CVE-2026 list

CVE-2026 records published in June 2026

Page eight of eight: records 7,001 to 7,316 of the 7,316 published in June 2026, newest first. The first page carries the figures for June 2026.

CVE-2026 records published in June 2026, newest first: records 7,001 to 7,316 of 7,316
CVE Summary CVSS EPSS Published Signals
CVE-2026-48839WP Statistics WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-01Reported exploitedFix
CVE-2026-48827Apache Mina Sshd: Path traversal in org.Apache.sshd:sshd-git7.1CNA v3.10.8%2026-06-01Fix
CVE-2026-48726Apache Airflow: Revoke_token unreachable in FabAuthManager / KeycloakAuthManager logout path6.5CISA ADP v3.10.6%2026-06-01Fix
CVE-2026-48559epoupon lms Lightweight Music Server stored XSS via Media File Metadata Tags5.1CNA v4.00.3%2026-06-01
CVE-2026-48209OTRS reflected XSS in authenticated agent context7.1CNA v3.10.4%2026-06-01Fix
CVE-2026-48208OTRS An improper neutralization6.5CNA v3.10.5%2026-06-01Exploit codeFix
CVE-2026-48191OTRS Wrong Permission Handling in Document Search Article Meta Filters3.5CNA v3.10.2%2026-06-01Fix
CVE-2026-48190OTRS Incorrect handling of permissions in External Interface Config Item List module3.5CNA v3.10.2%2026-06-01Fix
CVE-2026-48189OTRS bypass DedicatedAgentToCustomerGroups setting5.7CNA v3.10.3%2026-06-01Fix
CVE-2026-48188OTRS SQL injection via MySQL Quote method9.1CNA v3.10.5%2026-06-01Exploit codeFix
CVE-2026-48187OTRS email with special content can lead to DoS5.7CNA v3.10.4%2026-06-01Fix
CVE-2026-47294Microsoft SharePoint server remote code execution8.0CNA v3.11.2%2026-06-01Fix
CVE-2026-46764Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter4.3v3.10.4%2026-06-01Fix
CVE-2026-46605Apache ActiveMQ server has an incomplete authorization workflow4.3CISA ADP v3.10.5%2026-06-01Fix
CVE-2026-46243Linux kernel CIFS SPNEGO upcall improper input validation7.1CNA v3.10.4%2026-06-01Exploit codeFix
CVE-2026-45810Nextcloud: Propfind requests for file comments allowed to load comments for other files6.8CNA v3.10.4%2026-06-01Fix
CVE-2026-45729ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input4.3CNA v3.10.4%2026-06-01Exploit codeFix
CVE-2026-45727CloakBrowser: Unauthenticated path traversal8.8CNA v4.00.7%2026-06-01Fix
CVE-2026-45722Nextcloud Tables table view sort order SQL injection7.1CNA v3.10.5%2026-06-01Fix
CVE-2026-45701Sulu: Weak cryptographical usage for API Key generation and Reset Tokens6.9CNA v4.00.3%2026-06-01Fix
CVE-2026-45691Nextcloud: Bypass of second factor authentication on DAV endpoints5.9CNA v3.10.4%2026-06-01Fix
CVE-2026-45690Nextcloud: Two-Factor authentication bypass via Pending Session Token Replay5.9CNA v3.10.4%2026-06-01Fix
CVE-2026-45545Nextcloud: SQL injection in Column Type parameter allows arbitrary SQL Execution8.2CNA v3.10.5%2026-06-01Fix
CVE-2026-45544Nextcloud: Information disclosure of view filter metdata4.3CNA v3.10.4%2026-06-01Fix
CVE-2026-45543Nextcloud Forms collaborator share removal information disclosure5.3CNA v3.10.5%2026-06-01Fix
CVE-2026-45505Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a code injection issue8.8CISA ADP v3.10.9%2026-06-01Fix
CVE-2026-45426Apache Airflow: Log server JWT authorization bypass3.1CISA ADP v3.10.5%2026-06-01Fix
CVE-2026-45360Apache Airflow: Arbitrary import in custom deadline-reference deserialization7.3CISA ADP v3.10.9%2026-06-01Fix
CVE-2026-45302Prototype pollution in parse-nested-form-data via `__proto__` in FormData field names8.2CNA v3.10.6%2026-06-01Fix
CVE-2026-45286Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint4.3CNA v3.10.5%2026-06-01Fix
CVE-2026-45285Nextcloud: Hidden Public Link creation when sharing to a Team External Member6.4CNA v3.10.5%2026-06-01Fix
CVE-2026-45284Nextcloud User OIDC LDAP authentication check improper access control4.6CNA v3.10.4%2026-06-01Fix
CVE-2026-45283Nextcloud: Files Lock app allows users to lock and unlock files of other users6.3CNA v3.10.4%2026-06-01Fix
CVE-2026-45282Nextcloud Server text attachments improper access control6.5CNA v3.10.5%2026-06-01Fix
CVE-2026-45281Nextcloud: Cross-Account Calendar takeover via Unauthorized Group-Member-Set Update8.1CNA v3.10.5%2026-06-01Fix
CVE-2026-45279Nextcloud Server template API path traversal4.4CNA v3.10.6%2026-06-01Fix
CVE-2026-45278Nextcloud: Open redirect in user_oidc login flow via protocol-relative URL bypass3.3CNA v3.10.3%2026-06-01Fix
