# CVEs published 2026-06-12

280 CVEs were published on June 12, 2026: 32 critical, 114 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-11443](https://cve.now/CVE-2026-11443.md): Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability (CVSS 4.6, Allegra)
- [CVE-2026-11442](https://cve.now/CVE-2026-11442.md): Allegra exportReport Directory Traversal Information Disclosure Vulnerability (CVSS 6.5, Allegra)
- [CVE-2026-12068](https://cve.now/CVE-2026-12068.md): Avira Password Manager credential disclosure via cross-origin autofill in Firefox (CVSS 7.4, Gen Digital Avira Password Manager)
- [CVE-2026-6676](https://cve.now/CVE-2026-6676.md): Avira antivirus engine heap buffer OOB write when scanning a malformed POSIX tar archive (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-14098](https://cve.now/CVE-2025-14098.md): Avira antivirus engine heap buffer OOB write when scanning a malformed MS-DOS executable file (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-9033](https://cve.now/CVE-2025-9033.md): Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 3) (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-9032](https://cve.now/CVE-2025-9032.md): Avira antivirus engine heap buffer OOB read when scanning a malformed PE file (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-7019](https://cve.now/CVE-2025-7019.md): Avast antivirus stack overflow when scanning a malformed Office Open XML file (CVSS 5.5, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7018](https://cve.now/CVE-2025-7018.md): Avira antivirus engine null pointer dereference when scanning a malformed PE file (CVSS 5.5, Gen Digital Avira Antivirus)
- [CVE-2025-7017](https://cve.now/CVE-2025-7017.md): Avira antivirus engine heap buffer OOB read when scanning a malformed Windows MSI file (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-7011](https://cve.now/CVE-2025-7011.md): Avast antivirus heap OOB when scanning a malformed zip file (CVSS 7.8, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7010](https://cve.now/CVE-2025-7010.md): Avast antivirus stack overflow when scanning a malformed PDF file (CVSS 5.5, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7009](https://cve.now/CVE-2025-7009.md): Avast antivirus heap buffer OOB read when scanning a malformed PE file (CVSS 7.8, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7008](https://cve.now/CVE-2025-7008.md): Avast antivirus heap buffer OOB read when scanning a malformed PE file (CVSS 7.8, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7006](https://cve.now/CVE-2025-7006.md): Avast antivirus use of stack memory after free when scanning a malformed PE file (CVSS 5.5, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7005](https://cve.now/CVE-2025-7005.md): Avast antivirus infinite recursion when scanning a malformed PE file (CVSS 5.5, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7004](https://cve.now/CVE-2025-7004.md): Avast antivirus heap buffer OOB write when scanning a malformed PE file (CVSS 7.8, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7003](https://cve.now/CVE-2025-7003.md): Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 1) (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-7002](https://cve.now/CVE-2025-7002.md): Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 2) (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2026-41158](https://cve.now/CVE-2026-41158.md): GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-53868](https://cve.now/CVE-2026-53868.md): Capgo \< 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion (CVSS 8.7, Capgo)
- [CVE-2026-53867](https://cve.now/CVE-2026-53867.md): Capgo \< 12.128.2 - Orphaned File Retention via Profile Image Replacement (CVSS 5.3, Capgo)
- [CVE-2026-53839](https://cve.now/CVE-2026-53839.md): OpenClaw \< 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validation (CVSS 6.0, OpenClaw)
- [CVE-2026-53838](https://cve.now/CVE-2026-53838.md): OpenClaw \< 2026.5.27 - Node Pairing State Mutation via Reconnection (CVSS 6.0, OpenClaw)
- [CVE-2026-53837](https://cve.now/CVE-2026-53837.md): OpenClaw \< 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers (CVSS 6.3, OpenClaw)
- [CVE-2026-53836](https://cve.now/CVE-2026-53836.md): OpenClaw \< 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases (CVSS 8.7, OpenClaw)
- [CVE-2026-53835](https://cve.now/CVE-2026-53835.md): OpenClaw \< 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent Bindings (CVSS 2.3, OpenClaw)
- [CVE-2026-53834](https://cve.now/CVE-2026-53834.md): OpenClaw \< 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commands (CVSS 8.2, OpenClaw)
- [CVE-2026-53833](https://cve.now/CVE-2026-53833.md): QQBot for OpenClaw \< 2026.4.29 - Authorization Bypass via QQBot Streaming Command (CVSS 7.4, OpenClaw)
- [CVE-2026-53832](https://cve.now/CVE-2026-53832.md): OpenClaw \< 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration (CVSS 7.4, OpenClaw)
- [CVE-2026-53831](https://cve.now/CVE-2026-53831.md): OpenClaw \< 2026.5.18 - Arbitrary File Read via Shell Expansion in system.run Safe-bin Allowlist (CVSS 7.6, OpenClaw)
- [CVE-2026-53830](https://cve.now/CVE-2026-53830.md): OpenClaw \< 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reload (CVSS 6.0, OpenClaw)
- [CVE-2026-53829](https://cve.now/CVE-2026-53829.md): OpenClaw \< 2026.5.18 - Command Truncation in Exec Approval Display (CVSS 8.5, OpenClaw)
- [CVE-2026-53828](https://cve.now/CVE-2026-53828.md): OpenClaw \< 2026.5.6 - Native Command Authorization Bypass via Owner-Command Enforcement (CVSS 7.7, OpenClaw)
