CVEs published June 11, 2026
194 CVEs were published on June 11, 2026: 19 critical, 95 high. 1 is now in CISA KEV.
- Published
- 194
- Critical
- 19
- High
- 95
- Medium
- 71
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 163
Most affected products
- Google Chrome
- 27
- OpenClaw
- 14
- Apple macOS
- 11
- GitLab
- 11
- duck-organization quest-bot
- 10
- axios
- 9
- MacWarrior clipbucket-v5
- 5
- Spring Web Services · org.springframework.ws:spring-ws-secu…
- 5
- vim
- 5
- cerebrate
- 3
Critical 19
- CVE-2026-45060ClipBucket: Blind SQL Injection in progress_video.phpMacWarrior clipbucket-v5
- CVE-2026-42846ClipBucket: Remote Play URL Command InjectionMacWarrior clipbucket-v5
- CVE-2026-39494WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerabilityWBW Plugins Product Filter by WBW
- CVE-2026-42647WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerabilityBeardev JoomSport
- CVE-2026-49060WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerabilityHippoo Mobile App for WooCommerce
- CVE-2026-12027Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-41005UAA accepts SAML Encrypted Assertions authentication bypassCloud Foundry UAA · Cloud Foundry CF Deployment
- CVE-2026-49973Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settingsnesquena hermes-webui
- CVE-2026-47174Duck Site: Untrusted pull request code can trigger privileged production deploymentduck-organization duck-site
- CVE-2026-45177Idira Secrets Manager SaaS Edge: Authentication Bypass of an internal validation mechanismCyberArk Software, a Palo Alto Networks Company Conjur Cloud
- CVE-2026-47172Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.duck-organization quest-bot
- CVE-2026-49261MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`MariaDB server
- CVE-2026-11839Arbitrary File Upload in Basarsoft's RotabanBaşarsoft Information Technologies Rotaban
- CVE-2026-9648CVE-2026-9648Haskell Programming Language crypton-certificate
- CVE-2026-11561SSTI in Soagen Informatics' ApinizerSoagen Informatics Technologies Software and Consulting Api…
- CVE-2026-7852Unrestricted File Upload in Limatek's LimRAD NACLimatek System LimRAD NAC
- CVE-2026-4764Privilege Escalation in Dialogflow CX via Playbook ImportGoogle Cloud Dialogflow CX
- CVE-2026-35273Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2026-38581SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via
High 95
- CVE-2026-45418ClipBucket: Blind SQL Injection in subtitle_edit.phpMacWarrior clipbucket-v5
- CVE-2026-45171Idira Privileged Session Manager (PSM): Potential Code Execution due to an Incomplete Input ValidationCyberArk Software, a Palo Alto Networks Company Privileged…
- CVE-2026-45172Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS CommandCyberArk Software, a Palo Alto Networks Company PAM Self-Ho…
- CVE-2026-45173Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation FailureCyberArk Software, a Palo Alto Networks Company Identity Br…
- CVE-2026-45174Idira Endpoint Privilege Manager Linux Agent: Potential bypass of Agent Daemon InitializationCyberArk Software, a Palo Alto Networks Company Idira Endpo…
- CVE-2026-42653WordPress SliceWP plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityiova.mihai SliceWP
- CVE-2026-44890Netty has Unbounded Direct Memory Consumption in its RedisDecodernetty · io.netty:netty-codec-redis
- CVE-2026-44250Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arraysnetty · io.netty:netty-codec-redis
- CVE-2026-12035Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2026-12034Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 allowed a remote attacGoogle Chrome
- CVE-2026-12031Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the Google Chrome
- CVE-2026-12030Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-12029Use after free in Video in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-12028Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2026-12023Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-12022Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-12020Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2026-12019Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-12018Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilGoogle Chrome
- CVE-2026-12016Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-12014Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a saGoogle Chrome
