of service via Circular Reference in Mach-O Export Trie parser6.7CNA v4.00.2%2026-06-10Fix
CVE-2026-49219ImageMagick: Policy Bypass can read disallowed files5.5CNA v3.10.2%2026-06-10Fix
CVE-2026-49218ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions7.5CNA v3.10.6%2026-06-10Fix
CVE-2026-49069WPZOOM Portfolio WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.9%2026-06-10NucleiExploit codeFix
CVE-2026-48994ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems5.9CNA v3.10.4%2026-06-10Fix
CVE-2026-48860Erlang/OTP TLS distribution allowlist incorrect authorization7.5CNA v4.00.2%2026-06-10Fix
CVE-2026-48859Erlang/OTP timing side channel6.3CNA v4.00.6%2026-06-10Fix
CVE-2026-48858FTP client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks6.3CNA v4.00.2%2026-06-10Fix
CVE-2026-48856Erlang OTP httpc leaks Authorization header to cross-origin redirect targets7.1CNA v4.00.3%2026-06-10Fix
CVE-2026-48855Erlang OTP SFTP READLINK leaks Absolute Backend Filesystem Path when Root is Configured2.3CNA v4.00.3%2026-06-10Fix
CVE-2026-48734ImageMagick: Stack overflow in MVG decoder5.5CNA v3.10.1%2026-06-10Fix
CVE-2026-48733ImageMagick: Infinite loop in subimage-search with crafted image4.7CNA v3.10.1%2026-06-10Fix
CVE-2026-48724ImageMagick: Heap buffer underwrite in Floyd-Steinberg depth dithering5.5CNA v3.10.1%2026-06-10Fix
CVE-2026-48110Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds7.5CNA v3.10.5%2026-06-10Fix
CVE-2026-48108Russh SSH identification banner parsing improper input validation5.3CNA v3.10.5%2026-06-10Fix
CVE-2026-48107Russh: Unchecked keyboard-interactive prompt count in client auth path6.5CNA v3.10.4%2026-06-10Fix
CVE-2026-48096OpenFGA iterator cache key generation vulnerability5.0CNA v3.10.1%2026-06-10Fix
CVE-2026-48011Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames3.7CNA v3.10.4%2026-06-10Fix
CVE-2026-47838Spring Security Unauthorized User Impersonation when using X.509 Client Certificates6.8CNA v3.10.2%2026-06-10Fix
CVE-2026-47734Dulwich has unbounded memory allocation in receive-pack from crafted thin packs5.7CNA v3.10.3%2026-06-10Fix
CVE-2026-47712Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`3.3CNA v3.10.2%2026-06-10Fix
CVE-2026-47342Apache OFBiz: Privilege escalation via updateOrRemove authorization bypass8.8v3.10.4%2026-06-10Fix
CVE-2026-47213Boxlite sandbox timeout signal handling denial of service6.5CNA v3.10.4%2026-06-10
CVE-2026-47166ImageMagick: Heap buffer over-read in distributed pixel cache server5.7CNA v3.10.1%2026-06-10Fix
CVE-2026-47165ImageMagick: Information disclosure in distributed pixel cache server because it is not4.1CNA v3.10.1%2026-06-10Fix
CVE-2026-46705russh server userauth state is not reset when authentication principal changes5.3CNA v3.10.4%2026-06-10Fix
CVE-2026-46703BoxLite: Path traversal vulnerability in boxlite leads to arbitrary file write on the host9.6CNA v3.10.8%2026-06-10Fix
CVE-2026-46702Eugeny Russh post-decompression packet handling resource exhaustion7.5CNA v3.10.5%2026-06-10Fix
CVE-2026-46695BoxLite: Permission bypass in boxlite allows Modification of Read-Only files10.0CNA v3.10.5%2026-06-10Fix
CVE-2026-46693ImageMagick distributed pixel cache server race condition4.1CNA v3.10.1%2026-06-10Fix
CVE-2026-46692ImageMagick: Heap Buffer Over-Write in distributed pixel cache server4.1CNA v3.10.1%2026-06-10Fix
CVE-2026-46689Kanidm: Unauthenticated process abort via SCIM filter stack exhaustion8.7CNA v4.00.5%2026-06-10Fix
CVE-2026-46683Snappy: SSRF and local file read via the xsl-style-sheet option6.9CNA v4.00.4%2026-06-10Fix
CVE-2026-46679libp2p gossipsub subscriptions memory leak7.5CNA v3.10.5%2026-06-10Fix
