# CVEs published 2026-06-23

255 CVEs were published on June 23, 2026: 22 critical, 101 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-7574](https://cve.now/CVE-2026-7574.md): Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use (CVSS 8.7, Anthropic Claude Desktop Cowork)
- [CVE-2026-5818](https://cve.now/CVE-2026-5818.md): MCU Firmware Update Authentication Bypass on Caliptra Core (CVSS 7.2, Caliptra Core Runtime Firmware)
- [CVE-2026-6458](https://cve.now/CVE-2026-6458.md): AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty (CVSS 5.1, Caliptra Core Runtime Firmware)
- [CVE-2026-12164](https://cve.now/CVE-2026-12164.md): Privilege Escalation in Fortra File Integrity Monitoring (FIM) (CVSS 4.4, Fortra File Integrity Monitoring)
- [CVE-2026-48493](https://cve.now/CVE-2026-48493.md): Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment (CVSS 5.5, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-56785](https://cve.now/CVE-2026-56785.md): FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields (CVSS 8.4, FlatPress)
- [CVE-2026-54588](https://cve.now/CVE-2026-54588.md): Poweradmin has Host Header Injection in OIDC redirect\_uri, SAML ACS/SLO URL, and Logout Redirect Construction. (CVSS 9.6, poweradmin · poweradmin/poweradmin)
- [CVE-2026-47693](https://cve.now/CVE-2026-47693.md): Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications (CVSS 6.9, poweradmin · poweradmin/poweradmin)
- [CVE-2026-12163](https://cve.now/CVE-2026-12163.md): Stored XSS in Fortra File Integrity Monitoring (FIM) (CVSS 5.5, Fortra File Integrity Monitoring)
- [CVE-2026-11972](https://cve.now/CVE-2026-11972.md): tarfile opened in streaming mode mishandles EOF (CVSS 8.2, Python Software Foundation CPython)
- [CVE-2026-54518](https://cve.now/CVE-2026-54518.md): jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind (CVSS 6.5, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-50193](https://cve.now/CVE-2026-50193.md): jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() (CVSS 6.3, FasterXML jackson-databind · com.fasterxml.jackson.core:jac…)
- [CVE-2026-41862](https://cve.now/CVE-2026-41862.md): Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts… (CVSS 8.8, Spring Statemachine · org.springframework.statemachine:spri…)
- [CVE-2026-54512](https://cve.now/CVE-2026-54512.md): jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation (CVSS 8.1, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54513](https://cve.now/CVE-2026-54513.md): jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) (CVSS 8.1, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54514](https://cve.now/CVE-2026-54514.md): jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) (CVSS 5.3, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54515](https://cve.now/CVE-2026-54515.md): jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties (CVSS 5.3, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54516](https://cve.now/CVE-2026-54516.md): jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields (CVSS 5.3, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54517](https://cve.now/CVE-2026-54517.md): jackson-databind: @JsonView bypass for setterless creator properties (CVSS 5.3, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-46547](https://cve.now/CVE-2026-46547.md): NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL (CVSS 6.1, nocodb)
- [CVE-2026-46548](https://cve.now/CVE-2026-46548.md): NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) (CVSS 4.3, nocodb)
- [CVE-2026-46549](https://cve.now/CVE-2026-46549.md): NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation (CVSS 2.0, nocodb)
- [CVE-2026-46550](https://cve.now/CVE-2026-46550.md): NocoDB: Refresh Token Cookie Set Without \`Secure\` and \`SameSite\` Flags (CVSS 5.4, nocodb)
- [CVE-2026-46552](https://cve.now/CVE-2026-46552.md): NocoDB: Shared-base link access can invite arbitrary users as persistent base members (CVSS 5.8, nocodb)
- [CVE-2026-46553](https://cve.now/CVE-2026-46553.md): NocoDB: Attachment Size Limit Bypass via Upload-by-URL (CVSS 2.1, nocodb)
- [CVE-2026-47375](https://cve.now/CVE-2026-47375.md): NocoDB: Postgres SQL Injection in Formula \`ARRAYSORT\` (CVSS 6.0, nocodb)
- [CVE-2026-47376](https://cve.now/CVE-2026-47376.md): NocoDB: Reflected Cross-Site Scripting via Password Reset Token (CVSS 5.1, nocodb)
- [CVE-2026-47377](https://cve.now/CVE-2026-47377.md): NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin (CVSS 5.1, nocodb)
- [CVE-2026-47378](https://cve.now/CVE-2026-47378.md): NocoDB: Hidden Column Exposure in Public Shared View Endpoints (CVSS 6.9, nocodb)
- [CVE-2026-47380](https://cve.now/CVE-2026-47380.md): NocoDB: User Enumeration via Sign-In Timing (CVSS 6.3, nocodb)
- [CVE-2026-46551](https://cve.now/CVE-2026-46551.md): NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion (CVSS 6.5, nocodb)
