# CVEs published 2026-06-07

23 CVEs were published on June 7, 2026: 0 critical, 1 high. Days are UTC.

- [CVE-2026-11469](https://cve.now/CVE-2026-11469.md): jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery (CVSS 5.1, jishenghua jshERP)
- [CVE-2026-11468](https://cve.now/CVE-2026-11468.md): SourceCodester Hospitals Patient Records Management System page room\_types cross site scripting (CVSS 4.8, SourceCodester Hospitals Patient Records Management System)
- [CVE-2026-11467](https://cve.now/CVE-2026-11467.md): jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal (CVSS 5.3, jishenghua jshERP)
- [CVE-2026-11466](https://cve.now/CVE-2026-11466.md): zilliztech deep-searcher collection\_router.py CollectionRouter.invoke access control (CVSS 5.3, zilliztech deep-searcher · deepsearcher)
- [CVE-2026-11465](https://cve.now/CVE-2026-11465.md): songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error (CVSS 2.3, songquanpeng one-api · github.com/songquanpeng/one-api)
- [CVE-2026-11464](https://cve.now/CVE-2026-11464.md): JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure (CVSS 2.3, JeecgBoot)
- [CVE-2026-11463](https://cve.now/CVE-2026-11463.md): USCiLab Cereal Shared Pointer type confusion (CVSS 6.3, USCiLab Cereal)
- [CVE-2026-11462](https://cve.now/CVE-2026-11462.md): Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization (CVSS 6.9, Chengdu Everbrite Network Technology BeikeShop)
- [CVE-2026-11461](https://cve.now/CVE-2026-11461.md): NousResearch hermes-agent resume Endpoint hermes\_state.py resolve\_session\_by\_title authorization (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-11460](https://cve.now/CVE-2026-11460.md): Boost Serialization improper validation of specified type of input (CVSS 6.3, Boost Serialization)
- [CVE-2026-49494](https://cve.now/CVE-2026-49494.md): Xcitium Client Security / Comodo Internet Security Remote Denial of Service (CVSS 8.7, Xcitium (formerly Comodo Security Solutions) Comodo Interne…)
- [CVE-2026-11459](https://cve.now/CVE-2026-11459.md): SecureAge CatchPulse IOCTL saappctl.sys information disclosure (CVSS 4.8, SecureAge CatchPulse)
- [CVE-2026-11458](https://cve.now/CVE-2026-11458.md): erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure (CVSS 6.9, erzhongxmu JeeWMS)
- [CVE-2026-11457](https://cve.now/CVE-2026-11457.md): erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection (CVSS 6.9, erzhongxmu JeeWMS)
- [CVE-2026-11456](https://cve.now/CVE-2026-11456.md): Chanjet CRM HTTP GET Request jxf\_dump\_systable.php sql injection (CVSS 6.9, Chanjet CRM)
- [CVE-2026-11455](https://cve.now/CVE-2026-11455.md): FoundationAgents MetaGPT common.py check\_cmd\_exists command injection (CVSS 2.3, FoundationAgents MetaGPT)
- [CVE-2026-11453](https://cve.now/CVE-2026-11453.md): Tiobon Employee Self-Service System Login Endpoint BlogSearch.aspx sql injection (CVSS 5.3, Tiobon Employee Self-Service System)
- [CVE-2026-11452](https://cve.now/CVE-2026-11452.md): GL.iNet GL-MT3000 SET\_USER\_PWD glc FUN\_0042e200 command injection (CVSS 6.9, GL.iNet GL-MT3000)
- [CVE-2026-11451](https://cve.now/CVE-2026-11451.md): GL.iNet GL-MT3000 FTP Protocol glc snprintf command injection (CVSS 6.9, GL.iNet GL-MT3000)
- [CVE-2026-11450](https://cve.now/CVE-2026-11450.md): GL.iNet GL-MT3000 Path Normalization dlopen command injection (CVSS 6.9, GL.iNet GL-MT3000)
- [CVE-2026-11449](https://cve.now/CVE-2026-11449.md): GL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc\_sys command injection (CVSS 5.3, GL.iNet GL-MT3000)
- [CVE-2026-11448](https://cve.now/CVE-2026-11448.md): GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection (CVSS 5.1, GL.iNet GL-MT3000)
- [CVE-2026-11447](https://cve.now/CVE-2026-11447.md): GL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo\_backend command injection (CVSS 5.3, GL.iNet GL-MT3000)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.