CVE-2026-46673Russh: Unchecked CryptoVec allocation and growth handling is reachable7.5CNA v3.10.5%2026-06-10Fix
CVE-2026-46669openvm `openvm-pairing` pairing check missing proper subfield check on scaling factor8.7CNA v4.00.4%2026-06-10Fix
CVE-2026-46668SpiceDB: Caveat structures with nested lists can result in improper cache reuse2.3CNA v4.00.4%2026-06-10Fix
CVE-2026-46654Plonky3 MultiField32Challenger: Transcript malleability and challenge entropy loss8.9CNA v4.00.1%2026-06-10Fix
CVE-2026-46645SQLAdmin: Authorization bypass on `ajax_lookup`4.3CNA v3.10.4%2026-06-10Fix
CVE-2026-46643Snappy: Binary path is never shell-escaped due to an inverted is_executable check7.5CNA v4.00.2%2026-06-10Fix
CVE-2026-46642draw.io text format panel cross-site scripting6.1CNA v3.10.3%2026-06-10Fix
CVE-2026-46625JavaScript Cookie: Per-instance prototype hijack in assign enables cookie-attribute injection7.5CNA v3.11.0%2026-06-10Fix
CVE-2026-46618Fission builder pod OS command injection6.9CNA v4.00.6%2026-06-10Fix
CVE-2026-46617Fission runtime service account information disclosure8.7CNA v4.00.5%2026-06-10Fix
CVE-2026-46616Umbraco-CMS Umbraco.Cms: Open redirect vulnerability in Surface Controllers5.4CNA v3.10.3%2026-06-10Fix
CVE-2026-46614Fission function router missing authorization9.8CNA v3.10.7%2026-06-10Fix
CVE-2026-46612Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives8.8CNA v3.10.7%2026-06-10Fix
CVE-2026-46609Umbraco.Cms: XSS/HTML injection in Umbraco Backoffice confirmation dialog4.6CNA v3.10.2%2026-06-10Fix
CVE-2026-46559ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder4.0CNA v3.10.2%2026-06-10Fix
CVE-2026-46558Plane workspace asset storage missing authorization8.3CNA v3.10.4%2026-06-10Exploit codeFix
CVE-2026-46557ImageMagick: Stack overflow in fx operation6.2CNA v3.10.2%2026-06-10Fix
CVE-2026-46546Frappe LMS: HTML injection in user-controlled metadata2.1CNA v4.00.2%2026-06-10Fix
CVE-2026-46545nimiq core-rs-albatross nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item7.5CNA v3.10.6%2026-06-10Fix
CVE-2026-46543nimiq core-rs-albatross nimiq-blockchain: Genesis batch set request5.3CNA v3.10.5%2026-06-10Fix
CVE-2026-46542nimiq core-rs-albatross nimiq-keys: Denial of service in Ed25519 multisig delinearization4.3CNA v3.10.4%2026-06-10Fix
CVE-2026-46541Nimiq network-libp2p: DHT query poisoning via first-record verification failure7.5CNA v3.10.6%2026-06-10Fix
CVE-2026-46540Nimiq light-blockchain: Light blockchain rebranch issue6.5CNA v3.10.5%2026-06-10Fix
CVE-2026-46539nimiq core-rs-albatross nimiq-primitives: BlockInclusionProof interlink issue when hops are empty5.9CNA v3.10.2%2026-06-10Fix
CVE-2026-46532espressif esp-idf ESF-IDF: Heap out-of-bounds read in Bluedroid AVRCP Target parser4.6CNA v3.10.4%2026-06-10Fix
CVE-2026-46529mate-desktop atril PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen8.4CNA v4.00.4%2026-06-10Exploit codeFix
CVE-2026-46523ImageMagick MSL decoder use-after-free6.2CNA v3.10.4%2026-06-10Fix
CVE-2026-46522ImageMagick: Infinite loop in the MIFF decoder can lead to CPU exhaustion7.5CNA v3.11.9%2026-06-10Exploit codeFix
CVE-2026-46521ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression5.5CNA v3.10.1%2026-06-10Fix
CVE-2026-46520ImageMagick IPL decoder out-of-bounds write7.5CNA v3.10.6%2026-06-10Fix
CVE-2026-46518OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics7.7CNA v3.10.8%2026-06-10Fix
CVE-2026-46497apify crawlee-python SSRF via sitemap-derived URLs in Crawlee for Python2.3CNA v4.00.5%2026-06-10Fix
CVE-2026-46491simplesamlphp-module-casserver path traversal8.6CNA v3.10.6%2026-06-10Fix
CVE-2026-46432LMDeploy: Arbitrary code execution7.8CNA v3.10.2%2026-06-10Fix