CVE-2026-45277Nextcloud: Information disclosure in Nextcloud Approval app3.3CNA v3.10.2%2026-06-01Fix
CVE-2026-45275Nextcloud: Authorization bypass in Approval feature allows unauthorized file sharing with approvers6.5CNA v3.10.5%2026-06-01Fix
CVE-2026-45267Nextcloud: Missing permission check for from submissions6.5CNA v3.10.5%2026-06-01Fix
CVE-2026-45266Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling3.5CNA v3.10.4%2026-06-01Fix
CVE-2026-45264Nextcloud: ACL Rename permission bypass in Team Folders allows Unauthorized File Renames4.3CNA v3.10.4%2026-06-01Fix
CVE-2026-45192Apache Airflow: Incomplete Redaction of Sensitive fields in Connection Extra API Response6.5CISA ADP v3.10.7%2026-06-01Fix
CVE-2026-45159Nextcloud end-to-end encrypted file drop shares insecure direct object reference3.5CNA v3.10.4%2026-06-01Fix
CVE-2026-45157Nextcloud: Valid share tokens allow to access tempory upload files of share owner6.3CNA v3.10.4%2026-06-01Fix
CVE-2026-45156Nextcloud: Authentication bypass in ID4me handling8.1CNA v3.10.6%2026-06-01Exploit codeFix
CVE-2026-45155Nextcloud: Private circle can be added to another circle via API2.6CNA v3.10.3%2026-06-01Fix
CVE-2026-45154Nextcloud: Improper access control in Collectives2.6CNA v3.10.3%2026-06-01Fix
CVE-2026-45153Nextcloud: PIN bypass in PassCodeActivity via back button4.6CNA v3.10.2%2026-06-01Fix
CVE-2026-45132CloudPirates Open Source Helm Charts generate-schema GitHub Actions workflow code injection10.0CNA v3.10.4%2026-06-01Exploit code
CVE-2026-45131CloudPirates Open Source Helm Charts pull-request GitHub Actions workflow code injection10.0CNA v3.10.4%2026-06-01Exploit code
CVE-2026-44825Apache Solr: Enabling BasicAuth using bin/Solr CLI configures additional insecure users8.1CNA v3.12.8%2026-06-01NucleiExploit codeFix
CVE-2026-44740go-git go-billy symlink resolution uncontrolled recursion6.5CNA v3.10.5%2026-06-01Fix
CVE-2026-44211Cline Kanban Server has a Cross-Origin WebSocket Hijacking vulnerability9.6CNA v3.10.2%2026-06-01
CVE-2026-43958rrdtool rrdcached stack buffer overflow7.8CNA v3.10.2%2026-06-01Fix
CVE-2026-43625CodexBar Session Cookie Exposure via HTTP Redirect8.2CNA v4.00.3%2026-06-01Fix
CVE-2026-43624F5-TTS path traversal via finetune_gradio.py create_data_project8.8CNA v4.00.6%2026-06-01
CVE-2026-43623microtar stack-based buffer overflow via raw_to_header8.7CNA v4.00.6%2026-06-01
CVE-2026-42683VikBooking Hotel Booking Engine and PMS WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-01Fix
CVE-2026-42682wpForo Forum WordPress plugin broken access control9.1CNA v3.10.4%2026-06-01Fix
CVE-2026-42681e2pdf WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-01Fix
CVE-2026-42680Contest Gallery Pro WordPress plugin privilege escalation9.8CNA v3.10.5%2026-06-01Fix
CVE-2026-42679Classified Listing WordPress plugin arbitrary file download6.5CNA v3.10.4%2026-06-01Fix
CVE-2026-42678GiveWP WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-06-01Fix
CVE-2026-42677WP Document Revisions WordPress plugin broken access control7.5CNA v3.10.4%2026-06-01Fix
CVE-2026-42676myCred WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-06-01Fix
CVE-2026-42675Hydra Booking WordPress plugin broken access control7.3CNA v3.10.3%2026-06-01Fix
CVE-2026-42674Advanced Access Manager WordPress plugin bypass vulnerability vulnerability7.5CNA v3.10.5%2026-06-01Fix
CVE-2026-42673Logtivity Activity Logs Activity Logs information disclosure7.5CNA v3.10.4%2026-06-01Fix
CVE-2026-42672WP Directory Kit WordPress plugin SQL injection9.3CNA v3.10.4%2026-06-01Fix
CVE-2026-42671GeoDirectory WordPress plugin broken access control6.5CNA v3.10.3%2026-06-01Fix
CVE-2026-42588Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote code execution8.1CISA ADP v3.10.7%2026-06-01Exploit codeFix
CVE-2026-42360Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking6.5CISA ADP v3.10.5%2026-06-01Fix
CVE-2026-42359Apache Airflow: Authenticated RCE8.8CISA ADP v3.10.9%2026-06-01Fix
CVE-2026-42358Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets6.5v3.10.3%2026-06-01Fix
CVE-2026-42253Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response header injection via JMS Message Properties6.1v3.11.1%2026-06-01Fix
