# CVEs published 2026-06-10

251 CVEs were published on June 10, 2026: 23 critical, 96 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-47342](https://cve.now/CVE-2026-47342.md): Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass (CVSS 8.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-46645](https://cve.now/CVE-2026-46645.md): SQLAdmin: Authorization Bypass on \`ajax\_lookup\` (CVSS 4.3, smithyhq sqladmin · sqladmin)
- [CVE-2026-50223](https://cve.now/CVE-2026-50223.md): Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution (CVSS 8.8, Apache Software Foundation Apache OFBiz)
- [CVE-2026-46695](https://cve.now/CVE-2026-46695.md): BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files (CVSS 10.0, boxlite-ai boxlite · boxlite +3)
- [CVE-2026-46703](https://cve.now/CVE-2026-46703.md): BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host (CVSS 9.6, boxlite-ai boxlite · boxlite +3)
- [CVE-2026-47213](https://cve.now/CVE-2026-47213.md): BoxLite: Timeout Bypass Vulnerability (CVSS 6.5, boxlite-ai boxlite · boxlite)
- [CVE-2026-42568](https://cve.now/CVE-2026-42568.md): Yamcs Vulnerable to LDAP Injection in LdapAuthModule (CVSS 4.3, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-52726](https://cve.now/CVE-2026-52726.md): Dulwich's submodule path traversal in porcelain.submodule\_update / porcelain.clone(recurse\_submodules=True) yields RCE via attacker-dropped .git/hooks payload (CVSS 7.5, jelmer dulwich · dulwich)
- [CVE-2026-44693](https://cve.now/CVE-2026-44693.md): Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer (CVSS 8.8, pi-hole FTL)
- [CVE-2026-47734](https://cve.now/CVE-2026-47734.md): Dulwich has unbounded memory allocation in receive-pack from crafted thin packs (CVSS 5.7, jelmer dulwich · dulwich)
- [CVE-2026-53465](https://cve.now/CVE-2026-53465.md): ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame image (CVSS 6.2, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-53464](https://cve.now/CVE-2026-53464.md): ImageMagick: Memory Leak in wand option parser when providing invalid arguments (CVSS 4.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-53463](https://cve.now/CVE-2026-53463.md): ImageMagick: Null Pointer Dereference in distort operation when passing incorrect arguments (CVSS 4.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-53462](https://cve.now/CVE-2026-53462.md): ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent fails (CVSS 5.9, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-53461](https://cve.now/CVE-2026-53461.md): ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop (CVSS 7.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-53460](https://cve.now/CVE-2026-53460.md): ImageMagick: Policy Bypass can trigger out-of-Memory condition (CVSS 7.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-47712](https://cve.now/CVE-2026-47712.md): Dulwich doesn't sanitize commit subjects in \`porcelain.format\_patch\` (CVSS 3.3, jelmer dulwich · dulwich)
- [CVE-2026-49219](https://cve.now/CVE-2026-49219.md): ImageMagick: Policy Bypass can read disallowed files (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-49218](https://cve.now/CVE-2026-49218.md): ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions (CVSS 7.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-48994](https://cve.now/CVE-2026-48994.md): ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems (CVSS 5.9, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-48734](https://cve.now/CVE-2026-48734.md): ImageMagick: Stack Overflow in MVG decoder (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-42305](https://cve.now/CVE-2026-42305.md): Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows (CVSS 8.8, jelmer dulwich · dulwich)
- [CVE-2024-21944](https://cve.now/CVE-2024-21944.md): Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys (CVSS 5.3, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Series Pr…)
- [CVE-2026-48733](https://cve.now/CVE-2026-48733.md): ImageMagick: Infinite Loop in subimage-search with crafted image (CVSS 4.7, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-48724](https://cve.now/CVE-2026-48724.md): ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-47166](https://cve.now/CVE-2026-47166.md): ImageMagick: Heap Buffer Over-Read in distributed pixel cache server (CVSS 5.7, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-47165](https://cve.now/CVE-2026-47165.md): ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model (CVSS 4.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-46693](https://cve.now/CVE-2026-46693.md): ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking (CVSS 4.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-42563](https://cve.now/CVE-2026-42563.md): Dulwich Vulnerable to Command Injection via Merge Driver Path (CVSS 7.7, jelmer dulwich · dulwich)
