# CVEs published 2026-06-06

39 CVEs were published on June 6, 2026: 0 critical, 7 high. Days are UTC.

- [CVE-2026-11441](https://cve.now/CVE-2026-11441.md): theonedev Pull Request issues canAccessIssue improper authorization (CVSS 5.3, theonedev onedev)
- [CVE-2026-11440](https://cve.now/CVE-2026-11440.md): theonedev REST API default-branch improper authorization (CVSS 5.3, theonedev onedev)
- [CVE-2026-11439](https://cve.now/CVE-2026-11439.md): theonedev Parent Project projects improper authorization (CVSS 5.3, theonedev onedev)
- [CVE-2026-11438](https://cve.now/CVE-2026-11438.md): theonedev projects improper authorization (CVSS 5.3, theonedev onedev)
- [CVE-2026-11437](https://cve.now/CVE-2026-11437.md): perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery (CVSS 6.9, perfree go-fastdfs-web)
- [CVE-2026-11436](https://cve.now/CVE-2026-11436.md): Mage AI Sign-in Flow index.tsx useMutation cross site scripting (CVSS 5.3, Mage AI)
- [CVE-2026-11435](https://cve.now/CVE-2026-11435.md): Jinher OA nextselectplan.aspx sql injection (CVSS 6.9, Jinher OA)
- [CVE-2026-11434](https://cve.now/CVE-2026-11434.md): FluentCMS Blocks Plugin blocks cross site scripting (CVSS 4.8, FluentCMS)
- [CVE-2026-11413](https://cve.now/CVE-2026-11413.md): JingDong JD Cloud Box AX6600 jdcweb\_rpc set\_macfilter stack-based overflow (CVSS 8.7, JingDong JD Cloud Box AX6600)
- [CVE-2026-11412](https://cve.now/CVE-2026-11412.md): Jinher OA GetFormSn.aspx sql injection (CVSS 5.3, Jinher OA)
- [CVE-2026-11411](https://cve.now/CVE-2026-11411.md): iAI Lab PDF AI App chatpdf.pro getExternalCacheDir path traversal (CVSS 4.8, iAI Lab PDF AI App)
- [CVE-2026-11408](https://cve.now/CVE-2026-11408.md): vertex-app vertex Log Viewer Endpoint LogMod.js os command injection (CVSS 5.3, vertex-app vertex)
- [CVE-2026-11406](https://cve.now/CVE-2026-11406.md): GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection (CVSS 5.3, GL.iNet MT3000)
- [CVE-2026-10725](https://cve.now/CVE-2026-10725.md): Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb (CVSS 7.5, CRUX Protocol::HTTP2)
- [CVE-2026-9829](https://cve.now/CVE-2026-9829.md): Photo Gallery by 10Web \<= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact\_album\_order\_by' Shortcode Parameter (CVSS 6.5, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2026-9851](https://cve.now/CVE-2026-9851.md): Booking Package \<= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action (CVSS 7.2, masaakitanaka Booking Package)
- [CVE-2026-9016](https://cve.now/CVE-2026-9016.md): Debug Log Manager \<= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log\_js\_errors AJAX Action (CVSS 5.3, qriouslad Debug Log Manager – Conveniently Monitor and Insp…)
- [CVE-2026-9594](https://cve.now/CVE-2026-9594.md): WP Maps \<= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location\_messages' Parameter (CVSS 4.4, flippercode WP Maps – Google Maps,OpenStreetMap,Mapbox,Stor…)
- [CVE-2026-8611](https://cve.now/CVE-2026-8611.md): Klamra Paycal for Aspaclaria \<= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice\_id' Parameter (CVSS 4.3, klamra22 Klamra Paycal for Aspaclaria)
- [CVE-2026-8839](https://cve.now/CVE-2026-8839.md): MapPress Maps for WordPress \<= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints (CVSS 5.3, chrisvrichardson MapPress Maps for WordPress)
- [CVE-2026-7624](https://cve.now/CVE-2026-7624.md): SEO Plugin by Squirrly SEO \<= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations (CVSS 4.3, cifi SEO Plugin by Squirrly SEO)
- [CVE-2026-8978](https://cve.now/CVE-2026-8978.md): OptinCraft \<= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order\_by' Parameter (CVSS 4.9, crafium OptinCraft – Drag & Drop Optins & Popup Builder for…)
- [CVE-2026-7792](https://cve.now/CVE-2026-7792.md): WPForms \<= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint (CVSS 5.3, smub WPForms – Easy Form Builder for WordPress – Contact Fo…)
- [CVE-2026-2500](https://cve.now/CVE-2026-2500.md): Quick Playground \<= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter (CVSS 4.4, davidfcarr Quick Playground)
- [CVE-2026-8502](https://cve.now/CVE-2026-8502.md): LearnPress \<= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c\_status' and 'return\_type' Parameters (CVSS 5.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-7796](https://cve.now/CVE-2026-7796.md): EmbedPress \<= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed PDF viewer, YouT…)
- [CVE-2026-7665](https://cve.now/CVE-2026-7665.md): Essential Addons for Elementor \<= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load\_more' AJAX Handler (CVSS 5.3, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2026-7795](https://cve.now/CVE-2026-7795.md): Click to Chat \<= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter (CVSS 6.4, Click to Chat – HoliThemes)
- [CVE-2026-7537](https://cve.now/CVE-2026-7537.md): MDJM Event Management \<= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm\_email\_upload\_file' Parameter (CVSS 7.2, MDJM Event Management)
- [CVE-2026-7566](https://cve.now/CVE-2026-7566.md): LearnPress – Backup & Migration Tool \<= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload (CVSS 6.6, thimpress LearnPress – Backup & Migration Tool)
- [CVE-2026-7565](https://cve.now/CVE-2026-7565.md): LearnPress \<= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter (CVSS 4.9, thimpress LearnPress – Backup & Migration Tool)
- [CVE-2026-9280](https://cve.now/CVE-2026-9280.md): Ad Inserter \<= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode (CVSS 6.1, spacetime Ad Inserter – Ad Manager & AdSense Ads)
- [CVE-2026-9197](https://cve.now/CVE-2026-9197.md): Smart Slider 3 \<= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export (CVSS 4.9, nextendweb Smart Slider)
- [CVE-2026-8991](https://cve.now/CVE-2026-8991.md): Drag and Drop Multiple File Upload for Contact Form 7 \<= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag\_n\_drop\_text' and 'drag\_n\_drop\_browse\_text' Settings (CVSS 4.4, glenwpcoder Drag and Drop Multiple File Upload for Contact…)
- [CVE-2026-8438](https://cve.now/CVE-2026-8438.md): All-In-One Security (AIOS) \<= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path (CVSS 7.2, davidanderson All-In-One Security (AIOS) – Security and Fir…)
- [CVE-2026-8901](https://cve.now/CVE-2026-8901.md): Integration for Freshsales \<= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data (CVSS 7.2, plugcrux Integration for Freshsales – Contact Form 7, WPFor…)
- [CVE-2026-9281](https://cve.now/CVE-2026-9281.md): Master Addons For Elementor \<= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma\_custom\_js' Page Setting (Custom JS Extension) (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2026-9008](https://cve.now/CVE-2026-9008.md): Page-list \<= 6.2 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes (CVSS 4.3, webvitaly Page-list)
- [CVE-2026-26422](https://cve.now/CVE-2026-26422.md): clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation. (CVSS 8.4, Clash Verge Rev clash-verge-service-ipc)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.