CVE-2026-42252Apache Airflow: BashOperator Jinja2 injection via dag_run.conf low-privilege user pattern9.1CISA ADP v3.10.6%2026-06-01Fix
CVE-2026-42251Hard-coded credentials in KS-SOMED8.7CNA v4.00.4%2026-06-01
CVE-2026-41084Apache Airflow: API authorization bypass: Bulk TaskInstances allows cross-DAG mutation7.5CISA ADP v3.10.8%2026-06-01Fix
CVE-2026-41017Apache Airflow has a Sensitive Cookie in HTTPS Session without Secure attribute5.9v3.10.4%2026-06-01Fix
CVE-2026-41014Apache Airflow: Per-DAG RBAC bypass on /UI/partitioned_dag_runs endpoints4.3CISA ADP v3.10.6%2026-06-01Fix
CVE-2026-41013Cloud Foundry Foundation smb-volume-release improper input validation8.1CISA ADP v3.10.4%2026-06-01
CVE-2026-40990Unbounded cache for function definitions5.7CNA v3.10.3%2026-06-01Fix
CVE-2026-40989Self Routing guard bypassed via function composition5.7CNA v3.10.3%2026-06-01Fix
CVE-2026-40965Cloud Foundry Foundation uaa_release information disclosure10.0CNA v4.00.5%2026-06-01
CVE-2026-40964Cloud Foundry Foundation log-cache_release cf-auth-proxy authentication bypass7.5CNA v3.10.6%2026-06-01
CVE-2026-40963Apache Airflow: DAG authorization bypass on /UI/structure/structure_data3.1CISA ADP v3.10.5%2026-06-01Fix
CVE-2026-40961Apache Airflow: Open redirect Bypass7.2CISA ADP v3.10.8%2026-06-01Fix
CVE-2026-40861Apache Airflow: Arbitrary file read via Log symlink following in FileTaskHandler6.5CISA ADP v3.10.8%2026-06-01Fix
CVE-2026-40549Cross-site request forgery in SOPlanning5.1CNA v4.00.2%2026-06-01
CVE-2026-40548Unrestricted upload of file with dangerous type in SOPlanning6.4CNA v4.00.4%2026-06-01
CVE-2026-40547Path traversal in SOPlanning6.4CNA v4.00.6%2026-06-01
CVE-2026-40546SOPlanning SQL injection8.7CNA v4.00.4%2026-06-01
CVE-2026-40545Reflected XSS in SOPlanning5.1CNA v4.00.6%2026-06-01
CVE-2026-40544Stored XSS in SOPlanning5.1CNA v4.00.4%2026-06-01
CVE-2026-40543Missing authorization in SOPlanning8.8CNA v4.00.4%2026-06-01
CVE-2026-38950ESA AnomalyMatch model checkpoint loader deserialization of untrusted data7.8CISA ADP v3.10.4%2026-06-01
CVE-2026-37235Mosaic5g Flexric crash7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37234Mosaic5g Flexric resource exhaustion8.2CISA ADP v3.10.5%2026-06-01
CVE-2026-37233Mosaic5g Flexric reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37232Openairinterface5g divide by zero8.6CISA ADP v3.10.6%2026-06-01
CVE-2026-37231Mosaic5g Flexric integer underflow7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37230Mosaic5g Flexric null pointer dereference7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37229Mosaic5g Flexric reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37228Mosaic5g Flexric reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37227FlexRIC near-RT RIC message handler reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37226Mosaic5g Flexric null pointer dereference7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37225FlexRIC iApp E42 subscription handler reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37224FlexRIC iApp node registry reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37223FlexRIC iApp message dispatcher reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37222FlexRIC E2AP message decoder reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37221FlexRIC near-RT RIC subscription response handler reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-37220FlexRIC near-RT RIC SCTP handler reachable assertion7.5CISA ADP v3.10.6%2026-06-01
CVE-2026-35563Apache Directory LDAP API lacks server certificate verification for LDAP hostnames8.8CNA v4.00.3%2026-06-01Fix
CVE-2026-34193GPU Ddk Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr4.3CISA ADP v3.10.2%2026-06-01Fix
CVE-2026-32325Fsas Technologies ServerView Agents privilege escalation8.5CNA v4.00.1%2026-06-01
CVE-2026-30963Capsule Namespace Hijacking via subresource3.9CNA v3.10.3%2026-06-01Fix
CVE-2026-28586Google Android AppOpsService.java missing authorization3.3CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-28581Google Android null pointer dereference4.0CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-28580Google Android multiple functions privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-28578Google Android DevicePolicyManagerService.java denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-28577Google Android WindowManagerService.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-28511elabftw has entry title leakage through autocompletion search4.3CNA v3.10.3%2026-06-01Fix