- [CVE-2026-53827](https://cve.now/CVE-2026-53827.md): OpenClaw \< 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action Forwarding (CVSS 6.0, OpenClaw)
- [CVE-2026-53826](https://cve.now/CVE-2026-53826.md): OpenClaw \< 2026.4.26 - Information Disclosure via Sandboxed Session Spawn (CVSS 2.3, OpenClaw)
- [CVE-2026-53825](https://cve.now/CVE-2026-53825.md): OpenClaw \< 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scope (CVSS 7.1, OpenClaw)
- [CVE-2026-53824](https://cve.now/CVE-2026-53824.md): Mattermost plugin for OpenClaw \< 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delay (CVSS 6.0, OpenClaw)
- [CVE-2026-53823](https://cve.now/CVE-2026-53823.md): OpenClaw \< 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFrom (CVSS 8.6, OpenClaw)
- [CVE-2026-53822](https://cve.now/CVE-2026-53822.md): OpenClaw \< 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution (CVSS 8.7, OpenClaw)
- [CVE-2026-53821](https://cve.now/CVE-2026-53821.md): OpenClaw \< 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocket (CVSS 8.7, OpenClaw)
- [CVE-2026-53820](https://cve.now/CVE-2026-53820.md): OpenClaw \< 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session Spawn (CVSS 6.9, OpenClaw)
- [CVE-2026-41157](https://cve.now/CVE-2026-41157.md): GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D (CVSS 9.8, Imagination Technologies Graphics DDK)
- [CVE-2026-41155](https://cve.now/CVE-2026-41155.md): GPU DDK - SharedSecMem mapped into all GPU virtual address spaces (CVSS 5.5, Imagination Technologies Graphics DDK)
- [CVE-2026-34195](https://cve.now/CVE-2026-34195.md): GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes (CVSS 8.8, Imagination Technologies Graphics DDK)
- [CVE-2026-12131](https://cve.now/CVE-2026-12131.md): CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection (CVSS 5.3, CodeAstro Human Resource Management System)
- [CVE-2026-54398](https://cve.now/CVE-2026-54398.md): MISP object edit authorization bypass allows unauthorized sharing group assignment (CVSS 5.3, misp)
- [CVE-2026-53523](https://cve.now/CVE-2026-53523.md): Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection (CVSS 6.8, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53522](https://cve.now/CVE-2026-53522.md): Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS (CVSS 6.5, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53521](https://cve.now/CVE-2026-53521.md): Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context (CVSS 6.4, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53520](https://cve.now/CVE-2026-53520.md): Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing (CVSS 6.5, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53519](https://cve.now/CVE-2026-53519.md): Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt\_secret\_key (CVSS 9.1, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-49397](https://cve.now/CVE-2026-49397.md): Nezha Monitoring: Private services (\`EnableShowInService: false\`) are enumerable via per-server endpoints, leaking name and timing data (CVSS 5.3, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-49396](https://cve.now/CVE-2026-49396.md): Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents (CVSS 7.1, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-48119](https://cve.now/CVE-2026-48119.md): Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services (CVSS 7.1, nezhahq nezha · github.com/naiba/nezha +1)
- [CVE-2026-47124](https://cve.now/CVE-2026-47124.md): Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members (CVSS 6.5, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-47120](https://cve.now/CVE-2026-47120.md): Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) (CVSS 7.1, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-46717](https://cve.now/CVE-2026-46717.md): Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification (CVSS 7.7, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-46716](https://cve.now/CVE-2026-46716.md): Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron (CVSS 9.9, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53609](https://cve.now/CVE-2026-53609.md): Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass (CVSS 9.1, apostrophecms apostrophe · apostrophe)
- [CVE-2026-53608](https://cve.now/CVE-2026-53608.md): @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag (CVSS 8.7, @apostrophecms/seo)
- [CVE-2026-47268](https://cve.now/CVE-2026-47268.md): Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host (CVSS 6.4, nezhahq nezha · github.com/naiba/nezha +1)
- [CVE-2026-54397](https://cve.now/CVE-2026-54397.md): MISP event editing allows unauthorized assignment to undisclosed sharing groups (CVSS 6.1, misp)
- [CVE-2026-53607](https://cve.now/CVE-2026-53607.md): @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header (CVSS 3.7, apostrophecms apostrophe · apostrophe)
- [CVE-2026-4870](https://cve.now/CVE-2026-4870.md): Qiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain… (CVSS 7.5, IBM Qiskit SDK)
- [CVE-2026-53606](https://cve.now/CVE-2026-53606.md): sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and… (CVSS 5.4, apostrophecms sanitize-html · sanitize-html)
- [CVE-2026-45014](https://cve.now/CVE-2026-45014.md): Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip (CVSS 5.3, apostrophecms apostrophe)
- [CVE-2026-54396](https://cve.now/CVE-2026-54396.md): MISP AuthKey edit endpoint allows authenticated user email enumeration (CVSS 5.3, misp)