- [CVE-2026-46554](https://cve.now/CVE-2026-46554.md): NocoDB: Stale Auth Cache After API Token Deletion (CVSS 2.3, nocodb)
- [CVE-2026-47382](https://cve.now/CVE-2026-47382.md): NocoDB: Server-Side Request Forgery via Database Connection Host (CVSS 5.3, nocodb)
- [CVE-2026-47279](https://cve.now/CVE-2026-47279.md): NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints (CVSS 6.9, nocodb)
- [CVE-2026-47379](https://cve.now/CVE-2026-47379.md): NocoDB: Plaintext Password Comparison in Shared Views (CVSS 6.9, nocodb)
- [CVE-2026-47381](https://cve.now/CVE-2026-47381.md): NocoDB: Cross-Workspace Integration Use in Connection Test (CVSS 6.9, nocodb)
- [CVE-2026-47383](https://cve.now/CVE-2026-47383.md): NocoDB: Stored Cross-Site Scripting via Row Comments (CVSS 7.4, nocodb)
- [CVE-2026-47384](https://cve.now/CVE-2026-47384.md): NocoDB: SQL Injection via Column Title in Bulk GroupBy (CVSS 5.3, nocodb)
- [CVE-2026-47385](https://cve.now/CVE-2026-47385.md): NocoDB: Path Traversal via SQLite Source Filename (CVSS 5.3, nocodb)
- [CVE-2026-47386](https://cve.now/CVE-2026-47386.md): NocoDB: OAuth Authorization Code Race Condition (CVSS 6.3, nocodb)
- [CVE-2026-23513](https://cve.now/CVE-2026-23513.md): FOSSBilling: Broken Authorization in Client Transaction and Order Listings (CVSS 7.1, FOSSBilling)
- [CVE-2026-47387](https://cve.now/CVE-2026-47387.md): NocoDB: Stored Cross-Site Scripting via Form View Redirect URL (CVSS 8.4, nocodb)
- [CVE-2026-47388](https://cve.now/CVE-2026-47388.md): NocoDB: Missing Ownership Check in MCP Attachment Read (CVSS 2.3, nocodb)
- [CVE-2026-53926](https://cve.now/CVE-2026-53926.md): NocoDB: OAuth Tokens Persist Through Security Events (CVSS 6.3, nocodb)
- [CVE-2026-53927](https://cve.now/CVE-2026-53927.md): NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL (CVSS 5.1, nocodb)
- [CVE-2026-53928](https://cve.now/CVE-2026-53928.md): NocoDB: Refresh Tokens Persist Through Password Recovery (CVSS 6.3, nocodb)
- [CVE-2026-12892](https://cve.now/CVE-2026-12892.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser (CVSS 4.4, Red Hat Enterprise Linux)
- [CVE-2026-12891](https://cve.now/CVE-2026-12891.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser (CVSS 4.3, Red Hat Enterprise Linux)
- [CVE-2026-11820](https://cve.now/CVE-2026-11820.md): Community.general: community.general nexmo — api credentials exposed in get url query string\[security\] community.general nexmo — api… (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-11819](https://cve.now/CVE-2026-11819.md): Community.general: community.general keyring\_info — os keyring passphrase returned in plaintext (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-9073](https://cve.now/CVE-2026-9073.md): Foreman-mcp-server: mcp server: insecure sensitive http header sanitization (CVSS 6.2, Red Hat Satellite · foreman-mcp-server)
- [CVE-2025-64105](https://cve.now/CVE-2025-64105.md): FOSSBilling: IDOR Vulnerability in Support Ticket Creation (CVSS 5.1, FOSSBilling)
- [CVE-2026-53929](https://cve.now/CVE-2026-53929.md): NocoDB: Stored Cross-Site Scripting via Secure Attachment (CVSS 5.1, nocodb)
- [CVE-2026-53930](https://cve.now/CVE-2026-53930.md): NocoDB: Server-Side Request Forgery via Base Migration URL (CVSS 5.1, nocodb)
- [CVE-2026-53931](https://cve.now/CVE-2026-53931.md): NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint (CVSS 6.9, nocodb)
- [CVE-2026-12112](https://cve.now/CVE-2026-12112.md): Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse (CVSS 7.8, Red Hat Satellite)
- [CVE-2026-11807](https://cve.now/CVE-2026-11807.md): Eda-server: websocket missing authorization allows credential theft via activation\_id spoofing (CVSS 9.6, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-54327](https://cve.now/CVE-2026-54327.md): Pi: Race condition in auth.json writes could expose stored credentials (CVSS 2.2, earendil-works pi · @mariozechner/pi-coding-agent +1)
- [CVE-2026-54326](https://cve.now/CVE-2026-54326.md): Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass (CVSS 2.5, earendil-works pi · @mariozechner/pi-coding-agent +1)
- [CVE-2026-54328](https://cve.now/CVE-2026-54328.md): Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts (CVSS 7.3, earendil-works pi · @earendil-works/pi-coding-agent +1)
- [CVE-2026-54325](https://cve.now/CVE-2026-54325.md): Pi loads project-local extensions without approval (CVSS 4.4, earendil-works pi · @earendil-works/pi-coding-agent)
- [CVE-2026-54762](https://cve.now/CVE-2026-54762.md): Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails (CVSS 5.9, traefik · github.com/traefik/traefik +2)
- [CVE-2026-54761](https://cve.now/CVE-2026-54761.md): Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services (CVSS 6.0, traefik · github.com/traefik/traefik +2)
- [CVE-2026-53622](https://cve.now/CVE-2026-53622.md): Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts (CVSS 7.8, traefik · github.com/traefik/traefik +2)