- [CVE-2026-46692](https://cve.now/CVE-2026-46692.md): ImageMagick: Heap Buffer Over-Write in distributed pixel cache server (CVSS 4.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-46559](https://cve.now/CVE-2026-46559.md): ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder (CVSS 4.0, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-46557](https://cve.now/CVE-2026-46557.md): ImageMagick: Stack overflow in fx operation (CVSS 6.2, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-46521](https://cve.now/CVE-2026-46521.md): ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-42558](https://cve.now/CVE-2026-42558.md): Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet (CVSS 7.6, xibosignage xibo-cms)
- [CVE-2026-46520](https://cve.now/CVE-2026-46520.md): ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions (CVSS 7.5, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-45664](https://cve.now/CVE-2026-45664.md): ImageMagick: Policy Bypass in MNG coder could (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-46522](https://cve.now/CVE-2026-46522.md): ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion (CVSS 7.5, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-45624](https://cve.now/CVE-2026-45624.md): ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation. (CVSS 5.1, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-45359](https://cve.now/CVE-2026-45359.md): ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define (CVSS 5.7, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-45358](https://cve.now/CVE-2026-45358.md): ImageMagick: Out-of-Bounds Read of a single byte in meta encoder (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-42326](https://cve.now/CVE-2026-42326.md): ImageMagick: Heap Buffer Over-Read in IPTC encoder (CVSS 5.1, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-45031](https://cve.now/CVE-2026-45031.md): ImageMagick: Policy Bypass in PSD decoder (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-2049](https://cve.now/CVE-2026-2049.md): GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-46523](https://cve.now/CVE-2026-46523.md): ImageMagick: Use-After-Free in MSL decoder. (CVSS 6.2, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-46625](https://cve.now/CVE-2026-46625.md): JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection (CVSS 7.5, js-cookie)
- [CVE-2026-45783](https://cve.now/CVE-2026-45783.md): libp2p: Unvalidated PUT\_VALUE records allow unbounded disk exhaustion on DHT server nodes (CVSS 7.5, js-libp2p · @libp2p/kad-dht)
- [CVE-2026-46679](https://cve.now/CVE-2026-46679.md): libp2p: Memory DoS via subscription flood of unique topics (CVSS 7.5, js-libp2p · @libp2p/gossipsub)
- [CVE-2026-11604](https://cve.now/CVE-2026-11604.md): An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenti (CVSS 5.6, OpenVPN ovpn-dco-win)
- [CVE-2026-0274](https://cve.now/CVE-2026-0274.md): Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration (CVSS 8.1, Palo Alto Networks Cortex XSIAM CommvaultSecurityIQ Marketp…)
- [CVE-2026-0273](https://cve.now/CVE-2026-0273.md): PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI (CVSS 6.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0272](https://cve.now/CVE-2026-0272.md): PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI) (CVSS 6.0, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0271](https://cve.now/CVE-2026-0271.md): Prisma Access Agent: Local Privilege Escalation by Authorized Users (CVSS 5.9, Palo Alto Networks Prisma Access Agent)
- [CVE-2026-0270](https://cve.now/CVE-2026-0270.md): Cortex XSOAR: Path Traversal Vulnerability (CVSS 4.8, Palo Alto Networks Cortex XSOAR)
- [CVE-2026-0269](https://cve.now/CVE-2026-0269.md): PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing (CVSS 4.6, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +2)
- [CVE-2026-0268](https://cve.now/CVE-2026-0268.md): Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux (CVSS 4.4, Palo Alto Networks Prisma Access Agent)
- [CVE-2026-53742](https://cve.now/CVE-2026-53742.md): Simple Link Directory through 9.0.4 Stored XSS via Embed Shortcode Attributes (CVSS 5.1, quantumcloud Simple Link Directory)
- [CVE-2026-53741](https://cve.now/CVE-2026-53741.md): Simple Link Directory through 9.0.4 Stored XSS via sld\_no\_results\_found Option (CVSS 5.1, quantumcloud Simple Link Directory)
- [CVE-2026-53740](https://cve.now/CVE-2026-53740.md): Yoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish Notice (CVSS 5.1, Yoast Duplicate Post)
- [CVE-2026-53739](https://cve.now/CVE-2026-53739.md): Yoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate\_post\_dismiss\_notice (CVSS 5.1, Yoast Duplicate Post)
- [CVE-2026-53738](https://cve.now/CVE-2026-53738.md): Copy & Delete Posts through 1.5.4 Privilege Escalation via cdp\_action\_handling Handler (CVSS 7.2, Inisev Copy & Delete Posts)
- [CVE-2026-53737](https://cve.now/CVE-2026-53737.md): Juicer through 1.12.18 Stored Cross-Site Scripting via Unescaped API Response (CVSS 5.3, saas.group Juicer)