- [CVE-2026-45013](https://cve.now/CVE-2026-45013.md): Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation (CVSS 8.1, apostrophecms apostrophe · apostrophe)
- [CVE-2026-24618](https://cve.now/CVE-2026-24618.md): WordPress Hash Elements plugin \<= 1.5.4 - Sensitive Data Exposure vulnerability (CVSS 4.3, HashThemes Hash Elements)
- [CVE-2026-12130](https://cve.now/CVE-2026-12130.md): CodeAstro Human Resource Management System Projects Management Add\_Projects cross site scripting (CVSS 5.1, CodeAstro Human Resource Management System)
- [CVE-2026-45012](https://cve.now/CVE-2026-45012.md): Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget (CVSS 7.6, apostrophecms apostrophe · apostrophe)
- [CVE-2026-45011](https://cve.now/CVE-2026-45011.md): Apostrophe has stored XSS via javascript: URL in Image Widget Link (CVSS 7.3, apostrophecms apostrophe · apostrophe)
- [CVE-2026-44990](https://cve.now/CVE-2026-44990.md): Apostrophe has default XSS via \`xmp\` raw-text passthrough in \`sanitize-html\` (CVSS 9.3, apostrophecms sanitize-html · sanitize-html)
- [CVE-2026-42853](https://cve.now/CVE-2026-42853.md): @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input (CVSS 6.5, @apostrophecms/cli)
- [CVE-2026-54395](https://cve.now/CVE-2026-54395.md): MISP UiBeta event index reflected XSS in advanced filter popup (CVSS 5.3, misp)
- [CVE-2026-54394](https://cve.now/CVE-2026-54394.md): MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files (CVSS 5.3, misp)
- [CVE-2026-12129](https://cve.now/CVE-2026-12129.md): CodeAstro Human Resource Management System Dashboard add\_tod cross site scripting (CVSS 5.1, CodeAstro Human Resource Management System)
- [CVE-2026-47264](https://cve.now/CVE-2026-47264.md): Discourse: Don't leak restricted tag group names via tag info (CVSS 5.3, discourse)
- [CVE-2026-47263](https://cve.now/CVE-2026-47263.md): Discourse: Prevent webhook payload disclosure on event redelivery (CVSS 4.3, discourse)
- [CVE-2026-45775](https://cve.now/CVE-2026-45775.md): Discourse: Cross-site backup access via path traversal in multisite local backups (CVSS 6.8, discourse)
- [CVE-2026-45085](https://cve.now/CVE-2026-45085.md): Discourse: Chat misauthorization and information disclosure (CVSS 5.3, discourse)
- [CVE-2026-44785](https://cve.now/CVE-2026-44785.md): Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts (CVSS 4.3, discourse)
- [CVE-2026-44784](https://cve.now/CVE-2026-44784.md): Discourse: Non-staff group owners can see email password in plaintext through group history (CVSS 6.5, discourse)
- [CVE-2026-44783](https://cve.now/CVE-2026-44783.md): Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts (CVSS 5.4, discourse)
- [CVE-2026-44782](https://cve.now/CVE-2026-44782.md): Discourse: GroupPostSerializer leaks hidden full names through reaction post association (CVSS 4.3, discourse)
- [CVE-2026-44780](https://cve.now/CVE-2026-44780.md): Discourse: Category queue reviewers can read raw incoming emails from queued posts (CVSS 4.3, discourse)
- [CVE-2026-44779](https://cve.now/CVE-2026-44779.md): Discourse: Bot debug endpoints disclose whisper translation audit logs (CVSS 4.3, discourse)
- [CVE-2026-44786](https://cve.now/CVE-2026-44786.md): Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users (CVSS 7.5, discourse)
- [CVE-2026-54393](https://cve.now/CVE-2026-54393.md): MISP Overmind theme stored XSS via unvalidated homepage setting (CVSS 5.1, misp)
- [CVE-2026-54362](https://cve.now/CVE-2026-54362.md): MISP template builder exposes non-visible custom galaxies across organisations (CVSS 5.3, misp)
- [CVE-2026-54057](https://cve.now/CVE-2026-54057.md): Kitty vulnerable to command injection via unsanitized OSC 21 query reply (CVSS 7.3, kovidgoyal kitty)
- [CVE-2026-54056](https://cve.now/CVE-2026-54056.md): Kitty has an arbitrary file overwrite via symlink following in \`kitten dnd\` remote drop staging (CVSS 7.6, kovidgoyal kitty)
- [CVE-2026-54055](https://cve.now/CVE-2026-54055.md): Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol (CVSS 5.0, kovidgoyal kitty)
- [CVE-2026-42851](https://cve.now/CVE-2026-42851.md): @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE (CVSS 7.8, kovidgoyal kitty)
- [CVE-2026-54361](https://cve.now/CVE-2026-54361.md): MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records (CVSS 8.8, misp)
- [CVE-2026-42850](https://cve.now/CVE-2026-42850.md): Kitty has a shell command injection (CVSS 7.4, kovidgoyal kitty)
- [CVE-2026-54360](https://cve.now/CVE-2026-54360.md): MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups (CVSS 8.4, misp)
- [CVE-2026-54359](https://cve.now/CVE-2026-54359.md): MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default (CVSS 7.1, misp)
- [CVE-2026-54358](https://cve.now/CVE-2026-54358.md): MISP organization administrators can target site administrator accounts for password reset (CVSS 7.5, misp)
- [CVE-2026-54357](https://cve.now/CVE-2026-54357.md): MISP improper authorization allows organization administrators to modify site administrator user settings (CVSS 5.1, misp)
- [CVE-2026-43872](https://cve.now/CVE-2026-43872.md): actual-server has a path traversal vulnerability (CVSS 5.3, actualbudget actual)
- [CVE-2026-42890](https://cve.now/CVE-2026-42890.md): actual Allows Electron to Run As Node (CVSS 4.8, actualbudget actual · actual)
- [CVE-2026-50552](https://cve.now/CVE-2026-50552.md): Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail (CVSS 6.3, koel · phanan/koel)
- [CVE-2026-47260](https://cve.now/CVE-2026-47260.md): Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs (CVSS 7.7, koel · phanan/koel)