CVE-2026-46411FlashMQ: Client can trigger uncaught exception on FlashMQ6.5CNA v3.10.5%2026-06-10Fix
CVE-2026-45783@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes7.5CNA v3.10.5%2026-06-10Fix
CVE-2026-45782cloud-hypervisor Cloud Hypervisor: Use-after-free in virtio-block Async I/O Completion8.9CNA v4.00.2%2026-06-10Fix
CVE-2026-45664ImageMagick: Policy Bypass in MNG coder could5.3CNA v3.10.6%2026-06-10Fix
CVE-2026-45624ImageMagick: Heap buffer over-read of a 4 bytes in distort operation5.1CNA v3.10.2%2026-06-10Fix
CVE-2026-45569Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)8.1CNA v3.10.5%2026-06-10
CVE-2026-45567Roxy-WI: Authentication bypass via API substring in URL + unauthenticated /API/gpt8.3CNA v3.10.4%2026-06-10
CVE-2026-45566Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass6.1CNA v3.10.3%2026-06-10
CVE-2026-45565Roxy-WI input validator path traversal8.1CNA v3.10.5%2026-06-10
CVE-2026-45564Roxy-WI: Authenticated RCE via configver URL parameter (os.system sink in /config/versions/.../save)8.8CNA v3.10.5%2026-06-10
CVE-2026-45563Roxy-WI: IDOR any authenticated user can read another user's full action history4.3CNA v3.10.3%2026-06-10
CVE-2026-45561Roxy-WI smon agent proxy server-side request forgery6.5CNA v3.10.4%2026-06-10
CVE-2026-45560Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)6.1CNA v3.10.3%2026-06-10
CVE-2026-45559Roxy-WI LDAP user lookup LDAP injection4.9CNA v3.10.4%2026-06-10
CVE-2026-45558Roxy-WI: Authenticated RCE on every managed HAProxy load balancer9.9CNA v3.10.8%2026-06-10
CVE-2026-45556Roxy-WI: Authenticated arbitrary file write on every managed load balancer9.9CNA v3.10.6%2026-06-10
CVE-2026-45552Roxy-WI server installation endpoints authorization bypass9.9CNA v3.10.5%2026-06-10
CVE-2026-45550Roxy-WI: IDOR on PUT /smon/check any user can rewrite any tenant's monitoring URL/IP/body9.1CNA v3.10.3%2026-06-10
CVE-2026-45549Roxy-WI smon agent action endpoint authorization bypass8.5CNA v3.10.3%2026-06-10
CVE-2026-45542espressif esp-idf ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth7.1CNA v3.10.5%2026-06-10Fix
CVE-2026-45541espressif esp-idf ESF-IDF: Remote null pointer dereference in WebSocket Server7.5CNA v3.10.8%2026-06-10Fix
CVE-2026-45384bit7z archive update temp files insecure temporary file6.1CNA v3.10.2%2026-06-10Fix
CVE-2026-45380bit7z symlink restoration path traversal3.6CNA v3.10.1%2026-06-10Fix
CVE-2026-45359ImageMagick connected components operation out-of-bounds read5.7CNA v3.10.2%2026-06-10Fix
CVE-2026-45358ImageMagick: Out-of-bounds read of a single byte in meta encoder5.3CNA v3.10.3%2026-06-10Fix
CVE-2026-45329espressif esp-idf ESF-IDF: Out-of-bounds read in ESP-TEE Secure Service Wrappers7.1CNA v3.10.2%2026-06-10Fix
CVE-2026-45328espressif esp-idf ESF-IDF: Out-of-bounds write in ESP-TEE Secure Service Wrappers9.3CNA v3.10.2%2026-06-10Fix
CVE-2026-45160espressif esp-idf ESF-IDF: Out-of-bounds read in lwIP DHCP Server option parser6.5CNA v3.10.4%2026-06-10Fix
CVE-2026-45106Weblate: Stored HTML injection in editor search preview4.6CNA v3.10.3%2026-06-10Fix
CVE-2026-45062FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting allows Execution of Non-PHP files8.1CNA v3.10.8%2026-06-10Fix
CVE-2026-45031ImageMagick: Policy Bypass in PSD decoder5.3CNA v3.10.7%2026-06-10Fix
CVE-2026-44716Pipecat: Path traversal in Pipecat Runner `/files` endpoint arbitrary file read7.5CNA v3.10.6%2026-06-10Fix
CVE-2026-44693Pi-hole FTL: Unauthenticated session hijacking via race condition on Global Session Buffer8.8CNA v3.10.3%2026-06-10Fix
CVE-2026-44692code16 Sharp download endpoint insecure direct object reference7.7CNA v3.10.4%2026-06-10Fix