- [CVE-2026-53736](https://cve.now/CVE-2026-53736.md): Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate\_post Action (CVSS 5.1, bplugins Easy Twitter Feeds)
- [CVE-2026-42542](https://cve.now/CVE-2026-42542.md): TDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS) (CVSS 7.5, taosdata TDengine)
- [CVE-2026-0267](https://cve.now/CVE-2026-0267.md): GlobalProtect App: Information Exposure Vulnerability on macOS (CVSS 4.4, Palo Alto Networks GlobalProtect App · Palo Alto Networks G…)
- [CVE-2026-0266](https://cve.now/CVE-2026-0266.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (CVSS 1.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-46689](https://cve.now/CVE-2026-46689.md): Kanidm: Unauthenticated process abort via SCIM filter stack exhaustion (CVSS 8.7, kanidm · scim\_proto +1)
- [CVE-2026-50131](https://cve.now/CVE-2026-50131.md): Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges (CVSS 8.6, fedify-dev fedify · fedify-dev vocab-runtime +2)
- [CVE-2026-48110](https://cve.now/CVE-2026-48110.md): Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds (CVSS 7.5, Eugeny russh · russh)
- [CVE-2026-48108](https://cve.now/CVE-2026-48108.md): Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input (CVSS 5.3, Eugeny russh · russh)
- [CVE-2026-48107](https://cve.now/CVE-2026-48107.md): Russh: Unchecked keyboard-interactive prompt count in client auth path (CVSS 6.5, Eugeny russh · russh)
- [CVE-2026-10143](https://cve.now/CVE-2026-10143.md): kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py (CVSS 7.5, Dana Powers kafka-python · kafka-python)
- [CVE-2026-42462](https://cve.now/CVE-2026-42462.md): Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring (CVSS 7.0, fedify-dev fedify · @fedify/fedify)
- [CVE-2026-46705](https://cve.now/CVE-2026-46705.md): russh server userauth state is not reset when authentication principal changes (CVSS 5.3, Eugeny russh · russh)
- [CVE-2026-46702](https://cve.now/CVE-2026-46702.md): Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets (CVSS 7.5, Eugeny russh · russh)
- [CVE-2026-46673](https://cve.now/CVE-2026-46673.md): Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases (CVSS 7.5, Eugeny russh · russh-cryptovec +1)
- [CVE-2026-10142](https://cve.now/CVE-2026-10142.md): kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length (CVSS 7.5, Dana Powers kafka-python · kafka-python)
- [CVE-2026-46668](https://cve.now/CVE-2026-46668.md): SpiceDB: Caveat structures with nested lists can result in improper cache reuse (CVSS 2.3, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2026-46669](https://cve.now/CVE-2026-46669.md): \`openvm-pairing\` pairing check missing proper subfield check on scaling factor (CVSS 8.7, openvm-org openvm)
- [CVE-2022-48575](https://cve.now/CVE-2022-48575.md): A person with access to a Mac may be able to bypass Login Window. (CVSS 3.5, Apple macOS Monterey)
- [CVE-2022-26758](https://cve.now/CVE-2022-26758.md): A malicious application may cause unexpected changes in memory shared between processes. (CVSS 7.1, Apple macOS Monterey)
- [CVE-2026-48011](https://cve.now/CVE-2026-48011.md): Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames (CVSS 3.7, shopware · shopware/platform +1)
- [CVE-2026-46654](https://cve.now/CVE-2026-46654.md): Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss (CVSS 8.9, Plonky3 · p3-challenger)
- [CVE-2026-44692](https://cve.now/CVE-2026-44692.md): Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint (CVSS 7.7, code16 sharp · code16/sharp)
- [CVE-2026-53634](https://cve.now/CVE-2026-53634.md): Sharp: Missing Authorization Check in Quick Creation Command Endpoints (CVSS 4.3, code16 sharp · code16/sharp)
- [CVE-2026-45380](https://cve.now/CVE-2026-45380.md): bit7z: Path Traversal via Null Byte Injection from \`gcount()\` Off-by-One in \`restoreSymlink()\` (CVSS 3.6, rikyoz bit7z)
- [CVE-2026-45384](https://cve.now/CVE-2026-45384.md): bit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive Update (CVSS 6.1, rikyoz bit7z)
- [CVE-2026-45106](https://cve.now/CVE-2026-45106.md): Weblate: Stored HTML injection in editor search preview (CVSS 4.6, WeblateOrg weblate · weblate)
- [CVE-2026-50127](https://cve.now/CVE-2026-50127.md): Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) (CVSS 5.9, WeblateOrg weblate · weblate)
- [CVE-2026-46683](https://cve.now/CVE-2026-46683.md): Snappy: SSRF and local file read via the xsl-style-sheet option (CVSS 6.9, KnpLabs snappy · knplabs/knp-snappy)
- [CVE-2026-46643](https://cve.now/CVE-2026-46643.md): Snappy: Binary path is never shell-escaped due to an inverted is\_executable check (CVSS 7.5, KnpLabs snappy · KnpLabs/knp-snappy)
- [CVE-2026-6893](https://cve.now/CVE-2026-6893.md): Dracut: dracut: root code execution via dhcp options command injection (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +1)
- [CVE-2026-46529](https://cve.now/CVE-2026-46529.md): PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVSS 8.4, mate-desktop atril)