- [CVE-2026-48491](https://cve.now/CVE-2026-48491.md): Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass (CVSS 7.8, traefik · github.com/traefik/traefik/v2 +1)
- [CVE-2026-48020](https://cve.now/CVE-2026-48020.md): Traefik StripPrefix Route-Level Auth Bypass via Path Normalization (CVSS 7.8, traefik · github.com/traefik/traefik +2)
- [CVE-2026-54555](https://cve.now/CVE-2026-54555.md): rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators (CVSS 7.8, rtk-ai rtk)
- [CVE-2026-45792](https://cve.now/CVE-2026-45792.md): RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM (CVSS 6.9, rtk-ai rtk · rtk)
- [CVE-2026-55249](https://cve.now/CVE-2026-55249.md): @rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String (CVSS 6.3, rtk-ai rtk)
- [CVE-2026-55736](https://cve.now/CVE-2026-55736.md): Private action arguments can be set by user input in Ash (CVSS 5.9, ash-project ash · ash)
- [CVE-2026-53753](https://cve.now/CVE-2026-53753.md): Crawl4AI: AST Sandbox Escape via gi\_frame.f\_back Chain - Pre-Auth RCE in Docker API (CVSS 9.8, unclecode crawl4ai · crawl4ai)
- [CVE-2026-53754](https://cve.now/CVE-2026-53754.md): Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) (CVSS 7.5, unclecode crawl4ai · crawl4ai)
- [CVE-2026-53755](https://cve.now/CVE-2026-53755.md): Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check (CVSS 8.6, unclecode crawl4ai · crawl4ai)
- [CVE-2026-54320](https://cve.now/CVE-2026-54320.md): Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email (CVSS 8.4, daytonaio daytona)
- [CVE-2026-54321](https://cve.now/CVE-2026-54321.md): Daytona: Public sandbox previews remain accessible for up to one hour after being made private (CVSS 7.0, daytonaio daytona · github.com/daytonaio/daytona)
- [CVE-2026-54319](https://cve.now/CVE-2026-54319.md): Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape (CVSS 4.2, daytonaio daytona · github.com/daytonaio/daytona)
- [CVE-2026-54322](https://cve.now/CVE-2026-54322.md): Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles (CVSS 7.7, daytonaio daytona · github.com/daytonaio/daytona)
- [CVE-2026-54324](https://cve.now/CVE-2026-54324.md): Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join (CVSS 6.5, daytonaio daytona · github.com/daytonaio/daytona)
- [CVE-2026-54323](https://cve.now/CVE-2026-54323.md): Daytona: Git credential leak via git clone with TLS verification disabled (CVSS 5.9, daytonaio daytona)
- [CVE-2020-9695](https://cve.now/CVE-2020-9695.md): Acrobat Reader | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-9711](https://cve.now/CVE-2020-9711.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2026-45135](https://cve.now/CVE-2026-45135.md): Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files (CVSS 8.1, caddyserver caddy · github.com/caddyserver/caddy/v2)
- [CVE-2026-45692](https://cve.now/CVE-2026-45692.md): Caddy: Remote Admin Authorization Bypass in \`/config\` API via Array Index Normalization (CVSS 5.4, caddyserver caddy · github.com/caddyserver/caddy/v2)
- [CVE-2026-52845](https://cve.now/CVE-2026-52845.md): Caddy: FastCGI header normalization bypass in \`forward\_auth copy\_headers\` (CVSS 8.1, caddyserver caddy · github.com/caddyserver/caddy/v2 +1)
- [CVE-2026-52844](https://cve.now/CVE-2026-52844.md): Caddy: Windows \`file\_server\` path authorization bypass via encoded backslash (CVSS 7.5, caddyserver caddy · github.com/caddyserver/caddy/v2 +1)
- [CVE-2026-52846](https://cve.now/CVE-2026-52846.md): Caddy: stripHTML template function bypass (CVSS 4.2, caddyserver caddy · github.com/caddyserver/caddy/v2 +1)
- [CVE-2020-9713](https://cve.now/CVE-2020-9713.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2026-54157](https://cve.now/CVE-2026-54157.md): LobeHub: Unauthenticated SSRF in \`/webapi/proxy\` (CVSS 9.0, lobehub · @lobehub/lobehub)
- [CVE-2026-0864](https://cve.now/CVE-2026-0864.md): Configuration Injection via Carriage Return (\\r) in write() method (CVSS 4.1, Python Software Foundation CPython)
- [CVE-2026-54318](https://cve.now/CVE-2026-54318.md): Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location (CVSS 7.1, home-assistant core)
- [CVE-2026-54317](https://cve.now/CVE-2026-54317.md): Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN (CVSS 7.6, home-assistant core · homeassistant)
- [CVE-2026-53662](https://cve.now/CVE-2026-53662.md): immich: One-click account takeover via XSS in login page continue redirect (CVSS 9.6, immich-app immich)
- [CVE-2026-57062](https://cve.now/CVE-2026-57062.md): CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is… (CVSS 2.9, GnuPG)
- [CVE-2026-55517](https://cve.now/CVE-2026-55517.md): Deno: Denial of service via non-ASCII bytes in WebSocket response headers (CVSS 4.3, denoland deno · deno)
- [CVE-2026-44726](https://cve.now/CVE-2026-44726.md): Deno: TLS retry copies stale upgrade hook, risking plaintext traffic (CVSS 7.4, denoland deno · deno)