CVE-2026-44634Stack buffer overflows in SimpleBLE8.7CNA v4.00.6%2026-06-10Fix
CVE-2026-44505Nimiq network-libp2p: Untrusted peer can wedge DHT5.3CNA v3.10.5%2026-06-10Fix
CVE-2026-42568Yamcs vulnerable to LDAP injection in LdapAuthModule4.3CNA v3.11.0%2026-06-10Exploit codeFix
CVE-2026-42563Dulwich vulnerable to command injection via Merge Driver Path7.7CNA v4.00.8%2026-06-10Fix
CVE-2026-42558xibosignage xibo-cms xibo vulnerable to stored XSS and Iframe sandbox escape7.6CNA v3.10.1%2026-06-10Fix
CVE-2026-42542TDengine has an integer underflow in uvConnMayGetUserInfo allows unauthenticated remote crash (DoS)7.5CNA v3.10.6%2026-06-10Fix
CVE-2026-42462Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring7.0CNA v3.10.2%2026-06-10Fix
CVE-2026-42326ImageMagick: Heap buffer over-read in IPTC encoder5.1CNA v3.10.2%2026-06-10Fix
CVE-2026-42305Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows8.8CNA v3.10.9%2026-06-10Fix
CVE-2026-41837Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys5.3CNA v3.10.3%2026-06-10Fix
CVE-2026-41732VMware Spring for Apache Pulsar Pulsar header mapper deserialization of untrusted data8.1CNA v3.10.4%2026-06-10Fix
CVE-2026-41730Spring Data REST exposes persistence-layer internals in error responses5.3CNA v3.10.3%2026-06-10Fix
CVE-2026-41729Spring Data REST SpEL injection via Map Key in JSON Patch8.1CNA v3.10.4%2026-06-10Exploit codeFix
CVE-2026-41728Spring Data REST has improper access control in its JSON Patch Implementation7.5CNA v3.10.3%2026-06-10Fix
CVE-2026-41727In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior6.5CNA v3.10.4%2026-06-10Fix
CVE-2026-41726VMware Spring for Apache Kafka delegating deserializer cache resource exhaustion6.5CNA v3.10.4%2026-06-10Fix
CVE-2026-41721Spring Data Commons denial of service via Data Binding5.9CNA v3.10.4%2026-06-10Fix
CVE-2026-41719Spring Data KeyValue SpEL injection vulnerability in SpelPropertyComparator6.4CNA v3.10.3%2026-06-10Fix
CVE-2026-41717Spring Data MongoDB SpEL Expression injection via Annotated Query Parameter Binding8.1CNA v3.10.4%2026-06-10Fix
CVE-2026-41716Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names7.5CNA v3.10.5%2026-06-10Fix
CVE-2026-41714Spring AMQP RabbitConnectionFactoryBean improper certificate validation4.0CNA v3.10.2%2026-06-10Fix
CVE-2026-41711Spring Data Commons potential denial of service through crafted Sort parameters5.9CNA v3.10.4%2026-06-10Fix
CVE-2026-41706Spring Security open redirect when using CookieRequestCache6.1CNA v3.10.3%2026-06-10Fix
CVE-2026-41701In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues4.4CNA v3.10.2%2026-06-10Fix
CVE-2026-41697Spring Data Relational parameter not Escaped for Query by Example LIKE Pattern4.8CNA v3.10.3%2026-06-10Fix
CVE-2026-41696Spring Data MongoDB Bind Parameter Literal Quoting Breakout5.9CNA v3.10.3%2026-06-10Fix
CVE-2026-41695Denial of service in Spring Data Commons Property Path Resolution7.5CNA v3.10.5%2026-06-10Fix
CVE-2026-41694Spring Security SAML Payloads Decrypted without Valid Signature3.7CNA v3.10.2%2026-06-10Fix
CVE-2026-41008Spring Security Authorization Server open redirect via request_uri6.1CNA v3.10.3%2026-06-10Fix
CVE-2026-41003Unencoded HTML Outputs in Spring Security may allow cross-site scripting7.6CNA v3.10.3%2026-06-10Fix
CVE-2026-40993Spring Security SAML2 Service Provider is vulnerable to deserialization of untrusted data7.3CNA v3.10.3%2026-06-10Fix
CVE-2026-40991Spring REST Docs XML external entity (XXE) injection when documenting untrusted XML content5.9CNA v3.10.3%2026-06-10Fix
CVE-2026-40988Spring Security Unbounded DEFLATE Inflation in SAML Service Provider7.5CNA v3.10.5%2026-06-10Fix