- [CVE-2026-50287](https://cve.now/CVE-2026-50287.md): Missing Authentication for Critical Function in @agenticmail/mcp (CVSS 8.7, agenticmail · @agenticmail/mcp)
- [CVE-2026-42604](https://cve.now/CVE-2026-42604.md): Actual has an OpenID \`client\_secret\` Disclosure via Broken Authorization Guard in \`/openid/config\` (CVSS 6.9, actualbudget actual)
- [CVE-2026-53726](https://cve.now/CVE-2026-53726.md): Parse Server: Relation \`$relatedTo\` query bypasses \`protectedFields\` and owning-object ACL (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-12043](https://cve.now/CVE-2026-12043.md): Heap double-free in AWS Common Runtime aws-c-http (CVSS 8.8, aws-c-http)
- [CVE-2026-53725](https://cve.now/CVE-2026-53725.md): Parse Server: Endpoints \`/login\` and \`/verifyPassword\` disclose MFA secrets and protected fields when \`\_User\` get is denied (CVSS 5.9, parse-community parse-server · parse-server)
- [CVE-2026-53724](https://cve.now/CVE-2026-53724.md): Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist (CVSS 2.1, parse-community parse-server · parse-server)
- [CVE-2026-50099](https://cve.now/CVE-2026-50099.md): Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory (CVSS 5.1, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-50008](https://cve.now/CVE-2026-50008.md): Parse Server: Server option routeAllowList is bypassable through batch sub-requests (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-10715](https://cve.now/CVE-2026-10715.md): Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint (CVSS 5.1, Camaleon CMS)
- [CVE-2026-47138](https://cve.now/CVE-2026-47138.md): Parse Server: Pre-authentication denial of service via client version header regex backtracking (CVSS 8.7, parse-community parse-server · parse-server)
- [CVE-2026-47248](https://cve.now/CVE-2026-47248.md): Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-50244](https://cve.now/CVE-2026-50244.md): Naxclow IoT Platform Missing Authorization (CVSS 6.9, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-42932](https://cve.now/CVE-2026-42932.md): Naxclow IoT Platform Generation of Predictable Numbers or Identifiers (CVSS 6.9, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-42947](https://cve.now/CVE-2026-42947.md): Naxclow IoT Platform Authorization bypass through User-Controlled key (CVSS 8.7, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-47236](https://cve.now/CVE-2026-47236.md): Solidtime team page exposes pending invitation and member emails to employees who lack invitations:view/members:view permission (CVSS 4.3, solidtime-io solidtime)
- [CVE-2026-50108](https://cve.now/CVE-2026-50108.md): Naxclow IoT Platform Missing Authorization (CVSS 8.7, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-42306](https://cve.now/CVE-2026-42306.md): Moby: Race condition in docker cp allows bind mount redirection to host path (CVSS 7.2, moby · github.com/docker/docker +2)
- [CVE-2026-41568](https://cve.now/CVE-2026-41568.md): Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap (CVSS 6.1, moby · github.com/docker/docker +2)
- [CVE-2026-50101](https://cve.now/CVE-2026-50101.md): Naxclow IoT Platform Not using password aging (CVSS 9.2, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-28742](https://cve.now/CVE-2026-28742.md): Naxclow IoT Platform Use of hard-coded cryptographic key (CVSS 9.2, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-12143](https://cve.now/CVE-2026-12143.md): form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) (CVSS 8.7, form-data)
- [CVE-2026-53408](https://cve.now/CVE-2026-53408.md): Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may… (CVSS 8.1, Zoom Communications Zoom Workplace)
- [CVE-2026-53407](https://cve.now/CVE-2026-53407.md): Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may… (CVSS 8.1, Zoom Communications Zoom Workplace)
- [CVE-2026-53406](https://cve.now/CVE-2026-53406.md): Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an… (CVSS 7.8, Zoom Communications Remote Control for Zoom Contact Center)
- [CVE-2026-48165](https://cve.now/CVE-2026-48165.md): MariaDB: unsafe usage of \`wsrep\_sst\_receive\_address\` values on the joiner side (CVSS 8.0, MariaDB server)
- [CVE-2026-48163](https://cve.now/CVE-2026-48163.md): MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync) (CVSS 8.0, MariaDB server)
- [CVE-2026-44173](https://cve.now/CVE-2026-44173.md): MariaDB: FILE privilege was not checked for subqueries in the FROM clause (CVSS 5.0, MariaDB server)
- [CVE-2026-44172](https://cve.now/CVE-2026-44172.md): MariaDB: mysql\_real\_escape\_string() incorrectly handled big5 (CVSS 6.9, MariaDB server · mariadb)
- [CVE-2026-44171](https://cve.now/CVE-2026-44171.md): MariaDB: path traversal in mbstream (CVSS 6.3, MariaDB server)
- [CVE-2026-44169](https://cve.now/CVE-2026-44169.md): MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions (CVSS 4.3, MariaDB server)
- [CVE-2026-44168](https://cve.now/CVE-2026-44168.md): MariaDB: wsrep SST unsafe parameter handling on the donor side (CVSS 8.0, MariaDB server)
- [CVE-2026-44170](https://cve.now/CVE-2026-44170.md): MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL (CVSS 6.3, MariaDB server)
- [CVE-2026-47216](https://cve.now/CVE-2026-47216.md): Typesense: Unauthenticated Denial of Service in the Typesense /multi\_search Endpoint (CVSS 8.7, typesense)
- [CVE-2026-47225](https://cve.now/CVE-2026-47225.md): Improper Search Cache Isolation for Scoped Search API Keys in Typesense (CVSS 6.0, typesense)