- [CVE-2026-1220](https://cve.now/CVE-2026-1220.md): Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (CVSS 7.5, Google Chrome)
- [CVE-2026-11626](https://cve.now/CVE-2026-11626.md): Local Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool (CVSS 5.4, Broadcom Symantec Endpoint Protection CleanWipe Removal Tool)
- [CVE-2026-50639](https://cve.now/CVE-2026-50639.md): Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections (CVSS 6.5, PEVANS Metrics::Any::Adapter::SignalFx)
- [CVE-2026-50638](https://cve.now/CVE-2026-50638.md): Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections (CVSS 9.1, PEVANS Metrics::Any::Adapter::DogStatsd)
- [CVE-2026-50637](https://cve.now/CVE-2026-50637.md): Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections (CVSS 8.2, PEVANS Metrics::Any::Adapter::Statsd)
- [CVE-2026-10740](https://cve.now/CVE-2026-10740.md): Excessive memory allocation in s2n-quic (CVSS 5.3, AWS s2n-quic · s2n-quic)
- [CVE-2026-46642](https://cve.now/CVE-2026-46642.md): draw.io: XSS via crafted cell label when opening a .drawio file (CVSS 6.1, jgraph drawio)
- [CVE-2026-11417](https://cve.now/CVE-2026-11417.md): OS Command Injection in NodejsFunction Bundling in aws-cdk-lib (CVSS 7.3, AWS Cloud Development Kit library · aws-cdk-lib)
- [CVE-2026-45062](https://cve.now/CVE-2026-45062.md): FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files (CVSS 8.1, frankenphp · github.com/dunglas/frankenphp)
- [CVE-2026-50570](https://cve.now/CVE-2026-50570.md): Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP\_SYS\_TIME and cross-tenant node wall-clock corruption (CVSS 8.5, fission · github.com/fission/fission)
- [CVE-2026-50569](https://cve.now/CVE-2026-50569.md): Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks (CVSS 4.3, fission · github.com/fission/fission)
- [CVE-2026-50568](https://cve.now/CVE-2026-50568.md): Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape (CVSS 3.6, fission · github.com/fission/fission)
- [CVE-2026-50567](https://cve.now/CVE-2026-50567.md): Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory (CVSS 7.7, fission · github.com/fission/fission)
- [CVE-2026-50566](https://cve.now/CVE-2026-50566.md): Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation (CVSS 9.9, fission · github.com/fission/fission)
- [CVE-2026-50565](https://cve.now/CVE-2026-50565.md): Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container (CVSS 4.9, fission · github.com/fission/fission)
- [CVE-2026-50564](https://cve.now/CVE-2026-50564.md): Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape (CVSS 9.9, fission · github.com/fission/fission)
- [CVE-2026-50563](https://cve.now/CVE-2026-50563.md): Fission Container Executor Function PodSpec Injection Leading to Node Escape (CVSS 9.9, fission · github.com/fission/fission)
- [CVE-2026-50545](https://cve.now/CVE-2026-50545.md): Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover (CVSS 9.9, fission · github.com/fission/fission)
- [CVE-2026-49824](https://cve.now/CVE-2026-49824.md): Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook (CVSS 8.5, fission · github.com/fission/fission)
- [CVE-2026-49823](https://cve.now/CVE-2026-49823.md): Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook (CVSS 7.7, fission · github.com/fission/fission)
- [CVE-2026-49822](https://cve.now/CVE-2026-49822.md): Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance (CVSS 7.7, fission · github.com/fission/fission)
- [CVE-2026-49821](https://cve.now/CVE-2026-49821.md): Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration (CVSS 7.7, fission · github.com/fission/fission)
- [CVE-2026-46618](https://cve.now/CVE-2026-46618.md): Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables (CVSS 6.9, fission · github.com/fission/fission)
- [CVE-2026-46617](https://cve.now/CVE-2026-46617.md): Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read (CVSS 8.7, fission · github.com/fission/fission)
- [CVE-2026-46612](https://cve.now/CVE-2026-46612.md): Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives (CVSS 8.8, fission · github.com/fission/fission)
- [CVE-2026-46614](https://cve.now/CVE-2026-46614.md): Fission router exposes /fission-function/\<ns\>/\<name\> on its public listener, allowing invocation of any function without an HTTPTrigger (CVSS 9.8, fission · github.com/fission/fission)
- [CVE-2026-20258](https://cve.now/CVE-2026-20258.md): Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise (CVSS 7.1, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20253](https://cve.now/CVE-2026-20253.md): Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise (CVSS 9.8, KEV, Splunk Enterprise)
- [CVE-2026-20260](https://cve.now/CVE-2026-20260.md): Log Injection through HTTP Request Paths in Splunk SOAR (CVSS 4.3, Splunk SOAR)