CVE-2026-29116Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC reachable assertion8.7CNA v4.00.6%2026-06-10Exploit code
CVE-2026-29115Dahua IPC/SD reachable assertion6.9CNA v4.00.5%2026-06-10Exploit code
CVE-2026-29114Dahua IPC sensitive information in an accessible file2.3CNA v4.00.3%2026-06-10Exploit code
CVE-2026-26241QNAP File Station 5 buffer overflow1.3CNA v4.00.6%2026-06-10Fix
CVE-2026-26240QNAP File Station 5 buffer overflow1.3CNA v4.00.6%2026-06-10Fix
CVE-2026-26239QNAP File Station 5 buffer overflow6.3CNA v4.00.5%2026-06-10Fix
CVE-2026-26237QNAP QuMagie missing authorization6.6CNA v4.00.5%2026-06-10Fix
CVE-2026-25700Apache Answer: AdminToken not invalidated after admin deactivation7.2CISA ADP v3.10.7%2026-06-10Fix
CVE-2026-24724QNAP File Station incorrect authorization6.2CNA v4.00.3%2026-06-10Fix
CVE-2026-24720QNAP File Station resource exhaustion1.3CNA v4.00.4%2026-06-10Fix
CVE-2026-24719QNAP QTS and QuTS hero OS command injection6.1CNA v4.01.0%2026-06-10Fix
CVE-2026-24717QNAP QTS and QuTS hero path traversal1.2CNA v4.00.4%2026-06-10Fix
CVE-2026-24716QNAP QTS and QuTS hero null pointer dereference1.2CNA v4.00.3%2026-06-10Fix
CVE-2026-24067Slate Digital Connect macOS XPC PID validation privilege escalation8.4CISA ADP v3.10.1%2026-06-10
CVE-2026-24066Slate Digital Connect macOS XPC certificate validation privilege escalation8.4CISA ADP v3.10.1%2026-06-10
CVE-2026-22899QNAP File Station 5 null pointer dereference1.3CNA v4.00.4%2026-06-10Fix
CVE-2026-22893QNAP QTS and QuTS hero OS command injection8.6CNA v4.01.1%2026-06-10Fix
CVE-2026-20260Log injection through HTTP Request Paths in Splunk SOAR4.3CNA v3.10.2%2026-06-10Fix
CVE-2026-20259Improper access control in Splunk Enterprise5.5CNA v3.10.2%2026-06-10Fix
CVE-2026-20258Stored cross-site scripting (XSS) through Classic Dashboard in Splunk Enterprise7.1CNA v3.10.2%2026-06-10Fix
CVE-2026-20257Improper input validation through Classic Dashboard CSS in Splunk Enterprise5.7CNA v3.10.3%2026-06-10Fix
CVE-2026-20256Improper input validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise5.7CNA v3.10.4%2026-06-10Fix
CVE-2026-20255Improper input validation through Classic Dashboards in Splunk Enterprise5.7CNA v3.10.4%2026-06-10Fix
CVE-2026-20254Information disclosure through External Content Restriction Bypass in Splunk Enterprise5.7CNA v3.10.4%2026-06-10Fix
CVE-2026-20253Splunk Enterprise missing authentication for critical function9.8CNA v3.196.9%2026-06-10KEVNucleiEmerging ThreatsExploit codeFix
CVE-2026-20252Server-side request forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise7.6CNA v3.10.3%2026-06-10Fix
CVE-2026-20251Remote code execution through deserialization of untrusted data in Splunk Secure Gateway8.8CNA v3.132.2%2026-06-10Exploit codeFix
CVE-2026-11884Red Hat Directory Server 11 heap-based buffer overflow6.5CNA v3.10.3%2026-06-10Fix
CVE-2026-11859Thinkst Applied Research Canarytokens HTML injection in the Canarytoken links email2.0CNA v4.00.3%2026-06-10Fix
CVE-2026-11853Debian debusine link following6.5CISA ADP v3.10.3%2026-06-10Fix
CVE-2026-11852Debian debusine missing authorization6.5CISA ADP v3.10.2%2026-06-10Fix
CVE-2026-11837Red Hat Enterprise Linux link following7.3CNA v3.10.2%2026-06-10Fix
CVE-2026-11815Insecure deserialization via MITM in Layer 7 Policy Manager5.3CNA v4.00.3%2026-06-10Fix
CVE-2026-11626Local privilege escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool5.4CNA v4.00.1%2026-06-10Fix
CVE-2026-11604OpenVPN ovpn-dco-win epoch key generator incorrect buffer size calculation5.6CNA v4.00.3%2026-06-10Fix