- [CVE-2026-47965](https://cve.now/CVE-2026-47965.md): Acrobat Reader | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Acrobat DC · Adobe Acrobat Reader DC +1)
- [CVE-2026-48558](https://cve.now/CVE-2026-48558.md): SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification (CVSS 9.5, KEV, SimpleHelp)
- [CVE-2026-47223](https://cve.now/CVE-2026-47223.md): NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow (CVSS 5.4, M2Team NanaZip)
- [CVE-2026-47224](https://cve.now/CVE-2026-47224.md): NanaZip: Heap buffer-overflow read in NanaZip LVM metadata CRC check (CVSS 4.3, M2Team NanaZip)
- [CVE-2026-47222](https://cve.now/CVE-2026-47222.md): NanaZip: Heap out-of-bounds read in NanaZip AVB property descriptor parser via unsigned integer underflow (CVSS 5.4, M2Team NanaZip)
- [CVE-2026-53982](https://cve.now/CVE-2026-53982.md): Cap-go Console \< 12.28.2 Account Deletion DoS via Device Identifier Association (CVSS 7.1, Cap-go capgo)
- [CVE-2026-6961](https://cve.now/CVE-2026-6961.md): CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync (CVSS 7.6, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-7387](https://cve.now/CVE-2026-7387.md): Mattermost group syncable endpoints allow privilege escalation via scheme\_admin (CVSS 8.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-6046](https://cve.now/CVE-2026-6046.md): Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server (CVSS 5.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-6689](https://cve.now/CVE-2026-6689.md): Missing {{invite\_user}} permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-7184](https://cve.now/CVE-2026-7184.md): Mattermost Remote Cluster PATCH API Leaks Authentication Tokens (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-6739](https://cve.now/CVE-2026-6739.md): Mattermost: Delegated admins could patch protected default system roles (CVSS 6.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-3433](https://cve.now/CVE-2026-3433.md): Mattermost fails to scope role\_updated websocket events to authorized team and channel members (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-3840](https://cve.now/CVE-2026-3840.md): Path Traversal in kedro-org/kedro (CVSS 7.1, kedro-org/kedro)
- [CVE-2026-53981](https://cve.now/CVE-2026-53981.md): Cap-go \< v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism (CVSS 7.2, Cap-go)
- [CVE-2026-45833](https://cve.now/CVE-2026-45833.md): A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary… (CVSS 9.4, ChromaDB)
- [CVE-2026-45832](https://cve.now/CVE-2026-45832.md): All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing… (CVSS 8.8, ChromaDB)
- [CVE-2026-45831](https://cve.now/CVE-2026-45831.md): The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a… (CVSS 8.8, ChromaDB)
- [CVE-2026-50091](https://cve.now/CVE-2026-50091.md): Aqara Home Android SDK hardcoded keys (CVSS 9.1, com.lumiunited.aqarahome)
- [CVE-2026-50090](https://cve.now/CVE-2026-50090.md): Aqara OAuth redirect\_uri validation bypass (CVSS 9.3, Aqara Cloud OAuth Authorization Endpoint)
- [CVE-2026-50089](https://cve.now/CVE-2026-50089.md): Aqara IAM/SSO Gateway open redirect (CVSS 6.1, Aqara IAM/SSO Gateway)
- [CVE-2026-50088](https://cve.now/CVE-2026-50088.md): Aqara Developer Portal cross-origin resource sharing (CVSS 8.2, Aqara Developer Portal · Aqara Developer Test Portal)
- [CVE-2026-50087](https://cve.now/CVE-2026-50087.md): Aqara IAM/SSO Gateway cross-origin resource sharing (CVSS 8.2, Aqara IAM/SSO Gateway)
- [CVE-2026-50086](https://cve.now/CVE-2026-50086.md): Aqara unauthenticated AES oracle (CVSS 10.0, Aqara IAM/SSO Gateway)
- [CVE-2026-50085](https://cve.now/CVE-2026-50085.md): Aqara Board IoT insecure debug API (CVSS 8.6, Aqara Board service)
- [CVE-2026-50084](https://cve.now/CVE-2026-50084.md): Aqara API cross-account access (CVSS 9.6, Aqara Cloud Production API)
- [CVE-2026-50083](https://cve.now/CVE-2026-50083.md): Aqara hardcoded OAuth client credentials (CVSS 9.1, Aqara Aquara IAM/SSO Gateway)
- [CVE-2026-50082](https://cve.now/CVE-2026-50082.md): Aqara Developer Portal insecure authentication token (CVSS 6.5, Aqara Cloud Developer Portal)
- [CVE-2026-50560](https://cve.now/CVE-2026-50560.md): Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (CVSS 6.9, netty · io.netty:netty-codec-http2)
- [CVE-2026-9641](https://cve.now/CVE-2026-9641.md): Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations (CVSS 5.3, ARODLAND Crypt::PBKDF2)
- [CVE-2026-46690](https://cve.now/CVE-2026-46690.md): unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race (CVSS 5.8, spearman unbounded-spsc · unbounded-spsc)
- [CVE-2026-50020](https://cve.now/CVE-2026-50020.md): Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted (CVSS 5.3, netty · io.netty:netty-codec-http)
- [CVE-2026-50011](https://cve.now/CVE-2026-50011.md): Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length (CVSS 7.5, netty · io.netty:netty-codec-redis)
- [CVE-2026-44967](https://cve.now/CVE-2026-44967.md): opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response (CVSS 5.3, open-telemetry opentelemetry-cpp)
- [CVE-2026-50010](https://cve.now/CVE-2026-50010.md): Netty's wrapping plain trust manager silently disables hostname verification (CVSS 7.5, netty · io.netty:netty-handler)
- [CVE-2026-8828](https://cve.now/CVE-2026-8828.md): A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily… (CVSS 8.8, ChromaDB)
- [CVE-2026-47190](https://cve.now/CVE-2026-47190.md): IPAM controller service account granted unnecessary full access to Secrets (CVSS 4.4, metal3-io ip-address-manager · github.com/metal3-io/ip-addr…)