- [CVE-2026-20252](https://cve.now/CVE-2026-20252.md): Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise (CVSS 7.6, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20257](https://cve.now/CVE-2026-20257.md): Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise (CVSS 5.7, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20259](https://cve.now/CVE-2026-20259.md): Improper Access Control in Splunk Enterprise (CVSS 5.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20255](https://cve.now/CVE-2026-20255.md): Improper Input Validation through Classic Dashboards in Splunk Enterprise (CVSS 5.7, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20251](https://cve.now/CVE-2026-20251.md): Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway (CVSS 8.8, Splunk Enterprise · Splunk Cloud Platform +1)
- [CVE-2026-20254](https://cve.now/CVE-2026-20254.md): Information Disclosure through External Content Restriction Bypass in Splunk Enterprise (CVSS 5.7, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20256](https://cve.now/CVE-2026-20256.md): Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise (CVSS 5.7, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-11596](https://cve.now/CVE-2026-11596.md): In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user wit (CVSS 4.7, ConnectWise ScreenConnect)
- [CVE-2026-9151](https://cve.now/CVE-2026-9151.md): Command Injection Vulnerability in OpenVPN on Multiple TP-Link Archer Routers (CVSS 8.5, TP-Link Systems Archer AX12 · TP-Link Systems Archer AX18 +2)
- [CVE-2026-46609](https://cve.now/CVE-2026-46609.md): Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog (CVSS 4.6, Umbraco-CMS · Umbraco.Cms)
- [CVE-2026-46616](https://cve.now/CVE-2026-46616.md): Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers (CVSS 5.4, Umbraco-CMS · Umbraco.Cms)
- [CVE-2026-46497](https://cve.now/CVE-2026-46497.md): SSRF via sitemap-derived URLs in Crawlee for Python (CVSS 2.3, apify crawlee-python · crawlee)
- [CVE-2026-46558](https://cve.now/CVE-2026-46558.md): Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces (CVSS 8.3, makeplane plane)
- [CVE-2026-45569](https://cve.now/CVE-2026-45569.md): Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug) (CVSS 8.1, roxy-wi)
- [CVE-2026-45567](https://cve.now/CVE-2026-45567.md): Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt (CVSS 8.3, roxy-wi)
- [CVE-2026-45566](https://cve.now/CVE-2026-45566.md): Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass (CVSS 6.1, roxy-wi)
- [CVE-2026-45565](https://cve.now/CVE-2026-45565.md): Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors) (CVSS 8.1, roxy-wi)
- [CVE-2026-48096](https://cve.now/CVE-2026-48096.md): OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning (CVSS 5.0, openfga · github.com/openfga/openfga)
- [CVE-2026-53694](https://cve.now/CVE-2026-53694.md): Potential local privileges escalation through argument injection in the nxchmod.sh script (CVSS 7.3, NoMachine)
- [CVE-2026-25700](https://cve.now/CVE-2026-25700.md): Apache Answer: AdminToken not invalidated after admin deactivation (CVSS 7.2, Apache Software Foundation Apache Answer · github.com/ap… +1)
- [CVE-2026-48856](https://cve.now/CVE-2026-48856.md): httpc leaks Authorization header to cross-origin redirect targets (CVSS 7.1, Erlang OTP)
- [CVE-2026-48860](https://cve.now/CVE-2026-48860.md): Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet\_tls\_dist (CVSS 7.5, Erlang OTP)
- [CVE-2026-48855](https://cve.now/CVE-2026-48855.md): SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured (CVSS 2.3, Erlang OTP)
- [CVE-2026-48858](https://cve.now/CVE-2026-48858.md): ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks (CVSS 6.3, Erlang OTP)
- [CVE-2026-48859](https://cve.now/CVE-2026-48859.md): SSH server timing side-channel in ssh\_auth:check\_password/3 allows unauthenticated username enumeration (CVSS 6.3, Erlang OTP)
- [CVE-2026-49759](https://cve.now/CVE-2026-49759.md): Stack buffer overflow in SCTP error cause parsing in inet\_drv allows remote VM crash (CVSS 8.8, Erlang OTP)
- [CVE-2026-49760](https://cve.now/CVE-2026-49760.md): Stack Buffer Overflow in ei\_s\_print\_term at Very Large Integer (CVSS 6.9, Erlang OTP)
- [CVE-2026-53693](https://cve.now/CVE-2026-53693.md): MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels (CVSS 6.9, misp bsimvis)
- [CVE-2026-8335](https://cve.now/CVE-2026-8335.md): Missing authentication in Aix-DB (CVSS 7.1, Aix-DB)
- [CVE-2025-10238](https://cve.now/CVE-2025-10238.md): During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products c (CVSS 8.4, Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad)… +106)
- [CVE-2025-10237](https://cve.now/CVE-2025-10237.md): During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could al (CVSS 8.4, Lenovo X13 Gen 6 (Type 21RK, 21RL) Laptops (ThinkPad) B… +93)
- [CVE-2026-6090](https://cve.now/CVE-2026-6090.md): A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute ar (CVSS 7.3, Lenovo Smart Connect)
- [CVE-2026-8637](https://cve.now/CVE-2026-8637.md): A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authent (CVSS 8.5, Lenovo LanSchool Classic)