- [CVE-2026-49401](https://cve.now/CVE-2026-49401.md): Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) (CVSS 7.3, denoland deno · deno)
- [CVE-2025-71382](https://cve.now/CVE-2025-71382.md): MuPDF \< 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering (CVSS 7.1, ArtifexSoftware mupdf)
- [CVE-2026-49402](https://cve.now/CVE-2026-49402.md): Deno: Command Injection via spawnSync & spawn on Windows (CVSS 8.1, denoland deno · deno)
- [CVE-2026-49406](https://cve.now/CVE-2026-49406.md): Deno: BYONM module resolution allows \`package.json\` main path traversal to bypass \`--allow-read\` restrictions (CVSS 5.5, denoland deno · deno)
- [CVE-2026-49411](https://cve.now/CVE-2026-49411.md): Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks (CVSS 6.5, denoland deno · deno)
- [CVE-2026-49983](https://cve.now/CVE-2026-49983.md): Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access (CVSS 5.2, denoland deno · deno)
- [CVE-2026-49860](https://cve.now/CVE-2026-49860.md): Deno: WebSocket API sandbox bypass via missing post-DNS check (CVSS 5.2, denoland deno · deno)
- [CVE-2026-49859](https://cve.now/CVE-2026-49859.md): Deno: \`fetch()\` API sandbox bypass via missing DNS resolution check (CVSS 5.2, denoland deno · deno)
- [CVE-2026-49440](https://cve.now/CVE-2026-49440.md): Deno: Miller-Rabin Primality Test Allows Zero Rounds (CVSS 7.4, denoland deno · deno)
- [CVE-2026-54257](https://cve.now/CVE-2026-54257.md): Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow (CVSS 9.3, electron)
- [CVE-2026-54316](https://cve.now/CVE-2026-54316.md): Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch (CVSS 6.0, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2026-50221](https://cve.now/CVE-2026-50221.md): In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device… (CVSS 5.3, OpenStack Swift · swift)
- [CVE-2026-54007](https://cve.now/CVE-2026-54007.md): Open WebUI: Cross-origin postMessage confirmation bypass via action:submit (CVSS 7.1, open-webui)
- [CVE-2026-54006](https://cve.now/CVE-2026-54006.md): Open WebUI: Calendar event re-parenting allows writing events into another user's calendar (CVSS 4.3, open-webui)
- [CVE-2026-54008](https://cve.now/CVE-2026-54008.md): Open WebUI: Redirect-Bypass SSRF in OAuth \`\_process\_picture\_url\` (CVSS 8.5, open-webui)
- [CVE-2026-54009](https://cve.now/CVE-2026-54009.md): Open WebUI: Cross-user file disclosure via /api/chat/completions image\_url field (CVSS 6.5, open-webui)
- [CVE-2026-54010](https://cve.now/CVE-2026-54010.md): Open WebUI: Forged chat-file link allows cross-user file read and deletion (CVSS 8.3, open-webui)
- [CVE-2026-54011](https://cve.now/CVE-2026-54011.md): Open WebUI: Stored XSS in Mermaid Markdown Preview (CVSS 8.7, open-webui)
- [CVE-2026-54012](https://cve.now/CVE-2026-54012.md): Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion (CVSS 7.1, open-webui)
- [CVE-2026-54013](https://cve.now/CVE-2026-54013.md): Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI (CVSS 7.6, open-webui)
- [CVE-2026-54014](https://cve.now/CVE-2026-54014.md): Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui (CVSS 4.3, open-webui)
- [CVE-2026-54015](https://cve.now/CVE-2026-54015.md): Open WebUI: Prompt history IDOR: unbound history\_id allows cross-prompt read and deletion (CVSS 6.4, open-webui)
- [CVE-2026-54016](https://cve.now/CVE-2026-54016.md): Open WebUI: Open WebUI BOLA: \`search\_knowledge\_files\` Allows Unauthorized Knowledge Base File Enumeration (CVSS 4.3, open-webui)
- [CVE-2026-54018](https://cve.now/CVE-2026-54018.md): Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects (CVSS 7.7, open-webui)
- [CVE-2026-54019](https://cve.now/CVE-2026-54019.md): Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode (CVSS 6.5, open-webui)
- [CVE-2026-57053](https://cve.now/CVE-2026-57053.md): GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in… (CVSS 4.0, GNU libidn)
- [CVE-2026-54021](https://cve.now/CVE-2026-54021.md): Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url\_idx path parameter (CVSS 6.3, open-webui)
- [CVE-2026-54022](https://cve.now/CVE-2026-54022.md): Open WebUI: Any authenticated user can read other users' private notes via Socket.IO (CVSS 5.3, open-webui)
- [CVE-2026-48520](https://cve.now/CVE-2026-48520.md): Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read (CVSS 6.1, langflow-ai langflow · langflow)
- [CVE-2026-33760](https://cve.now/CVE-2026-33760.md): Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints (CVSS 8.8, langflow-ai langflow · langflow)
- [CVE-2026-42867](https://cve.now/CVE-2026-42867.md): Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint (CVSS 6.5, langflow-ai langflow · langflow)
- [CVE-2026-55255](https://cve.now/CVE-2026-55255.md): Langflow: IDOR Vulnerability in \`/api/v1/responses\` Endpoint Allows Authenticated Attackers to Access Another User's Flow (CVSS 8.4, KEV, langflow-ai langflow · langflow)