CVE-2026-27788Fsas Technologies ServerView Agents incorrect permission assignment8.5CNA v4.00.1%2026-06-01
CVE-2026-25879Langroid has Prompt to SQL injection, leading to RCE9.8CNA v3.10.7%2026-06-01Fix
CVE-2026-25600Credential exposure vulnerability in Trac PDBM6.4CNA v3.10.1%2026-06-01Fix
CVE-2026-25599Missing authentication and clear‑text data transmission affecting Orca heat pumps6.3CNA v3.10.2%2026-06-01Fix
CVE-2026-25277Qualcomm Snapdragon buffer copy without checking size of input in Secure Processor8.8CNA v3.10.1%2026-06-01Fix
CVE-2026-25276Qualcomm Snapdragon improper validation of array index in Secure Processor8.8CNA v3.10.1%2026-06-01Fix
CVE-2026-25260Qualcomm Snapdragon time-of-check time-of-use (TOCTOU) race condition in DSP service7.8CNA v3.10.1%2026-06-01Fix
CVE-2026-25259Qualcomm Snapdragon out-of-bounds write in DSP service7.8CNA v3.10.1%2026-06-01Fix
CVE-2026-25258Qualcomm Snapdragon out-of-bounds read in DSP service7.8CNA v3.10.1%2026-06-01Fix
CVE-2026-24782Kiteworks Secure Data Forms has a SQL injection7.6CNA v3.10.7%2026-06-01Fix
CVE-2026-24761Kiteworks Secure Data Forms is vulnerable to authorization bypass through user-controlled key3.7CNA v3.10.1%2026-06-01Fix
CVE-2026-24756Kiteworks Secure Data Forms is vulnerable to authorization bypass through user-controlled key4.3CNA v3.10.2%2026-06-01Fix
CVE-2026-24755Kiteworks Secure Data Forms is vulnerable to authorization bypass through user-controlled key5.4CNA v3.10.1%2026-06-01Fix
CVE-2026-24754Kiteworks Secure Data forms vulnerable to cross-site scripting5.4CNA v3.10.1%2026-06-01Fix
CVE-2026-24753Kiteworks Secure Data Forms is vulnerable to authorization bypass through user-controlled key6.5CNA v3.10.2%2026-06-01Fix
CVE-2026-24752Kiteworks Secure Data Forms vulnerable to cross-site scripting8.2CNA v3.10.3%2026-06-01Fix
CVE-2026-24751Kiteworks Secure Data Forms vulnerable to cross-site scripting8.2CNA v3.10.3%2026-06-01Fix
CVE-2026-24092Qualcomm Snapdragon improper validation of syntactic correctness of input in Display7.2CNA v3.10.1%2026-06-01Fix
CVE-2026-24091Qualcomm Snapdragon improper validation of syntactic correctness of input in Display7.2CNA v3.10.1%2026-06-01Fix
CVE-2026-24090Qualcomm Snapdragon missing authentication for critical function in HLOS7.1CNA v3.10.1%2026-06-01Fix
CVE-2026-24089Qualcomm Snapdragon improper validation of syntactic correctness of input in Kernel7.2CNA v3.10.1%2026-06-01Fix
CVE-2026-24088Qualcomm Snapdragon missing authentication for critical function in Boot8.2CNA v3.10.1%2026-06-01Exploit codeFix
CVE-2026-24087Qualcomm Snapdragon improper validation of syntactic correctness of input in Kernel7.2CNA v3.10.1%2026-06-01Fix
CVE-2026-24085Qualcomm Snapdragon stack-based buffer overflow in Display7.2CNA v3.10.1%2026-06-01Fix
CVE-2026-23638Kiteworks Secure Data Forms is vulnerable to authorization bypass through user-controlled key6.5CNA v3.10.2%2026-06-01Fix
CVE-2026-22872Capsule TenantResource RawItems Cluster-Scoped Resource Creation vulnerability6.9CNA v4.00.7%2026-06-01Fix
CVE-2026-20456MediaTek chipset wlan STA driver crash5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-20455MediaTek chipset geniezone out-of-bounds write7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-20454MediaTek chipset geniezone out-of-bounds write6.4CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-20453MediaTek chipset geniezone out-of-bounds write6.7CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-20452MediaTek chipset wlan AP driver memory corruption8.0CISA ADP v3.10.4%2026-06-01Exploit codeFix
CVE-2026-10533Red Hat OpenShift Container Platform ResourceQuota pod limit enforcement resource exhaustion5.0CNA v3.10.2%2026-06-01
CVE-2026-10532Logback deserialization whitelist bypass for Proxy objects2.9CNA v4.00.4%2026-06-01Fix
CVE-2026-10300SGLang Inference HTTP endpoint lora_manager.py assertion6.3CNA v4.00.4%2026-06-01
CVE-2026-10299code-projects Online Hospital Management System viewdoctortimings.php resource injection5.1CNA v4.00.3%2026-06-01
CVE-2026-10298ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference4.8CNA v4.00.1%2026-06-01