- [CVE-2026-9045](https://cve.now/CVE-2026-9045.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise fo (CVSS 8.5, Lenovo Accessories and Display Manager for Enterprise)
- [CVE-2026-7516](https://cve.now/CVE-2026-7516.md): A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow (CVSS 5.1, Lenovo Application)
- [CVE-2026-11884](https://cve.now/CVE-2026-11884.md): 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc\_superior in size calculation (CVSS 6.5, Red Hat Directory Server · Red Hat Enterprise Linux)
- [CVE-2026-45564](https://cve.now/CVE-2026-45564.md): Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save) (CVSS 8.8, roxy-wi)
- [CVE-2026-45563](https://cve.now/CVE-2026-45563.md): Roxy-WI: IDOR — any authenticated user can read another user's full action history (CVSS 4.3, roxy-wi)
- [CVE-2026-45561](https://cve.now/CVE-2026-45561.md): Roxy-WI: SSRF in /smon/agent/\<endpoint\>/\<server\_ip\> reachable to cloud metadata IPs (CVSS 6.5, roxy-wi)
- [CVE-2026-45560](https://cve.now/CVE-2026-45560.md): Roxy-WI: Stored XSS in log viewer (wrap\_line/highlight\_word produce unescaped HTML) (CVSS 6.1, roxy-wi)
- [CVE-2026-45559](https://cve.now/CVE-2026-45559.md): Roxy-WI: LDAP injection in /user/ldap/\<username\> (admin-only) (CVSS 4.9, roxy-wi)
- [CVE-2026-45558](https://cve.now/CVE-2026-45558.md): Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via \`option\` field config injection in section save (CVSS 9.9, roxy-wi)
- [CVE-2026-45556](https://cve.now/CVE-2026-45556.md): Roxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save \`config\_file\_name\` (CVSS 9.9, roxy-wi)
- [CVE-2026-45550](https://cve.now/CVE-2026-45550.md): Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body (CVSS 9.1, roxy-wi)
- [CVE-2026-45549](https://cve.now/CVE-2026-45549.md): Roxy-WI: Authorization bypass on POST /smon/agent/action/\<action\> — guest can stop or restart smon-agent on any host (CVSS 8.5, roxy-wi)
- [CVE-2026-45552](https://cve.now/CVE-2026-45552.md): Roxy-WI: Cross-tenant authorization bypass on /install/\* — guest can run Ansible / SSH on every registered server (CVSS 9.9, roxy-wi)
- [CVE-2026-53470](https://cve.now/CVE-2026-53470.md): Migration-planner: getsourcedownloadurl missing organization check (CVSS 9.6, migration-planner · github.com/kubev2v/migration-planner)
- [CVE-2026-53476](https://cve.now/CVE-2026-53476.md): Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write (CVSS 9.6, assisted-migration-agent · github.com/kubev2v/assisted-migr…)
- [CVE-2026-53475](https://cve.now/CVE-2026-53475.md): Assisted-migration-agent: tls verification disabled on all vcenter connections (CVSS 9.3, assisted-migration-agent · github.com/kubev2v/assisted-migr…)
- [CVE-2026-53471](https://cve.now/CVE-2026-53471.md): Migration-planner: agent api ignores jwt source\_id claim (CVSS 9.6, migration-planner · github.com/kubev2v/migration-planner)
- [CVE-2026-53474](https://cve.now/CVE-2026-53474.md): Migration-planner: second-order sql injection via rvtools upload (CVSS 9.6, migration-planner · github.com/kubev2v/migration-planner)
- [CVE-2026-53473](https://cve.now/CVE-2026-53473.md): Migration-planner-ui-app: stored xss via javascript: url in agent credential link (CVSS 7.3, migration-planner-ui-app)
- [CVE-2026-53469](https://cve.now/CVE-2026-53469.md): Migration-planner: unprotected delete endpoint wipes all tenant data (CVSS 9.1, migration-planner · github.com/kubev2v/migration-planner)
- [CVE-2026-53689](https://cve.now/CVE-2026-53689.md): libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS ser (CVSS 7.1, sahlberg libnfs)
- [CVE-2026-53442](https://cve.now/CVE-2026-53442.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job conf (CVSS 5.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53441](https://cve.now/CVE-2026-53441.md): Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of (CVSS 5.4, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53440](https://cve.now/CVE-2026-53440.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53439](https://cve.now/CVE-2026-53439.md): Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine ot (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53438](https://cve.now/CVE-2026-53438.md): A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking I (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53437](https://cve.now/CVE-2026-53437.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53436](https://cve.now/CVE-2026-53436.md): Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2026-53435](https://cve.now/CVE-2026-53435.md): In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in J (CVSS 8.8, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2025-71329](https://cve.now/CVE-2025-71329.md): image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser (CVSS 8.7, image-size)
- [CVE-2025-71330](https://cve.now/CVE-2025-71330.md): image-size 2.0.2 Denial of Service via Malformed ICNS Image Parsing (CVSS 8.7, image-size)