CVE-2026-11596ConnectWise ScreenConnect improper quantity validation4.7CNA v3.10.2%2026-06-10
CVE-2026-11417AWS Cloud Development Kit library OS command injection in NodejsFunction Bundling in aws-cdk-lib7.0CNA v4.01.0%2026-06-10Exploit codeFix
CVE-2026-10846NLnet Labs ldns insufficient verification that responses belong to a query8.2CNA v4.00.1%2026-06-10Fix
CVE-2026-10740Excessive memory allocation in s2n-quic6.9CNA v4.00.3%2026-06-10Fix
CVE-2026-10721Concrete CMS is vulnerable to PHP object injection8.4CNA v4.00.1%2026-06-10Fix
CVE-2026-10143kafka-python DoS via SCRAM Iteration Count in scram.py8.7CNA v4.00.5%2026-06-10Fix
CVE-2026-10142kafka-python denial of service via protocol Parser Frame Length8.7CNA v4.00.3%2026-06-10Fix
CVE-2026-9758Improper certificate validation in S2OPC7.3CNA v3.10.2%2026-06-10Fix
CVE-2026-9151Command injection vulnerability in OpenVPN on multiple TP-Link Archer Routers8.5CNA v4.02.5%2026-06-10Fix
CVE-2026-9067Schema and Structured Data for WP and AMP WordPress plugin unauthenticated arbitrary Media upload9.1CISA ADP v3.10.4%2026-06-10Exploit codeFix
CVE-2026-9060Agile Store Locator WordPress plugin Admin+ stored XSS via map_style3.5CISA ADP v3.10.2%2026-06-10Fix
CVE-2026-9045Lenovo Accessories and Display Manager for Enterprise missing authentication8.5CNA v4.00.2%2026-06-10Fix
CVE-2026-9019Easy Image Collage WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-06-10Fix
CVE-2026-8853MW WP Form WordPress plugin authenticated (Editor+) stored cross-site scripting via memo parameter4.4CNA v3.10.3%2026-06-10Fix
CVE-2026-8637Lenovo LanSchool Classic uncontrolled search path8.5CNA v4.00.2%2026-06-10Fix
CVE-2026-8613aThemes Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-06-10Fix
CVE-2026-8335Missing authentication in Aix-DB7.1CNA v4.00.3%2026-06-10
CVE-2026-8071Spam protection, Honeypot, Anti-Spam by CleanTalk WordPress plugin unauthenticated stored XSS8.8CISA ADP v3.10.5%2026-06-10Fix
CVE-2026-7516Lenovo Application exposed dangerous method5.1CNA v4.00.3%2026-06-10Fix
CVE-2026-6893Red Hat Enterprise Linux 10 dracut: Dracut: Root code execution via dhcp options command injection7.5CNA v3.13.1%2026-06-10Fix
CVE-2026-6090Lenovo Smart Connect authentication bypass7.3CNA v4.00.2%2026-06-10Fix
CVE-2026-3326XStore WordPress theme unauthenticated SQLi8.6CISA ADP v3.11.6%2026-06-10NucleiFix
CVE-2026-3018Newsletters WordPress plugin unauthenticated SQL injection via wpmlsubscriber_id parameter7.5CNA v3.11.5%2026-06-10NucleiFix
CVE-2026-2049GIMP HDR File Parsing heap-based buffer overflow remote code execution7.8CNA v3.00.6%2026-06-10Fix
CVE-2026-1220Google Chrome race condition7.5CISA ADP v3.10.3%2026-06-10Fix
CVE-2026-0274Cortex XSOAR: Improper validation of Credentials in CommvaultSecurityIQ integration8.1CNA v4.00.3%2026-06-10Fix
CVE-2026-0273PAN-OS: Authenticated admin command injection vulnerability via CLI or Web UI6.1CNA v4.01.3%2026-06-10Fix
CVE-2026-0272PAN-OS: Privilege escalation (PE) vulnerability in the Command Line Interface (CLI)6.0CNA v4.00.3%2026-06-10Fix
CVE-2026-0271Prisma Access Agent: Local privilege escalation by Authorized Users5.9CNA v4.00.1%2026-06-10Fix
CVE-2026-0270Cortex XSOAR: Path traversal4.8CNA v4.00.2%2026-06-10Fix
CVE-2026-0269PAN-OS: Denial of service (DoS) in Tunnel Traffic Processing4.6CNA v4.00.2%2026-06-10Fix
CVE-2026-0268Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux4.4CNA v4.00.1%2026-06-10Fix
CVE-2026-0267GlobalProtect App: Information exposure vulnerability on macOS4.4CNA v4.00.1%2026-06-10Fix
CVE-2026-0266PAN-OS: Stored cross-site scripting (XSS) vulnerability in the Web interface1.1CNA v4.00.1%2026-06-10Fix
CVE-2026-53675BuddyPress Friends List IDOR via REST API5.3CNA v4.00.4%2026-06-09