CVE-2026-10297itsourcecode Fees Management System manage_course.php SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10296itsourcecode Fees Management System ajax.php SQL injection5.3CNA v4.00.3%2026-06-01
CVE-2026-10295SourceCodester Customer Review App review_app.py get_all_reviews denial of service4.8CNA v4.00.1%2026-06-01
CVE-2026-10294PackageKit API pk-transaction.c g_file_test improper authorization5.3CNA v4.00.2%2026-06-01Fix
CVE-2026-10293UTT HiPER 1200GW formFireWall strcpy stack-based overflow8.7CNA v4.00.5%2026-06-01
CVE-2026-10292UTT HiPER 1200GW formTaskEdit strcpy stack-based overflow8.7CNA v4.00.5%2026-06-01
CVE-2026-10291Enderfga claw-orchestrator Session Grep endpoint embedded-server.ts validateRegex redos5.3CNA v4.00.4%2026-06-01Fix
CVE-2026-10290code-projects Hotel and Tourism Reservation System GET parameter tour.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10289code-projects Hotel and Tourism Reservation System tour.php cross-site scripting5.3CNA v4.00.3%2026-06-01
CVE-2026-10288code-projects Hotel and Tourism Reservation System admin login improper authentication6.9CNA v4.00.5%2026-06-01
CVE-2026-10287SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery6.9CNA v4.00.3%2026-06-01
CVE-2026-10286CodeAstro Payroll System home_employee.php SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10285DevaslanPHP project-management ticket record updates improper authorization5.3CNA v4.00.2%2026-06-01
CVE-2026-10284DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization5.3CNA v4.00.2%2026-06-01
CVE-2026-10283Bottelet DaybydayCRM setting missing authentication5.3CNA v4.00.3%2026-06-01
CVE-2026-10282Bottelet DaybydayCRM DocumentsController.php view improper authorization5.3CNA v4.00.2%2026-06-01
CVE-2026-10281Enderfga claw-orchestrator API endpoint embedded-server.ts EmbeddedServer missing authentication6.9CNA v4.00.4%2026-06-01Fix
CVE-2026-10280horizon921 mcpilot MCP API Call endpoint route.ts server-side request forgery6.9CNA v4.00.3%2026-06-01
CVE-2026-10279hiraishikentaro wezterm-mcp pane command execution OS command injection5.3CNA v4.01.1%2026-06-01
CVE-2026-10278ishayoyo excel-mcp read_file/write_file index.ts path traversal5.3CNA v4.00.3%2026-06-01
CVE-2026-10277j3k0 mcp-google-workspace MCP Gmail tool gmail.ts saveToDisk access control5.3CNA v4.00.3%2026-06-01
CVE-2026-10276hekmon8 Jenkins-server-mcp build status and log requests server-side request forgery5.3CNA v4.00.3%2026-06-01
CVE-2026-10275OpenSC pkcs11-tool Key Generation pkcs11-tool.c test_kpgen_certwrite buffer overflow2.3CNA v4.00.3%2026-06-01Fix
CVE-2026-10274indrasishbanerjee aem-mcp-server asset metadata request server-side request forgery5.3CNA v4.00.2%2026-06-01
CVE-2026-10273php-censor Webhook Endpoint GitBuild.php os command injection6.9CNA v4.01.4%2026-06-01
CVE-2026-10272a4m4 Student-Management-System deleteform.php improper authorization6.9CNA v4.00.3%2026-06-01
CVE-2026-10271a4m4 Student-Management-System Admin endpoint admin redirect5.3CNA v4.00.3%2026-06-01
CVE-2026-10270D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow7.5v3.10.7%2026-06-01
CVE-2026-10269decolua 9router HTTP header dashboardGuard.js isAuthenticated improper authorization5.3CNA v4.00.3%2026-06-01Fix
CVE-2026-10268janet-lang janet marsh.c unmarshal_one_fiber integer overflow4.8CNA v4.00.1%2026-06-01
CVE-2026-10267janet-lang janet debug.c doframe out-of-bounds4.8CNA v4.00.1%2026-06-01
CVE-2026-10265itsourcecode Content Management System edit_topic.php SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10264lharries whatsapp-mcp Send API endpoint main.go SendMessageRequest path traversal5.1CNA v4.00.3%2026-06-01
CVE-2026-10263SourceCodester Computer Repair Shop Management System manage_product.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10262code-projects Real State Services Login loginuser.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10261CodeAstro Online Job Portal application_status.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10260CodeAstro Online Job Portal delete-jobs.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10259H3C Magic B0 aspForm SetMobileAPInfoById stack-based overflow8.7CNA v4.00.5%2026-06-01
