CVEs published June 6, 2026
39 CVEs were published on June 6, 2026: 0 critical, 7 high.
- Published
- 39
- Critical
- 0
- High
- 7
- Medium
- 32
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- theonedev onedev
- 4
- Jinher OA
- 2
- thimpress LearnPress – Backup & Migration Tool
- 2
- chrisvrichardson MapPress Maps for WordPress
- 1
- cifi SEO Plugin by Squirrly SEO
- 1
- Clash Verge Rev clash-verge-service-ipc
- 1
- Click to Chat – HoliThemes
- 1
- crafium OptinCraft – Drag & Drop Optins & Popup Builder for…
- 1
- CRUX Protocol::HTTP2
- 1
- davidanderson All-In-One Security (AIOS) – Security and Fir…
- 1
High 7
- CVE-2026-11413JingDong JD Cloud Box AX6600 jdcweb_rpc set_macfilter stack-based overflowJingDong JD Cloud Box AX6600
- CVE-2026-10725Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 BombCRUX Protocol::HTTP2
- CVE-2026-9851Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Actionmasaakitanaka Booking Package
- CVE-2026-7537MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' ParameterMDJM Event Management
- CVE-2026-8438All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Pathdavidanderson All-In-One Security (AIOS) – Security and Fir…
- CVE-2026-8901Integration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission Dataplugcrux Integration for Freshsales – Contact Form 7, WPFor…
- CVE-2026-26422clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.Clash Verge Rev clash-verge-service-ipc
Medium, low and unrated 32
- CVE-2026-11441theonedev Pull Request issues canAccessIssue improper authorizationtheonedev onedev
- CVE-2026-11440theonedev REST API default-branch improper authorizationtheonedev onedev
- CVE-2026-11439theonedev Parent Project projects improper authorizationtheonedev onedev
- CVE-2026-11438theonedev projects improper authorizationtheonedev onedev
- CVE-2026-11437perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgeryperfree go-fastdfs-web
- CVE-2026-11436Mage AI Sign-in Flow index.tsx useMutation cross site scriptingMage AI
- CVE-2026-11435Jinher OA nextselectplan.aspx sql injectionJinher OA
- CVE-2026-11434FluentCMS Blocks Plugin blocks cross site scriptingFluentCMS
- CVE-2026-11412Jinher OA GetFormSn.aspx sql injectionJinher OA
- CVE-2026-11411iAI Lab PDF AI App chatpdf.pro getExternalCacheDir path traversaliAI Lab PDF AI App
- CVE-2026-11408vertex-app vertex Log Viewer Endpoint LogMod.js os command injectionvertex-app vertex
- CVE-2026-11406GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injectionGL.iNet MT3000
- CVE-2026-9829Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode ParameterPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2026-9016Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Actionqriouslad Debug Log Manager – Conveniently Monitor and Insp…
- CVE-2026-9594WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameterflippercode WP Maps – Google Maps,OpenStreetMap,Mapbox,Stor…
- CVE-2026-8611Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameterklamra22 Klamra Paycal for Aspaclaria
- CVE-2026-8839MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpointschrisvrichardson MapPress Maps for WordPress
- CVE-2026-7624SEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operationscifi SEO Plugin by Squirrly SEO
- CVE-2026-8978OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order_by' Parametercrafium OptinCraft – Drag & Drop Optins & Popup Builder for…
- CVE-2026-7792WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpointsmub WPForms – Easy Form Builder for WordPress – Contact Fo…
- CVE-2026-2500Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameterdavidfcarr Quick Playground
- CVE-2026-8502LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parametersthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-7796EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attributewpdevteam EmbedPress – PDF Embedder, Embed PDF viewer, YouT…
- CVE-2026-7665Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handlerwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2026-7795Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode ParameterClick to Chat – HoliThemes
- CVE-2026-7566LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Uploadthimpress LearnPress – Backup & Migration Tool
- CVE-2026-7565LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameterthimpress LearnPress – Backup & Migration Tool
- CVE-2026-9280Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Modespacetime Ad Inserter – Ad Manager & AdSense Ads
- CVE-2026-9197Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Exportnextendweb Smart Slider
- CVE-2026-8991Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settingsglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2026-9281Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)litonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2026-9008Page-list <= 6.2 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributeswebvitaly Page-list