- [CVE-2026-55423](https://cve.now/CVE-2026-55423.md): Langflow: Logout button does not clear session (CVSS 6.1, langflow-ai langflow · langflow)
- [CVE-2026-55446](https://cve.now/CVE-2026-55446.md): Langflow: Unauthenticated DoS through multipart form boundary file upload (CVSS 7.5, langflow-ai langflow · langflow)
- [CVE-2026-48519](https://cve.now/CVE-2026-48519.md): Langflow: Unauthenticated RCE in Shareable Playgrounds (CVSS 9.6, langflow-ai langflow · langflow)
- [CVE-2026-55447](https://cve.now/CVE-2026-55447.md): Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit (CVSS 9.6, langflow-ai langflow · langflow)
- [CVE-2026-56968](https://cve.now/CVE-2026-56968.md): GNU SASL before 2.2.4 lacks sanitization of a short challenge in \_gsasl\_ntlm\_client\_step in the NTLM client, which could result in memory… (CVSS 3.7, GNU SASL)
- [CVE-2026-55450](https://cve.now/CVE-2026-55450.md): Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak (CVSS 9.3, langflow-ai langflow · langflow)
- [CVE-2026-34913](https://cve.now/CVE-2026-34913.md): A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and… (CVSS 4.3, Revive Adserver)
- [CVE-2026-34917](https://cve.now/CVE-2026-34917.md): Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally… (CVSS 4.3, Revive Adserver)
- [CVE-2026-44956](https://cve.now/CVE-2026-44956.md): Low‑privileged users could use their Full Name as a vector for a stored XSS attack. (CVSS 0.0, Revive Adserver)
- [CVE-2026-34916](https://cve.now/CVE-2026-34916.md): A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user… (CVSS 8.8, Revive Adserver)
- [CVE-2026-34914](https://cve.now/CVE-2026-34914.md): A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. (CVSS 8.3, Revive Adserver)
- [CVE-2026-44958](https://cve.now/CVE-2026-44958.md): An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even… (CVSS 5.4, Revive Adserver)
- [CVE-2026-44961](https://cve.now/CVE-2026-44961.md): The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. (CVSS 0.0, Revive Adserver)
- [CVE-2026-44960](https://cve.now/CVE-2026-44960.md): A stored XSS can be exploited by leveraging the usernames as an attack vector. (CVSS 0.0, Revive Adserver)
- [CVE-2026-44957](https://cve.now/CVE-2026-44957.md): A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. (CVSS 4.3, Revive Adserver)
- [CVE-2026-34912](https://cve.now/CVE-2026-34912.md): A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6… (CVSS 4.3, Revive Adserver)
- [CVE-2026-44959](https://cve.now/CVE-2026-44959.md): A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. (CVSS 8.8, Revive Adserver)
- [CVE-2026-34915](https://cve.now/CVE-2026-34915.md): A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user… (CVSS 6.1, Revive Adserver)
- [CVE-2026-56117](https://cve.now/CVE-2026-56117.md): dhcpcd Heap Use-After-Free via Control Socket Handling (CVSS 5.7, NetworkConfiguration dhcpcd)
- [CVE-2026-50019](https://cve.now/CVE-2026-50019.md): yt-dlp: File Downloader cookie leak with curl (CVSS 6.1, yt-dlp)
- [CVE-2025-13162](https://cve.now/CVE-2025-13162.md): Advant Master Online Builder DLL vulnerability (CVSS 4.4, ABB Control Builder A · ABB 800xA for Advant Master)
- [CVE-2026-56116](https://cve.now/CVE-2026-56116.md): dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling (CVSS 7.1, NetworkConfiguration dhcpcd)
- [CVE-2026-50574](https://cve.now/CVE-2026-50574.md): yt-dlp: Arbitrary code execution via manifest downloads with aria2c (CVSS 8.3, yt-dlp)
- [CVE-2026-56115](https://cve.now/CVE-2026-56115.md): Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass (CVSS 8.7, garybowers bootimus)
- [CVE-2026-50023](https://cve.now/CVE-2026-50023.md): yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) (CVSS 8.3, yt-dlp)
- [CVE-2026-56114](https://cve.now/CVE-2026-56114.md): dhcpcd Stack Out-of-Bounds Write in dhcp6\_makemessage() (CVSS 6.0, NetworkConfiguration dhcpcd)
- [CVE-2026-56113](https://cve.now/CVE-2026-56113.md): dhcpcd Heap Use-After-Free in dhcp6\_deprecateaddrs via DHCPv6 RENEW (CVSS 6.0, NetworkConfiguration dhcpcd)
- [CVE-2026-11940](https://cve.now/CVE-2026-11940.md): tarfile extraction filter bypass allows escaping the destination directory (CVSS 7.8, Python Software Foundation CPython)
- [CVE-2026-12958](https://cve.now/CVE-2026-12958.md): Arbitrary file write in Language Servers for AWS (CVSS 8.5, Amazon Web Services Language Servers for AWS · @aws/lsp-cod…)
- [CVE-2026-12957](https://cve.now/CVE-2026-12957.md): Arbitrary Code Execution in Language Servers for AWS (CVSS 8.5, Amazon Web Services Language Servers for AWS · @aws/lsp-cod…)
- [CVE-2026-13007](https://cve.now/CVE-2026-13007.md): Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure (CVSS 7.5, Tenable Identity Exposure)
- [CVE-2026-44792](https://cve.now/CVE-2026-44792.md): n8n: Source Control Pull SQL Injection (CVSS 8.9, n8n-io n8n · n8n)