CVE-2026-10258itsourcecode Content Management System add_sub_topic.php SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10257itsourcecode Content Management System update_ss_img.php SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10256itsourcecode Content Management System save_comment.php SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10255SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control6.9CNA v4.00.3%2026-06-01
CVE-2026-10254SourceCodester Pet Grooming Management Software admin file information disclosure6.9CNA v4.00.3%2026-06-01
CVE-2026-10253itsourcecode Online House Rental System manage_payment.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10252itsourcecode Online House Rental System manage_tenant.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10251itsourcecode Online House Rental System ajax.php login SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10250itsourcecode Online Blood Bank Management System campsdetails.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10249itsourcecode Online Blood Bank Management System viewrequest.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10248SourceCodester Pharmacy Sales and Inventory System supplier CSV export CSV injection5.1CNA v4.00.2%2026-06-01
CVE-2026-10247SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross-site scripting5.1CNA v4.00.2%2026-06-01
CVE-2026-10246SourceCodester Pharmacy Sales and Inventory System medicine presentation form cross-site scripting5.1CNA v4.00.2%2026-06-01
CVE-2026-10245SourceCodester Pharmacy Sales and Inventory System main create_supplier cross-site scripting5.1CNA v4.00.2%2026-06-01
CVE-2026-10244SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross-site scripting5.1CNA v4.00.2%2026-06-01
CVE-2026-10243code-projects Smart Parking System Admin endpoint missing authentication6.9CNA v4.00.6%2026-06-01
CVE-2026-10242itsourcecode Content Management System instructions.php SQL injection5.3CNA v4.00.3%2026-06-01
CVE-2026-10241JeecgBoot file download utility server-side request forgery5.3CNA v4.00.3%2026-06-01Fix
CVE-2026-10240JeecgBoot test server-side request forgery5.3CNA v4.00.3%2026-06-01
CVE-2026-10239JeecgBoot edit WordUtil.addImage server-side request forgery5.3CNA v4.00.3%2026-06-01
CVE-2026-10237SourceCodester Water Billing Management System User Management manage_user SQL injection5.1CNA v4.00.3%2026-06-01
CVE-2026-10236SourceCodester Water Billing Management System user management improper authorization6.9CNA v4.00.4%2026-06-01
CVE-2026-10235CodeAstro Ingredients Stock Management System stock_manager.php SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10234Mettle sendportal Campaign webview cross-site scripting5.1CNA v4.00.2%2026-06-01
CVE-2026-10233Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_sequence_infos out-of-bounds4.8CNA v4.00.1%2026-06-01
CVE-2026-10232Assimp ASE file scene.cpp ~aiNode use-after-free4.8CNA v4.00.1%2026-06-01Fix
CVE-2026-10231Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp extract_anim_value heap-based overflow4.8CNA v4.00.1%2026-06-01
CVE-2026-10230Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_animations heap-based overflow4.8CNA v4.00.1%2026-06-01
CVE-2026-10229Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_meshes heap-based overflow4.8CNA v4.00.1%2026-06-01
CVE-2026-10228raisulislamg4 student_management_system_by_php admission_form_check.php cross-site scripting5.1CNA v4.00.2%2026-06-01
CVE-2026-10227raisulislamg4 student_management_system_by_php User Creation add_user_check.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10226raisulislamg4 student_management_system_by_php delete.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10225raisulislamg4 student_management_system_by_php Login login_check.php SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10224NousResearch hermes-agent Webhook endpoint feishu.py _handle_webhook_request resource consumption6.9CNA v4.00.4%2026-06-01
CVE-2026-10223NousResearch hermes-agent memory_tool.py _scan_memory_content injection5.3CNA v4.00.2%2026-06-01Fix
CVE-2026-10222NousResearch hermes-agent config.py _sanitize_env_lines injection6.3CNA v4.00.3%2026-06-01Fix
CVE-2026-10221NousResearch hermes-agent run_agent.py _compress_context injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10220NousResearch hermes-agent skills_tool.py skill_view injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10219nextlevelbuilder GoClaw write_file tool fsbridge.go FsBridge.WriteFile os command injection6.9CNA v4.01.3%2026-06-01