- [CVE-2026-50009](https://cve.now/CVE-2026-50009.md): Netty QUIC stateless reset token material exposed through header-visible connection IDs (CVSS 4.8, netty · io.netty:netty-codec-classes-quic)
- [CVE-2026-45830](https://cve.now/CVE-2026-45830.md): A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily… (CVSS 8.8, ChromaDB)
- [CVE-2026-53568](https://cve.now/CVE-2026-53568.md): Frappe: Stored XSS in Frappe Report/List View via 'set\_link\_title\_field\_value' (CVSS 6.9, frappe)
- [CVE-2026-48748](https://cve.now/CVE-2026-48748.md): Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion (CVSS 7.5, netty · io.netty:netty-codec-http3)
- [CVE-2026-50026](https://cve.now/CVE-2026-50026.md): Frappe: Lack of permissions checks in 'relink' and 'set\_email\_password' endpoints (CVSS 6.9, frappe)
- [CVE-2026-48059](https://cve.now/CVE-2026-48059.md): Netty HAProxy: Unbalanced Reference Count in Nested PP2\_TYPE\_SSL TLV Parsing Leads to Memory Exhaustion (CVSS 8.7, netty · io.netty:netty-codec-haproxy)
- [CVE-2026-9638](https://cve.now/CVE-2026-9638.md): Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts (CVSS 7.5, ARODLAND Crypt::PBKDF2)
- [CVE-2026-47182](https://cve.now/CVE-2026-47182.md): Frappe: Broken Access Control on Private Files (CVSS 5.3, frappe)
- [CVE-2026-48043](https://cve.now/CVE-2026-48043.md): netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion (CVSS 5.3, netty · io.netty:netty-codec-http2)
- [CVE-2026-44976](https://cve.now/CVE-2026-44976.md): Frappe: IDOR in update\_onboarding\_step (CVSS 5.3, frappe)
- [CVE-2026-48006](https://cve.now/CVE-2026-48006.md): Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVSS 8.7, netty · io.netty:netty-codec-redis)
- [CVE-2026-44975](https://cve.now/CVE-2026-44975.md): Frappe: Missing authorization on reset form tours (CVSS 5.3, frappe)
- [CVE-2026-44206](https://cve.now/CVE-2026-44206.md): Frappe: DB Schema Enumeration via Frappe-Authorization-Source (CVSS 6.9, frappe)
- [CVE-2026-47691](https://cve.now/CVE-2026-47691.md): Netty has Insufficient Bailiwick Validation for NS Records (CVSS 8.7, netty · io.netty:netty-resolver-dns)
- [CVE-2026-40677](https://cve.now/CVE-2026-40677.md): The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially… (CVSS 7.7, AMD Management Console · AMD Ryzen™ Master +1)
- [CVE-2026-44207](https://cve.now/CVE-2026-44207.md): Frappe: Insecure Direct Object Reference for email accounts (CVSS 6.9, frappe)
- [CVE-2026-5792](https://cve.now/CVE-2026-5792.md): Authentication Bypass in Hedef Media's Related Marketing Cloud (RMC) (CVSS 6.5, Hedef Media Promotion Interactive Media Marketing Related M…)
- [CVE-2026-44208](https://cve.now/CVE-2026-44208.md): Frappe: IDOR in \`submit\_discussion()\` (CVSS 6.9, frappe)
- [CVE-2026-47244](https://cve.now/CVE-2026-47244.md): Netty HTTP/2: Advertised MAX\_CONCURRENT\_STREAMS are not enforced (CVSS 5.3, netty · io.netty:netty-codec-http2)
- [CVE-2026-44205](https://cve.now/CVE-2026-44205.md): Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload (CVSS 6.9, frappe)
- [CVE-2026-41581](https://cve.now/CVE-2026-41581.md): Frappe Vulnerable to Possible SQL Injection via get\_blog\_list (CVSS 6.9, frappe)
- [CVE-2026-47739](https://cve.now/CVE-2026-47739.md): Frappe: Stored XSS in Note (CVSS 6.9, frappe)
- [CVE-2026-46340](https://cve.now/CVE-2026-46340.md): Netty: SCTP reassembly nests buffers without bound (CVSS 7.5, netty · io.netty:netty-transport-sctp)
- [CVE-2026-45674](https://cve.now/CVE-2026-45674.md): Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (CVSS 8.7, netty · io.netty:netty-resolver-dns)
- [CVE-2026-47141](https://cve.now/CVE-2026-47141.md): vm2: NodeVM observability builtins leak host process and HTTP request data (CVSS 6.9, patriksimek vm2 · vm2)
- [CVE-2026-47210](https://cve.now/CVE-2026-47210.md): vm2 sandbox escape via JSPI-backed Promise \`.finally()\` species bypass (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2026-47208](https://cve.now/CVE-2026-47208.md): vm2: Sandbox Breakout Using Promise Species (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-47140](https://cve.now/CVE-2026-47140.md): vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-45673](https://cve.now/CVE-2026-45673.md): Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port (CVSS 6.8, netty · io.netty:netty-resolver-dns)
- [CVE-2026-47139](https://cve.now/CVE-2026-47139.md): vm2: NodeVM network builtin exclusions bypass via internal \_http\_client and \_http\_server (CVSS 8.6, patriksimek vm2 · vm2)
- [CVE-2026-47137](https://cve.now/CVE-2026-47137.md): vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-47135](https://cve.now/CVE-2026-47135.md): vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks (CVSS 8.7, patriksimek vm2 · vm2)
- [CVE-2026-47131](https://cve.now/CVE-2026-47131.md): vm2: Sandbox Escape (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-47209](https://cve.now/CVE-2026-47209.md): vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain (CVSS 8.6, patriksimek vm2 · vm2)
- [CVE-2026-45536](https://cve.now/CVE-2026-45536.md): Netty: Unix-socket fd receive leaks descriptors when peer sends two at once (CVSS 4.0, netty · io.netty:netty-transport-native-epoll +1)
- [CVE-2026-8694](https://cve.now/CVE-2026-8694.md): Improper access control on the API documentation endpoint in PowerShell Universal (CVSS 5.3, Devolutions PowerShell Universal)
- [CVE-2026-6211](https://cve.now/CVE-2026-6211.md): Arbitrary File Upload in Global IT's WEOLL (CVSS 8.7, Global IT Informatics Services WEOLL)