CVE-2026-53673BuddyPress Private Message IDOR via REST API user_id parameter8.6CNA v4.00.5%2026-06-09Fix
CVE-2026-52907Linux kernel rkcif camera interface driver off-by-one error7.8CNA v3.10.2%2026-06-09Fix
CVE-2026-52906Linux kernel 9P filesystem client vulnerability7.7CNA v3.10.2%2026-06-09Fix
CVE-2026-52905Linux kernel DAMON monitoring improper input validation5.5v3.10.1%2026-06-09Fix
CVE-2026-52904Linux kernel Nouveau GPU driver memory leak5.5v3.10.1%2026-06-09Fix
CVE-2026-52902Red Hat Ansible Automation Platform awxkit: Path traversal via yaml !include directive4.7CNA v3.10.2%2026-06-09Fix
CVE-2026-50636LimeSurvey RemoteControl invite_participants/remind_participants SQL injection8.7CNA v4.00.6%2026-06-09
CVE-2026-50635LimeSurvey password reset host header injection Discloses Reset Token8.7CNA v4.00.7%2026-06-09
CVE-2026-50512Microsoft PC Manager elevation of privilege7.8CNA v3.10.3%2026-06-09Fix
CVE-2026-50511Microsoft PC Manager elevation of privilege7.8CNA v3.10.4%2026-06-09Fix
CVE-2026-50508Microsoft Windows NTLM spoofing6.5CNA v3.10.9%2026-06-09Fix
CVE-2026-50507Microsoft Windows BitLocker security feature bypass6.8CNA v3.10.4%2026-06-09Fix
CVE-2026-49959nesquena hermes-webui Hermes WebUI RCE via Git Configuration injection8.7CNA v4.01.3%2026-06-09Fix
CVE-2026-49958nesquena hermes-webui hermes WebUI TOCTOU race condition via git_discard4.3CNA v4.00.1%2026-06-09Fix
CVE-2026-49957nesquena hermes-webui Hermes WebUI Workspace Boundary Bypass via API/workspace.py6.3CNA v4.00.5%2026-06-09Fix
CVE-2026-49956nesquena hermes-webui Hermes WebUI Profile Isolation Bypass via sessions search7.1CNA v4.00.5%2026-06-09Fix
CVE-2026-49955nesquena hermes-webui hermes WebUI resource exhaustion via passkey/options6.9CNA v4.00.8%2026-06-09Fix
CVE-2026-49948Mem0 missing authorization via POST /configure endpoint8.6CNA v4.00.5%2026-06-09
CVE-2026-49938Fortinet FortiPortal improper access control6.2CNA v3.10.3%2026-06-09Fix
CVE-2026-49848FreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto`4.3CNA v3.10.3%2026-06-09Fix
CVE-2026-49847FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON7.5CNA v3.10.5%2026-06-09Fix
CVE-2026-49843FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`5.3CNA v3.10.5%2026-06-09Fix
CVE-2026-49842FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames7.5CNA v3.10.6%2026-06-09Fix
CVE-2026-49841FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read9.8CNA v3.10.6%2026-06-09Fix
CVE-2026-49840FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing9.1CNA v3.10.5%2026-06-09Fix
CVE-2026-49818Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names6.5CISA ADP v3.11.0%2026-06-09Fix
CVE-2026-49762elixir-lang elixir resource exhaustion5.1CNA v4.00.2%2026-06-09Fix
CVE-2026-49742TYPO3 CMS broken access control in Media module7.1CNA v4.00.5%2026-06-09Fix
CVE-2026-49741TYPO3 CMS privilege escalation and SQL injection in Form Framework8.7CNA v4.00.4%2026-06-09Fix
CVE-2026-49740TYPO3 CMS insecure deserialization in Core API6.3CNA v4.00.6%2026-06-09Fix
CVE-2026-49738TYPO3 CMS broken access control in File Abstraction Layer2.1CNA v4.00.5%2026-06-09Fix
CVE-2026-49475FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing7.5CNA v3.10.5%2026-06-09Fix
CVE-2026-49472FreeSWITCH includes a vulnerable function, PREFIX(prologTok) from libexpat5.3CNA v3.10.4%2026-06-09Fix
CVE-2026-49161Microsoft PC Manager security feature bypass7.8CNA v3.10.3%2026-06-09Fix
CVE-2026-49160Microsoft Windows HTTP.sys denial of service7.5CNA v3.11.2%2026-06-09Exploit codeFix
CVE-2026-48583Microsoft Windows Kernel elevation of privilege7.8CNA v3.10.3%2026-06-09Fix