- [CVE-2026-52759](https://cve.now/CVE-2026-52759.md): Ghidra \< 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser (CVSS 6.7, Ghidra)
- [CVE-2026-52758](https://cve.now/CVE-2026-52758.md): Ghidra \< 12.1 - SQL Injection via Unescaped Filter Values in BSim Search (CVSS 8.7, nationalsecurityagency ghidra)
- [CVE-2026-52757](https://cve.now/CVE-2026-52757.md): Ghidra \< 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation (CVSS 4.6, nationalsecurityagency ghidra)
- [CVE-2026-52756](https://cve.now/CVE-2026-52756.md): Ghidra \< 12.2 - Unauthenticated Path Traversal in Debugger ISF Server (CVSS 6.3, nationalsecurityagency ghidra)
- [CVE-2026-52755](https://cve.now/CVE-2026-52755.md): Ghidra \< 12.0.4 - Path Traversal via Zip Slip in Theme Import (CVSS 8.4, nationalsecurityagency ghidra)
- [CVE-2026-52754](https://cve.now/CVE-2026-52754.md): Ghidra \< 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule (CVSS 8.7, nationalsecurityagency ghidra)
- [CVE-2026-52753](https://cve.now/CVE-2026-52753.md): Ghidra \< 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol (CVSS 6.7, nationalsecurityagency ghidra)
- [CVE-2026-52752](https://cve.now/CVE-2026-52752.md): Ghidra \< 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names (CVSS 8.4, nationalsecurityagency ghidra)
- [CVE-2026-49069](https://cve.now/CVE-2026-49069.md): WordPress WPZOOM Portfolio plugin \<= 1.4.21 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPZOOM Portfolio)
- [CVE-2026-52751](https://cve.now/CVE-2026-52751.md): Ghidra \< 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection (CVSS 8.6, nationalsecurityagency ghidra)
- [CVE-2026-52750](https://cve.now/CVE-2026-52750.md): Ghidra \< 12.1- Command Injection via URL Annotation Click (CVSS 7.3, nationalsecurityagency ghidra)
- [CVE-2026-49498](https://cve.now/CVE-2026-49498.md): Ghidra 11.0 \< 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username (CVSS 8.7, nationalsecurityagency ghidra)
- [CVE-2026-49497](https://cve.now/CVE-2026-49497.md): Ghidra \< 12.1 - Path Traversal via .gnu\_debuglink in DWARF External Debug File Resolution (CVSS 4.6, nationalsecurityagency ghidra)
- [CVE-2026-49496](https://cve.now/CVE-2026-49496.md): Ghidra \< 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation (CVSS 6.9, nationalsecurityagency ghidra)
- [CVE-2026-49495](https://cve.now/CVE-2026-49495.md): Ghidra 10.2 \< 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser (CVSS 6.7, nationalsecurityagency ghidra)
- [CVE-2024-58350](https://cve.now/CVE-2024-58350.md): Ghidra \< 11.2 - Use After Free in Sleigh Backend via Static Initialization Order (CVSS 2.1, nationalsecurityagency ghidra)
- [CVE-2026-9758](https://cve.now/CVE-2026-9758.md): Improper Certificate Validation in S2OPC (CVSS 7.3, Systerel S2OPC)
- [CVE-2026-24067](https://cve.now/CVE-2026-24067.md): Slate Digital Connect macOS XPC PID validation privilege escalation (CVSS 8.4, Slate Digital Connect)
- [CVE-2026-24066](https://cve.now/CVE-2026-24066.md): Slate Digital Connect macOS XPC certificate validation privilege escalation (CVSS 8.4, Slate Digital Connect)
- [CVE-2026-11859](https://cve.now/CVE-2026-11859.md): HTML injection in the Canarytoken links email (CVSS 2.0, Thinkst Applied Research Canarytokens)
- [CVE-2026-11853](https://cve.now/CVE-2026-11853.md): Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. (CVSS 6.5, Debian debusine)
- [CVE-2026-11852](https://cve.now/CVE-2026-11852.md): Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. (CVSS 6.5, Debian debusine)
- [CVE-2026-3018](https://cve.now/CVE-2026-3018.md): Newsletters \<= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber\_id Parameter (CVSS 7.5, contrid Newsletters)
- [CVE-2025-6254](https://cve.now/CVE-2025-6254.md): Doctreat Core \<= 1.6.8 - Unauthenticated Privilege Escalation (CVSS 9.8, AmentoTech Doctreat Core)
- [CVE-2026-8613](https://cve.now/CVE-2026-8613.md): aThemes Addons for Elementor \<= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title\_tag' Widget Setting (CVSS 6.4, smub aThemes Addons for Elementor)
- [CVE-2026-8853](https://cve.now/CVE-2026-8853.md): MW WP Form \<= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter (CVSS 4.4, websoudan MW WP Form)
- [CVE-2026-10721](https://cve.now/CVE-2026-10721.md): Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components (CVSS 8.4, Concrete CMS · concrete5/concrete5)
- [CVE-2026-9019](https://cve.now/CVE-2026-9019.md): Easy Image Collage \<= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid\[properties\]\[borderColor\]' and 'grid\[images\]\[N\]\[attachment\_url\]' Parameters (CVSS 6.4, brechtvds Easy Image Collage)
- [CVE-2026-11815](https://cve.now/CVE-2026-11815.md): Insecure Deserialization via MITM in Layer 7 Policy Manager (CVSS 5.3, Broadcom Layer 7 API Gateway)
- [CVE-2026-10846](https://cve.now/CVE-2026-10846.md): Insufficient verification that responses belong to a query (CVSS 8.2, NLnet Labs ldns)