CVE-2026-10218nextlevelbuilder GoClaw evolution_handlers.go auth improper authorization5.3CNA v4.00.2%2026-06-01
CVE-2026-10217nextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management5.3CNA v4.00.2%2026-06-01
CVE-2026-10216unitedbyai droidclaw claim endpoint pairing.ts excessive authentication6.3CNA v4.00.4%2026-06-01
CVE-2026-10215Dolibarr ERP CRM is vulnerable to improper authorization through its Leave Request REST API5.3CNA v4.00.3%2026-06-01Fix
CVE-2026-10214zhayujie chatgpt-on-wechat Bash tool bash.py _get_safety_warning os command injection6.9CNA v4.01.3%2026-06-01Fix
CVE-2026-10213AstrBotDevs AstrBot API endpoint delete path traversal5.3CNA v4.00.4%2026-06-01
CVE-2026-10212AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization5.3CNA v4.00.2%2026-06-01
CVE-2026-10211AstrBotDevs AstrBot file path normalization incorrect authorization5.3CNA v4.00.2%2026-06-01
CVE-2026-10210AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10209code-projects Online Hospital Management System Appointment appointmentdetail.php SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10208code-projects Online Hospital Management System login_1.php login_user SQL injection6.9CNA v4.00.3%2026-06-01
CVE-2026-10206D-Link DI-8400 dbsrv.asp stack-based overflow8.7CNA v4.00.5%2026-06-01
CVE-2026-10205Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload5.3CNA v4.00.2%2026-06-01
CVE-2026-10204OFCMS JSON Query SysUserController.java query SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10203OFCMS JSON Query SystemParamController.java query SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10202OFCMS JSON Query SystemDictController.java query SQL injection5.3CNA v4.00.2%2026-06-01
CVE-2026-10201Assimp UV Channel FBXExporter.cpp WriteObjects divide by zero4.8CNA v4.00.1%2026-06-01
CVE-2026-10118Poppler Splash tiling pattern fill integer overflow7.8CNA v3.10.3%2026-06-01Fix
CVE-2026-9614Ivanti Neurons for ITSM (Cloud) improper access control8.8CNA v3.11.2%2026-06-01Fix
CVE-2026-9330IBM WebSphere Application Server is affected by remote code execution8.5CNA v3.10.7%2026-06-01Fix
CVE-2026-9319IBM WebSphere Application Server is affected by a remote code execution9.0CNA v3.10.6%2026-06-01Fix
CVE-2026-9311IBM WebSphere Application Server is affected by remote code execution9.0CNA v3.10.6%2026-06-01Fix
CVE-2026-9309Mozilla Firefox arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection5.4CISA ADP v3.10.3%2026-06-01Fix
CVE-2026-9308Mozilla Firefox arbitrary JavaScript execution in Reader view due to wrong HTML replacement order5.4CISA ADP v3.10.3%2026-06-01Fix
CVE-2026-9024Dassault Systèmes DELMIA Service Process Engineer stored cross-site scripting8.7CNA v3.10.4%2026-06-01
CVE-2026-8931Critical RCE vulnerability in Disig Web Signer9.4CNA v4.01.0%2026-06-01
CVE-2026-8644IBM WebSphere Application Server is affected by an identity spoofing9.1CNA v3.10.5%2026-06-01Fix
CVE-2026-8643pip can extract console_scripts and gui_scripts outside installation directory4.1CNA v4.00.5%2026-06-01Fix
CVE-2026-8501Symantec PC Tools Internet Security PCTCore64.sys Windows kernel driver improper access control7.8CISA ADP v3.10.2%2026-06-01
CVE-2026-8474Stormshield Network Security login API cross-site scripting5.3CNA v3.10.3%2026-06-01
CVE-2026-7858Deserialization of untrusted data vulnerability affecting Teamwork Cloud from no Magic Release 2022x9.8CNA v3.10.8%2026-06-01
CVE-2026-7770IBM i Access Client Solutions IBM i Navigator listener remote code execution8.8CNA v3.10.8%2026-06-01Fix
CVE-2026-5419Red Hat Enterprise Linux 10 gnutls: Gnutls: Information disclosure3.7CNA v3.10.6%2026-06-01Fix
CVE-2026-0826HP poly_trio_8300 Poly Voice possible Remote Control of certain Poly Devices9.2CNA v4.032.2%2026-06-01MetasploitEmerging ThreatsExploit codeFix