- [CVE-2026-44791](https://cve.now/CVE-2026-44791.md): n8n: XML Node Prototype Pollution Patch Bypass (CVSS 9.4, n8n-io n8n · n8n)
- [CVE-2026-44790](https://cve.now/CVE-2026-44790.md): n8n: Arbitrary File Read via Git Node (CVSS 9.4, n8n-io n8n · n8n)
- [CVE-2026-44789](https://cve.now/CVE-2026-44789.md): n8n: HTTP Request Node Pagination Prototype Pollution to RCE (CVSS 9.4, n8n-io n8n · n8n)
- [CVE-2026-45732](https://cve.now/CVE-2026-45732.md): n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints (CVSS 8.3, n8n-io n8n · n8n)
- [CVE-2026-49444](https://cve.now/CVE-2026-49444.md): n8n: Python sandbox escape (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-49465](https://cve.now/CVE-2026-49465.md): n8n: Git Node Clone and Push Operations Bypass File Sandbox (CVSS 6.0, n8n-io n8n · n8n)
- [CVE-2026-54304](https://cve.now/CVE-2026-54304.md): n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-54307](https://cve.now/CVE-2026-54307.md): n8n: Credential Exfiltration via Permission Bypass (CVSS 8.5, n8n-io n8n · n8n)
- [CVE-2026-54302](https://cve.now/CVE-2026-54302.md): n8n: Stored XSS in Chat Trigger Node (CVSS 7.0, n8n-io n8n · n8n)
- [CVE-2026-54305](https://cve.now/CVE-2026-54305.md): n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints (CVSS 8.9, n8n-io n8n · n8n)
- [CVE-2026-54301](https://cve.now/CVE-2026-54301.md): n8n: Same-Origin XSS in Respond to Webhook Node (CVSS 7.0, n8n-io n8n · n8n)
- [CVE-2026-54306](https://cve.now/CVE-2026-54306.md): n8n: Prototype Pollution enables confused-deputy execution via public webhooks (CVSS 6.3, n8n-io n8n · n8n)
- [CVE-2026-54308](https://cve.now/CVE-2026-54308.md): n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node (CVSS 6.3, n8n-io n8n · n8n)
- [CVE-2026-54311](https://cve.now/CVE-2026-54311.md): n8n: Merge Node SQL Mode Prototype Pollution (CVSS 6.0, n8n-io n8n · n8n)
- [CVE-2026-54310](https://cve.now/CVE-2026-54310.md): n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes (CVSS 6.5, n8n-io n8n · n8n)
- [CVE-2026-56696](https://cve.now/CVE-2026-56696.md): OpenHarness - Prompt Injection via /issue and /pr\_comments Slash Commands (CVSS 5.3, HKUDS OpenHarness · openharness-ai)
- [CVE-2026-54309](https://cve.now/CVE-2026-54309.md): n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions (CVSS 8.8, n8n-io n8n · n8n)
- [CVE-2026-56695](https://cve.now/CVE-2026-56695.md): OpenHarness - Cross-Session Disclosure via /resume and /summary Commands (CVSS 7.1, HKUDS OpenHarness · openharness-ai)
- [CVE-2026-56694](https://cve.now/CVE-2026-56694.md): NanoClaw \< 2.1.0 - Privilege Escalation via Forged Channel Approval Callback (CVSS 5.3, nanocoai nanoclaw)
- [CVE-2026-56693](https://cve.now/CVE-2026-56693.md): NanoClaw \< 2.1.17 - Privilege Escalation via Unauthorized create\_agent System Action (CVSS 6.8, nanocoai nanoclaw)
- [CVE-2026-56692](https://cve.now/CVE-2026-56692.md): NanoClaw \< 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles (CVSS 6.8, nanocoai nanoclaw)
- [CVE-2026-56402](https://cve.now/CVE-2026-56402.md): NanoClaw \< 2.1.17 - Privilege Escalation via Unverified Approval Response Handler (CVSS 7.1, nanocoai nanoclaw)
- [CVE-2026-54314](https://cve.now/CVE-2026-54314.md): n8n: Denial of Service via ZIP decompression in webhook workflow (CVSS 6.3, n8n-io n8n · n8n)
- [CVE-2026-54312](https://cve.now/CVE-2026-54312.md): n8n: Microsoft SQL Node Prototype Pollution (CVSS 7.2, n8n-io n8n · n8n)
- [CVE-2026-54303](https://cve.now/CVE-2026-54303.md): n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints (CVSS 6.8, n8n-io n8n · n8n)
- [CVE-2026-54313](https://cve.now/CVE-2026-54313.md): n8n: NoSQL Injection in MongoDB Node Find And Replace Operation (CVSS 6.5, n8n-io n8n · n8n)
- [CVE-2025-15619](https://cve.now/CVE-2025-15619.md): HCL Connections is vulnerable to broken access control (CVSS 3.5, HCLSoftware Connections)
- [CVE-2026-55766](https://cve.now/CVE-2026-55766.md): guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization (CVSS 4.8, guzzle psr7 · guzzlehttp/psr7)
- [CVE-2026-55767](https://cve.now/CVE-2026-55767.md): Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle (CVSS 5.8, guzzle · guzzlehttp/guzzle)
- [CVE-2026-55568](https://cve.now/CVE-2026-55568.md): Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext (CVSS 5.9, guzzle · guzzlehttp/guzzle)
- [CVE-2025-62180](https://cve.now/CVE-2025-62180.md): Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to… (CVSS 7.1, Pegasystems Pega Infinity)
- [CVE-2026-27604](https://cve.now/CVE-2026-27604.md): FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions (CVSS 10.0, FOSSBilling)
- [CVE-2026-28496](https://cve.now/CVE-2026-28496.md): FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE (CVSS 9.4, FOSSBilling)
- [CVE-2026-56815](https://cve.now/CVE-2026-56815.md): pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in… (CVSS 7.4, rasta-mouse pwnlift)