CVE-2026-48578Microsoft Windows secure Boot security feature bypass7.9CNA v3.10.3%2026-06-09Fix
CVE-2026-48576Microsoft Windows secure Boot security feature bypass7.9CNA v3.12.3%2026-06-09Fix
CVE-2026-48575Microsoft Windows secure Boot security feature bypass7.9CNA v3.10.4%2026-06-09Fix
CVE-2026-48574Microsoft Windows Media remote code execution7.8CNA v3.10.5%2026-06-09Fix
CVE-2026-48573Microsoft Windows secure Boot security feature bypass7.9CNA v3.12.3%2026-06-09Fix
CVE-2026-48570Microsoft Windows secure Boot security feature bypass7.9CNA v3.10.4%2026-06-09Fix
CVE-2026-48569Microsoft Visual Studio Code security feature bypass7.1CNA v3.10.4%2026-06-09Fix
CVE-2026-48568Microsoft Windows secure Boot security feature bypass7.9CNA v3.10.4%2026-06-09Fix
CVE-2026-48566Microsoft Windows DWM Core library information disclosure5.5CNA v3.10.4%2026-06-09Fix
CVE-2026-48565Microsoft Windows Narrator Braille elevation of privilege7.8CNA v3.10.4%2026-06-09Fix
CVE-2026-48563Microsoft Windows remote Desktop client remote code execution7.5CNA v3.10.6%2026-06-09Fix
CVE-2026-48562Microsoft SharePoint server spoofing4.6CNA v3.10.6%2026-06-09Fix
CVE-2026-48560Microsoft SharePoint server spoofing5.4CNA v3.11.1%2026-06-09Fix
CVE-2026-48306Substance3D Sampler out-of-bounds write7.8CNA v3.10.3%2026-06-09Fix
CVE-2026-48305Substance3D Sampler out-of-bounds write7.8CNA v3.10.3%2026-06-09Fix
CVE-2026-48304Adobe Experience Manager cross-site scripting (stored XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48303Adobe Campaign Classic (ACC) incorrect authorization10.0CNA v3.11.2%2026-06-09Fix
CVE-2026-48301Adobe Experience Manager cross-site scripting (stored XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48300Adobe Experience Manager cross-site scripting (stored XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48299Adobe Experience Manager cross-site scripting (stored XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48297Adobe Experience Manager cross-site scripting (stored XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48293Adobe InDesign Desktop out-of-bounds write7.8CNA v3.10.3%2026-06-09Fix
CVE-2026-48292Adobe Format Plugins heap-based buffer overflow7.8CNA v3.10.3%2026-06-09Fix
CVE-2026-48291Adobe Format Plugins heap-based buffer overflow7.8CNA v3.10.3%2026-06-09Fix
CVE-2026-48289Adobe Experience Manager improper input validation3.5CNA v3.10.5%2026-06-09Fix
CVE-2026-48288Adobe Experience Manager improper input validation3.5CNA v3.10.5%2026-06-09Fix
CVE-2026-48280Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48271Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48268Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48266Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48265Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48264Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48258Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48256Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48251Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-48250Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-47993Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-47991Adobe Experience Manager URL redirection to untrusted site (open redirect)6.1CNA v3.10.5%2026-06-09Fix
CVE-2026-47990Adobe Experience Manager cross-site scripting (stored XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-47989Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-47987Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-47986Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix
CVE-2026-47985Adobe Experience Manager cross-site scripting (DOM-based XSS)5.4CNA v3.10.4%2026-06-09Fix