CVE-2026-0100Google Android LoadedArsc.cpp out-of-bounds write7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0099Google Android HostEmulationManager.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0098Google Android Shared.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0097Google Android multiple locations privilege escalation8.0CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0096Google Android ForgetDeviceDialogFragment.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0095Google Android l2c_fcr.cc privilege escalation8.0CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0094Google Android KeyChainActivity.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0093Google Android multiple locations privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0091Google Android multiple locations privilege escalation7.8CISA ADP v3.10.1%2026-06-01Exploit codeFix
CVE-2026-0089Google Android PackageInstallerService.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0088Google Android CertInstaller.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0087Google Android DomainVerificationService.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0086Google Android DisableSupervisionActivity.kt privilege escalation6.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0085Google Android DataRowHandler.java denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0080Google Android ubsan_throwing_runtime.cpp crash6.5CISA ADP v3.10.3%2026-06-01Fix
CVE-2026-0079Google Android ubsan_throwing_runtime.cpp denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0078Google Android DevicePolicyManagerService.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0077Google Android ActivityRecord.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0076Google Android ResourceTypes.cpp out-of-bounds read7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0075Google Android multiple functions privilege escalation5.9NVD v3.10.1%2026-06-01Exploit codeFix
CVE-2026-0074Google Android LauncherProcessImageListener.kt denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0072Google Android XR improper authorization10.0CNA v4.00.1%2026-06-01Fix
CVE-2026-0070Google Android DevicePolicyManagerService.java denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0069Google Android ApkChecksums.java crash5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0067Google Android ubsan_throwing_runtime.cpp denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0061Google Android WindowState.java privilege escalation5.9CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0060Google Android denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0059Google Android sdp_discovery.cc code execution8.0CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0056Google Android ResourceTypes.cpp information disclosure3.3CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0055Google Android PackageInstallerService.java privilege escalation6.2v3.10.1%2026-06-01Fix
CVE-2026-0052Google Android ubsan_throwing_runtime.cpp crash6.5CISA ADP v3.10.3%2026-06-01Fix
CVE-2026-0051Google Android ubsan_throwing_runtime.cpp crash6.5CISA ADP v3.10.3%2026-06-01Fix
CVE-2026-0050Google Android AdapterService.java information disclosure3.3CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0048Google Android WindowState.java privilege escalation6.8v3.10.1%2026-06-01Fix
CVE-2026-0046Google Android Letterbox.java privilege escalation6.2v3.10.1%2026-06-01Fix
CVE-2026-0045Google Android bta_jv_act.cc privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0044Google Android ubsan_throwing_runtime.cpp crash6.5CISA ADP v3.10.3%2026-06-01Fix
CVE-2026-0043Google Android ubsan_throwing_runtime.cpp denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0042Google Android ubsan_throwing_runtime.cpp denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0041Google Android ubsan_throwing_runtime.cpp denial of service6.5CISA ADP v3.10.3%2026-06-01Fix
CVE-2026-0040Google Android ubsan_throwing_runtime.cpp crash6.5CISA ADP v3.10.3%2026-06-01Fix
CVE-2026-0039Google Android ubsan_throwing_runtime.cpp denial of service6.5CISA ADP v3.10.3%2026-06-01Fix
CVE-2026-0036Google Android StageCoordinator.java privilege escalation7.8CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0018Google Android AccessibilityManagerService.java denial of service5.5CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0016Google Android CredentialManagerService.java information disclosure3.3CISA ADP v3.10.1%2026-06-01Fix
CVE-2026-0009Google Android multiple locations privilege escalation7.8CISA ADP v3.10.1%2026-06-01Exploit codeFix