- [CVE-2026-35019](https://cve.now/CVE-2026-35019.md): NetComm NF20MESH \< R6B032 Hardcoded AES Key Authentication Bypass (CVSS 9.2, NetComm Wireless Pty NF20MESH)
- [CVE-2026-35018](https://cve.now/CVE-2026-35018.md): NetComm NF20MESH \< R6B032 Authenticated RCE via OS Command Injection (CVSS 8.7, NetComm Wireless Pty NF20MESH)
- [CVE-2026-11772](https://cve.now/CVE-2026-11772.md): Reflected XSS in DRIMO CMS (CVSS 5.1, DRIMO CMS)
- [CVE-2026-12969](https://cve.now/CVE-2026-12969.md): Dnsmasq: dnsmasq: out-of-bounds read in find\_soa() due to missing extrabytes validation (CVSS 5.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-10609](https://cve.now/CVE-2026-10609.md): Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator… (CVSS 6.8, Logging Subsystem for Red Hat OpenShift · github.com/opensh…)
- [CVE-2026-4610](https://cve.now/CVE-2026-4610.md): ProfileGrid \<= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content (CVSS 6.4, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2026-54892](https://cve.now/CVE-2026-54892.md): Plug: quadratic-time decoding of nested query/body parameters enables denial of service (CVSS 8.7, elixir-plug plug · plug)
- [CVE-2026-10857](https://cve.now/CVE-2026-10857.md): Reflected XSS in Akinsoft's e-Commerce (CVSS 6.1, AKIN Software Computer Import Export Industry and Trade e-C…)
- [CVE-2026-56784](https://cve.now/CVE-2026-56784.md): OpenRemote \< 1.25.0 IDOR via Bulk Alarm Deletion Endpoint (CVSS 8.6, openremote · io.openremote:openremote-manager)
- [CVE-2026-56762](https://cve.now/CVE-2026-56762.md): Hono - Missing Cookie Name Validation in setCookie() (CVSS 6.9, Hono)
- [CVE-2026-56701](https://cve.now/CVE-2026-56701.md): Grav - XML External Entity Injection via SVG Upload (CVSS 7.1, Grav · getgrav/grav)
- [CVE-2026-56379](https://cve.now/CVE-2026-56379.md): ImageMagick - Command Injection via SVG Decoder (CVSS 9.2, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56376](https://cve.now/CVE-2026-56376.md): ImageMagick - Heap Use-After-Free in Meta Coder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56371](https://cve.now/CVE-2026-56371.md): ImageMagick - Memory Leak in TXT File Processing via Texture Attribute (CVSS 6.9, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56322](https://cve.now/CVE-2026-56322.md): Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter (CVSS 8.7, Capgo)
- [CVE-2026-56315](https://cve.now/CVE-2026-56315.md): picklescan - Remote Code Execution via Unblocked Standard Library Modules (CVSS 9.3, picklescan)
- [CVE-2026-56301](https://cve.now/CVE-2026-56301.md): Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux (CVSS 6.8, Nuxt)
- [CVE-2026-56275](https://cve.now/CVE-2026-56275.md): Flowise - Server-Side Request Forgery via Execute Flow Base URL (CVSS 6.0, Flowise · flowise-components)
- [CVE-2026-56274](https://cve.now/CVE-2026-56274.md): Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess (CVSS 8.7, Flowise · flowise-components)
- [CVE-2026-56263](https://cve.now/CVE-2026-56263.md): Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard (CVSS 5.3, Crawl4AI)
- [CVE-2026-56258](https://cve.now/CVE-2026-56258.md): Crawl4AI - Arbitrary File Write via output\_path Symlink and TOCTOU (CVSS 9.2, Crawl4AI)
- [CVE-2026-56248](https://cve.now/CVE-2026-56248.md): Capgo - Unauthenticated Denial-of-Service via audit\_logs RLS Policy (CVSS 8.7, Cap-go capgo)
- [CVE-2026-56243](https://cve.now/CVE-2026-56243.md): Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane (CVSS 8.6, Capgo)
- [CVE-2026-56234](https://cve.now/CVE-2026-56234.md): Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint (CVSS 6.9, Capgo)
- [CVE-2026-56225](https://cve.now/CVE-2026-56225.md): Capgo - Authorization Bypass in API Key Management via App-Limited Keys (CVSS 8.7, Capgo)
- [CVE-2026-56222](https://cve.now/CVE-2026-56222.md): Capgo - Cross-Organization App Takeover via Mismatched org\_id and app\_id in /private/role\_bindings (CVSS 8.6, Capgo)
- [CVE-2025-71376](https://cve.now/CVE-2025-71376.md): picklescan - Arbitrary Code Execution via Undetected idlelib.autocomplete.AutoComplete.fetch\_completions (CVSS 7.6, picklescan)
- [CVE-2025-71370](https://cve.now/CVE-2025-71370.md): picklescan - Remote Code Execution via torch.jit.unsupported\_tensor\_ops.execWrapper (CVSS 7.6, picklescan)
- [CVE-2025-71365](https://cve.now/CVE-2025-71365.md): picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection Bypass (CVSS 7.6, picklescan)
- [CVE-2025-71341](https://cve.now/CVE-2025-71341.md): picklescan - Remote Code Execution via Undetected profile.Profile.runctx (CVSS 7.6, picklescan)
- [CVE-2025-71337](https://cve.now/CVE-2025-71337.md): Flowise - Unverified Email Change via Account Profile Endpoint (CVSS 8.7, Flowise · flowise-ui)
- [CVE-2023-54365](https://cve.now/CVE-2023-54365.md): Traefik - Denial of Service via HTTP/2 Request Handling (CVSS 8.7, Traefik · github.com/traefik/traefik)