- [CVE-2026-45416](https://cve.now/CVE-2026-45416.md): Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (CVSS 7.5, netty · io.netty:netty-handler)
- [CVE-2026-44894](https://cve.now/CVE-2026-44894.md): Netty's Default QUIC token handler accepts any client-supplied token (CVSS 7.5, netty · io.netty:netty-codec-classes-quic)
- [CVE-2026-10557](https://cve.now/CVE-2026-10557.md): Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials (CVSS 9.3, Yarbo Android/IOS mobile application · Yarbo Cloud MQTT inf…)
- [CVE-2026-7368](https://cve.now/CVE-2026-7368.md): Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization (CVSS 8.6, Yarbo Android/IOS mobile application · Yarbo Cloud MQTT inf…)
- [CVE-2026-44893](https://cve.now/CVE-2026-44893.md): Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length (CVSS 7.5, netty · io.netty:netty-codec-haproxy)
- [CVE-2026-54133](https://cve.now/CVE-2026-54133.md): jmespath.php has CompilerRuntime code injection via unescaped function names (CVSS 9.8, jmespath.php · mtdowling/jmespath.php)
- [CVE-2026-53787](https://cve.now/CVE-2026-53787.md): Amasty Order Attributes for Magento 2 \< 4.0.0 Unauthenticated Arbitrary File Upload (CVSS 9.3, Amasty Order Attributes for Magento)
- [CVE-2026-6853](https://cve.now/CVE-2026-6853.md): OTP Bypass in Başbelen Group's Pause+ Mobile App (CVSS 9.8, Başbelen Group Food Cafe Businesses Industry and Trade Ltd.…)
- [CVE-2026-53722](https://cve.now/CVE-2026-53722.md): Nuxt: Reflected XSS in \`\<NuxtLink\>\` via unsanitised \`javascript:\` or \`data:\` URL (CVSS 5.1, nuxt)
- [CVE-2026-53721](https://cve.now/CVE-2026-53721.md): Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher (CVSS 8.8, nuxt)
- [CVE-2026-11967](https://cve.now/CVE-2026-11967.md): Arbitrary code execution in MobaXterm Personal Edition (Portable) (CVSS 8.5, Mobatek MobaXterm Personal Edition)
- [CVE-2026-11879](https://cve.now/CVE-2026-11879.md): Arbitrary code execution in MobaXterm Personal Edition (Portable) (CVSS 8.5, Mobatek MobaXterm Personal Edition)
- [CVE-2026-1836](https://cve.now/CVE-2026-1836.md): Stored credentials in Redmine (CVSS 5.3, Redmine)
- [CVE-2017-20240](https://cve.now/CVE-2017-20240.md): Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks (CVSS 5.9, ARODLAND Crypt::PBKDF2)
- [CVE-2026-12066](https://cve.now/CVE-2026-12066.md): PbootCMS Password MemberController.php retrieve password recovery (CVSS 6.9, PbootCMS)
- [CVE-2026-47200](https://cve.now/CVE-2026-47200.md): Nuxt: Route middleware not enforced when rendering \`.server.vue\` pages via \`/\_\_nuxt\_island/page\_\*\` (CVSS 6.3, nuxt · @nuxt/nitro-server)
- [CVE-2026-49993](https://cve.now/CVE-2026-49993.md): @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all… (CVSS 5.9, nuxt · @nuxt/webpack-builder +1)
- [CVE-2026-45669](https://cve.now/CVE-2026-45669.md): Nuxt: Reflected XSS in \`navigateTo()\` external redirect (CVSS 5.3, nuxt)
- [CVE-2026-45670](https://cve.now/CVE-2026-45670.md): Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) (CVSS 5.9, nuxt · @nuxt/rspack-builder +1)
- [CVE-2026-46342](https://cve.now/CVE-2026-46342.md): Nuxt: \`\_\_nuxt\_island\` endpoint does not bind responses to request props, enabling shared-cache poisoning (CVSS 2.3, nuxt · @nuxt/nitro-server)
- [CVE-2026-12065](https://cve.now/CVE-2026-12065.md): Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme (CVSS 1.0, Groww Stock, Mutual Fund, Gold App)
- [CVE-2026-49347](https://cve.now/CVE-2026-49347.md): Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown (CVSS 5.3, duck-organization questbot)
- [CVE-2026-48485](https://cve.now/CVE-2026-48485.md): Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through \`/warns\`. (CVSS 2.1, duck-organization questbot)
- [CVE-2026-47197](https://cve.now/CVE-2026-47197.md): Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands (CVSS 7.2, duck-organization questbot)
- [CVE-2026-47195](https://cve.now/CVE-2026-47195.md): Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands. (CVSS 7.1, duck-organization questbot)
- [CVE-2026-47196](https://cve.now/CVE-2026-47196.md): Quest Bot: Empty automod rule causes every guild message to be deleted (CVSS 8.4, duck-organization questbot)
- [CVE-2026-9266](https://cve.now/CVE-2026-9266.md): A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and… (CVSS 7.0, Moxa UC-1200A Series)
- [CVE-2026-11849](https://cve.now/CVE-2026-11849.md): IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded Credentials (CVSS 9.3, IEI Integration iRM-TSi410X)
- [CVE-2026-11848](https://cve.now/CVE-2026-11848.md): IEI Integration Corp｜ iRM-IEI Remote Management - Missing Authentication (CVSS 7.9, IEI Integration iRM-TSi410X)
- [CVE-2026-48914](https://cve.now/CVE-2026-48914.md): Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling (CVSS 6.7, qemu · Red Hat Enterprise Linux +1)
- [CVE-2026-11847](https://cve.now/CVE-2026-11847.md): Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion (CVSS 5.3, IEI Integration iVEC TANK-XM811)
- [CVE-2026-11846](https://cve.now/CVE-2026-11846.md): IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion (CVSS 7.2, IEI Integration iVEC TANK-XM811)
- [CVE-2026-11845](https://cve.now/CVE-2026-11845.md): IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command Injection (CVSS 8.6, IEI Integration iVEC TANK-XM811)
- [CVE-2026-11844](https://cve.now/CVE-2026-11844.md): IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Read (CVSS 6.9, IEI Integration iVEC TANK-XM811)
- [CVE-2026-50645](https://cve.now/CVE-2026-50645.md): Apache CXF: No restriction on attachment headers per message (CVSS 7.5, Apache Software Foundation org.apache.cxf:cxf-core · org.ap…)