- [CVE-2026-29116](https://cve.now/CVE-2026-29116.md): A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, tri (CVSS 8.7, Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC)
- [CVE-2026-29115](https://cve.now/CVE-2026-29115.md): A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, trigg (CVSS 6.9, Dahua IPC/SD)
- [CVE-2026-9067](https://cve.now/CVE-2026-9067.md): Schema & Structured Data for WP & AMP \< 1.60 - Unauthenticated Arbitrary Media Upload (CVSS 9.1, Schema & Structured Data for WP & AMP)
- [CVE-2026-9060](https://cve.now/CVE-2026-9060.md): Agile Store Locator \< 1.6.6 - Admin+ Stored XSS via map\_style (CVSS 3.5, Store Locator WordPress)
- [CVE-2026-8071](https://cve.now/CVE-2026-8071.md): Spam protection, Honeypot, Anti-Spam by CleanTalk \< 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass (CVSS 8.8, Anti-Spam by CleanTalk. Spam protection)
- [CVE-2026-3326](https://cve.now/CVE-2026-3326.md): XStore \< 9.7.3 - Unauthenticated SQLi (CVSS 8.6, Xstore)
- [CVE-2026-29114](https://cve.now/CVE-2026-29114.md): A vulnerability has been found in some Dahua products. (CVSS 2.3, Dahua IPC)
- [CVE-2026-26240](https://cve.now/CVE-2026-26240.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2026-11837](https://cve.now/CVE-2026-11837.md): Ansible-collection-ansible-posix: ansible.posix authorized\_key: local privilege escalation via symlink-following chown (CVSS 7.3, Red Hat Enterprise Linux · Red Hat OpenStack Platform)
- [CVE-2026-26241](https://cve.now/CVE-2026-26241.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2025-8444](https://cve.now/CVE-2025-8444.md): Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates \<= 4.2.6 - Authenticated (Contributor+) DOM-Based… (CVSS 6.4, wealcoder Animation Addons – Elementor Addons, GSAP Animati…)
- [CVE-2026-24724](https://cve.now/CVE-2026-24724.md): File Station 5 (CVSS 6.2, QNAP Systems File Station)
- [CVE-2026-26239](https://cve.now/CVE-2026-26239.md): File Station 5 (CVSS 6.3, QNAP Systems File Station)
- [CVE-2026-26237](https://cve.now/CVE-2026-26237.md): QuMagie (CVSS 6.6, QNAP Systems QuMagie)
- [CVE-2026-24719](https://cve.now/CVE-2026-24719.md): QTS, QuTS hero (CVSS 6.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2026-24717](https://cve.now/CVE-2026-24717.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2026-24716](https://cve.now/CVE-2026-24716.md): QTS, QuTS hero (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2026-24720](https://cve.now/CVE-2026-24720.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2026-22899](https://cve.now/CVE-2026-22899.md): File Station 5 (CVSS 1.3, QNAP Systems File Station)
- [CVE-2026-22893](https://cve.now/CVE-2026-22893.md): QTS, QuTS hero (CVSS 8.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-66281](https://cve.now/CVE-2025-66281.md): QTS, QuTS hero (CVSS 6.9, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-66280](https://cve.now/CVE-2025-66280.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-66279](https://cve.now/CVE-2025-66279.md): QTS, QuTS hero (CVSS 8.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-66273](https://cve.now/CVE-2025-66273.md): QTS, QuTS hero (CVSS 8.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-62851](https://cve.now/CVE-2025-62851.md): License Center (CVSS 4.6, QNAP Systems License Center)
- [CVE-2025-62850](https://cve.now/CVE-2025-62850.md): NULL Pointer Dereference in networkRequest.cgi (CVSS 5.1, QNAP Systems QTS · QNAP Systems QVP +2)
- [CVE-2025-58468](https://cve.now/CVE-2025-58468.md): Notification Center (CVSS 5.1, QNAP Systems Notification Center)
- [CVE-2025-59382](https://cve.now/CVE-2025-59382.md): QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) (CVSS 1.2, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2025-66276](https://cve.now/CVE-2025-66276.md): QTS (CVSS 9.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2026-46532](https://cve.now/CVE-2026-46532.md): ESF-IDF: Heap Out-of-Bounds Read in Bluedroid AVRCP Target Parser (CVSS 4.6, espressif esp-idf)
- [CVE-2026-45542](https://cve.now/CVE-2026-45542.md): ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth (CVSS 7.1, espressif esp-idf)
- [CVE-2026-45329](https://cve.now/CVE-2026-45329.md): ESF-IDF: Out-of-Bounds Read in ESP-TEE Secure Service Wrappers (CVSS 7.1, espressif esp-idf)
- [CVE-2026-45328](https://cve.now/CVE-2026-45328.md): ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers (CVSS 9.3, espressif esp-idf)
- [CVE-2026-45160](https://cve.now/CVE-2026-45160.md): ESF-IDF: Out-of-bounds Read in lwIP DHCP Server Option Parser (CVSS 6.5, espressif esp-idf)
- [CVE-2026-45541](https://cve.now/CVE-2026-45541.md): ESF-IDF: Remote Null Pointer Dereference in WebSocket Server (CVSS 7.5, espressif esp-idf)
- [CVE-2026-53698](https://cve.now/CVE-2026-53698.md): Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set. (CVSS 6.5, Silverpeas · org.silverpeas.core:silverpeas-core-war +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.