- [CVE-2026-10711](https://cve.now/CVE-2026-10711.md): RCE in Akınsoft's CafePlus (CVSS 8.8, AKIN Software Computer Import Export Industry and Trade Caf…)
- [CVE-2026-44089](https://cve.now/CVE-2026-44089.md): Buffer Overflow in Totolink EX1200L router (CVSS 9.4, Totolink EX1200L)
- [CVE-2026-4983](https://cve.now/CVE-2026-4983.md): Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type… (CVSS 4.1, Eclipse Foundation Eclipse Open VSX)
- [CVE-2026-11374](https://cve.now/CVE-2026-11374.md): Account Takeover via Predictable SSO Ticket Generation (CVSS 9.0, zohocorp manageengine\_adselfservice\_plus · zohocorp mana… +2)
- [CVE-2026-10521](https://cve.now/CVE-2026-10521.md): Authenticated unintended access to critical program parameters (CVSS 8.6, MB connect line mbCONNECT24 · MB connect line mymbCONNECT24)
- [CVE-2026-9733](https://cve.now/CVE-2026-9733.md): Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter (CVSS 9.1, HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2)
- [CVE-2026-8379](https://cve.now/CVE-2026-8379.md): Frontend File Manager Plugin \<= 23.6 - Unauthenticated Arbitrary File Download (CVSS 7.5, Frontend File Manager Plugin)
- [CVE-2026-8378](https://cve.now/CVE-2026-8378.md): Frontend File Manager Plugin \<= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename (CVSS 5.4, Frontend File Manager Plugin)
- [CVE-2026-8172](https://cve.now/CVE-2026-8172.md): Simple Basic Contact Form \<= 20250114 - Reflected XSS (CVSS 7.1, Simple Basic Contact Form)
- [CVE-2026-8163](https://cve.now/CVE-2026-8163.md): Infility Global \< 2.15.19 - Subscriber+ SQL Injection via order Parameter (CVSS 8.8, Infility Global)
- [CVE-2026-7842](https://cve.now/CVE-2026-7842.md): Infility Global \< 2.15.20 - Editor+ SQL Injection via orderby Parameter (CVSS 6.8, Infility Global)
- [CVE-2026-12866](https://cve.now/CVE-2026-12866.md): All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. (CVSS 9.2, expr-eval · org.webjars.npm:expr-eval)
- [CVE-2026-55654](https://cve.now/CVE-2026-55654.md): Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel… (CVSS 3.7, Red Hat Enterprise Linux · Red Hat Hardened Images +2)
- [CVE-2026-55655](https://cve.now/CVE-2026-55655.md): Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions (CVSS 5.0, Red Hat Enterprise Linux · Red Hat Hardened Images +3)
- [CVE-2026-55653](https://cve.now/CVE-2026-55653.md): Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to… (CVSS 4.3, Red Hat Enterprise Linux · Red Hat Hardened Images +3)
- [CVE-2026-11833](https://cve.now/CVE-2026-11833.md): Overview: A vulnerability has been found in FAST/TOOLS and CI Server. (CVSS 8.2, Yokogawa Electric FAST/TOOLS · Yokogawa Electric CI Server)
- [CVE-2025-55639](https://cve.now/CVE-2025-55639.md): GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf\_isom\_add\_track\_kind() function at isomedia/isom\_write.c. (CVSS 6.5)
- [CVE-2025-61018](https://cve.now/CVE-2025-61018.md): An issue in the sqlo\_place\_dt\_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)… (CVSS 7.5)
- [CVE-2025-61019](https://cve.now/CVE-2025-61019.md): An issue in the sqlo\_key\_part\_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)… (CVSS 7.5)
- [CVE-2025-61020](https://cve.now/CVE-2025-61020.md): An issue in the sqlo\_strip\_in\_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)… (CVSS 7.5)
- [CVE-2025-61021](https://cve.now/CVE-2025-61021.md): An issue in the sqlo\_natural\_join\_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service… (CVSS 7.5)
- [CVE-2025-61022](https://cve.now/CVE-2025-61022.md): An issue in the sqlo\_tb\_col\_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)… (CVSS 7.5)
- [CVE-2025-61023](https://cve.now/CVE-2025-61023.md): An issue in the st\_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via… (CVSS 7.5)
- [CVE-2025-61024](https://cve.now/CVE-2025-61024.md): An issue in the sqlo\_try\_in\_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via… (CVSS 7.5)
- [CVE-2025-61025](https://cve.now/CVE-2025-61025.md): An issue in the sslr\_qst\_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via… (CVSS 7.5)
- [CVE-2025-61027](https://cve.now/CVE-2025-61027.md): An issue in the t\_set\_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via… (CVSS 7.5)
- [CVE-2025-61028](https://cve.now/CVE-2025-61028.md): An issue in the time\_t\_to\_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via… (CVSS 7.5)
- [CVE-2025-61029](https://cve.now/CVE-2025-61029.md): An issue in the sqlo\_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via… (CVSS 7.5)
- [CVE-2026-39253](https://cve.now/CVE-2026-39253.md): An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and… (CVSS 8.1)
- [CVE-2026-52673](https://cve.now/CVE-2026-52673.md): SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues… (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-06-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.