- [CVE-2026-50634](https://cve.now/CVE-2026-50634.md): Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry (CVSS 6.5, Apache Software Foundation org.apache.cxf:cxf-rt-rs-securit…)
- [CVE-2026-50633](https://cve.now/CVE-2026-50633.md): Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl (CVSS 8.1, Apache Software Foundation org.apache.cxf:cxf-integration-j…)
- [CVE-2026-50632](https://cve.now/CVE-2026-50632.md): Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory (CVSS 8.1, Apache Software Foundation org.apache.cxf:cxf-rt-transports…)
- [CVE-2026-50631](https://cve.now/CVE-2026-50631.md): Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing (CVSS 7.4, Apache Software Foundation org.apache.cxf:cxf-rt-rs-securit…)
- [CVE-2026-50630](https://cve.now/CVE-2026-50630.md): Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection (CVSS 6.5, Apache Software Foundation org.apache.cxf:cxf-rt-rs-securit…)
- [CVE-2026-50629](https://cve.now/CVE-2026-50629.md): Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier (CVSS 5.3, Apache Software Foundation org.apache.cxf:cxf-rt-rs-securit…)
- [CVE-2026-50628](https://cve.now/CVE-2026-50628.md): Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control (CVSS 9.8, Apache Software Foundation org.apache.cxf:cxf-rt-rs-securit…)
- [CVE-2026-50627](https://cve.now/CVE-2026-50627.md): Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator (CVSS 9.1, Apache Software Foundation org.apache.cxf:cxf-rt-rs-securit…)
- [CVE-2026-49875](https://cve.now/CVE-2026-49875.md): Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils (CVSS 6.5, Apache Software Foundation org.apache.cxf:cxf-core · org.ap…)
- [CVE-2026-50623](https://cve.now/CVE-2026-50623.md): Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService (CVSS 4.8, Apache Software Foundation org.apache.cxf:cxf-rt-rs-securit…)
- [CVE-2026-12058](https://cve.now/CVE-2026-12058.md): The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed. (CVSS 5.3, vivo PcSuite)
- [CVE-2026-11535](https://cve.now/CVE-2026-11535.md): An unauthorized access vulnerability exists in the PcSuite APP. (CVSS 9.4, vivo PcSuite)
- [CVE-2026-12060](https://cve.now/CVE-2026-12060.md): Hepta Platforms｜Heptabase - Exposed Dangerous (CVSS 6.9, Hepta Platforms Heptabase)
- [CVE-2026-12059](https://cve.now/CVE-2026-12059.md): Cellopoint｜CelloOS - Improper Access Control (CVSS 8.7, Cellopoint CelloOS)
- [CVE-2026-9271](https://cve.now/CVE-2026-9271.md): KeepInMind - Dashboard Notes \< 0.8.4.2 - Contributor+ Stored XSS (CVSS 5.9, KeepInMind Dashboard Notes)
- [CVE-2026-9269](https://cve.now/CVE-2026-9269.md): Secure Copy Content Protection and Content Locking \< 5.1.5 - Admin+ Stored XSS via ays\_sccp\_sub\_icon\_image Parameter (CVSS 3.5, Secure Copy Content Protection and Content Locking)
- [CVE-2026-44892](https://cve.now/CVE-2026-44892.md): Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size (CVSS 7.5, netty · io.netty:netty-codec-http3)
- [CVE-2026-45169](https://cve.now/CVE-2026-45169.md): Idira Privileged Access Manager (PAM) Self-Hosted Vault: Denial of Service due to Unexpected Input Processing (CVSS 8.7, CyberArk Software, a Palo Alto Networks Company PAM SH Vault)
- [CVE-2026-47370](https://cve.now/CVE-2026-47370.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain… (CVSS 9.9, Ubiquiti UniFi OS Server · Ubiquiti Express +29)
- [CVE-2026-47369](https://cve.now/CVE-2026-47369.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain… (CVSS 9.9, Ubiquiti UniFi OS Server · Ubiquiti Express +29)
- [CVE-2026-48613](https://cve.now/CVE-2026-48613.md): SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during… (CVSS 7.1, phpBB)
- [CVE-2026-47368](https://cve.now/CVE-2026-47368.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to… (CVSS 8.6, Ubiquiti UniFi OS Server · Ubiquiti Express +29)
- [CVE-2026-48612](https://cve.now/CVE-2026-48612.md): Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s… (CVSS 8.0, phpBB)
- [CVE-2026-47367](https://cve.now/CVE-2026-47367.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID… (CVSS 9.9, Ubiquiti UID Enterprise Agent)
- [CVE-2026-48610](https://cve.now/CVE-2026-48610.md): Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability… (CVSS 8.1, Ubiquiti UDM · Ubiquiti UDM-Pro +13)
- [CVE-2026-47366](https://cve.now/CVE-2026-47366.md): Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an… (CVSS 7.2, phpBB)
- [CVE-2026-47365](https://cve.now/CVE-2026-47365.md): Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass… (CVSS 9.9, WebPros WordPress-Toolkit)
- [CVE-2026-48611](https://cve.now/CVE-2026-48611.md): Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to… (CVSS 9.8, phpBB)
- [CVE-2026-20746](https://cve.now/CVE-2026-20746.md): PingDirectory copying of virtual attributes leads to memory exhaustion (CVSS 6.3, Ping Identity PingDirectory)
- [CVE-2026-11933](https://cve.now/CVE-2026-11933.md): Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion (CVSS 8.8, MongoDB)
- [CVE-2026-9125](https://cve.now/CVE-2026-9125.md): The Ultimate Video Player For WordPress \<= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link\_url' Shortcode… (CVSS 6.4, 2winfactor Presto Player)
- [CVE-2026-45170](https://cve.now/CVE-2026-45170.md): Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation (CVSS 7.5, CyberArk Software, a Palo Alto Networks Company Vendor PAM)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-06-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.