- CVE-2026-12012Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploGoogle Chrome
- CVE-2026-12011Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-12010Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-12009Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who haGoogle Chrome
- CVE-2026-12008Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-12007Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a craftedGoogle Chrome
- CVE-2026-44249Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Maskingnetty · io.netty:netty-handler
- CVE-2026-6250Authenticated Format String Injection on TP-Link Tapo C110TP-Link Systems Tapo C110
- CVE-2026-53819OpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env OverrideOpenClaw
- CVE-2026-53817OpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device PairingOpenClaw
- CVE-2026-53816OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired NodeOpenClaw
- CVE-2026-53815OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read ActionsOpenClaw
- CVE-2026-53814OpenClaw < 2026.5.20 - Privilege Escalation via Hook-Triggered CLI MCP Tool AuthorityOpenClaw
- CVE-2026-53813OpenClaw < 2026.4.25 - Arbitrary Artifact Loading via Fake Package Root ResolutionOpenClaw
- CVE-2026-53811OpenClaw < 2026.5.7 - Privilege Escalation via Mutable Display Names in Matrix allowFromOpenClaw
- CVE-2026-53810OpenClaw < 2026.5.18 - Arbitrary Code Execution via Unscanned Marketplace Runtime Extension MetadataOpenClaw
- CVE-2026-53807OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFromOpenClaw
- CVE-2026-53806OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec RevalidationOpenClaw
- CVE-2026-50005Brickcom Cameras Use of Default CredentialsBrickcom Cube · Brickcom Dome +2
- CVE-2026-50245Brickcom Cameras Missing Authentication for Critical FunctionBrickcom Cube · Brickcom Dome +2
- CVE-2026-45175Idira Endpoint Privilege Manager Agent: Security Control and Cryptographic Validation Bypass in Internal Agent Validation ProcessesCyberArk Software, a Palo Alto Networks Company Idira Endpo…
- CVE-2026-46489SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logoSolidInvoice
- CVE-2026-46622SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breachSolidInvoice
- CVE-2026-47181PenguinMod-BackendApi: NoSQL Injection in Password Reset Endpoint Allows Account TakeoverPenguinMod-BackendApi
- CVE-2026-45176Idira Endpoint Privilege Manager Agent: Local Privilege Escalation via Internal Communication or File Operation ManipulationCyberArk Software, a Palo Alto Networks Company Idira Endpo…
- CVE-2025-46315A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-31272The issue was addressed with improved checks.Apple macOS
- CVE-2025-24284This issue was addressed with improved checks to prevent unauthorized actions.Apple macOS
- CVE-2026-47170Garlic-Hub: SSRF vulnerability in uploadFromUrl endpointgarlic-signage garlic-hub
- CVE-2026-46519mcp-server-kubernetes Affected By Tool Access Control Bypass: Presentation-Layer Filtering Without Execution-Layer EnforcementFlux159 mcp-server-kubernetes · mcp-server-kubernetes
- CVE-2026-52860Vim: Arbitrary Code Execution via Python Omni-Completionvim
- CVE-2026-48547KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.ymllingdojo kana-dojo
- CVE-2026-52858Vim: Arbitrary Code Execution via Python Omni-Completionvim
- CVE-2026-47162Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory namevim
- CVE-2026-47189Quest Bot: AutoMod removal can delete rules from another guild by global rule IDduck-organization quest-bot
- CVE-2026-47171Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`duck-organization quest-bot
- CVE-2026-47163Quest Bot: Unprivileged users can create and remove AutoMod rules.duck-organization quest-bot
- CVE-2026-47169Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accountsduck-organization quest-bot
- CVE-2026-45178Idira Secrets Manager Self-Hosted: Improper Access Control in Internal Cluster EndpointsCyberArk Software, a Palo Alto Networks Company Conjur Ente…
- CVE-2026-11774389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflowRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2026-48546KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjslingdojo kana-dojo
- CVE-2026-46697Fediverse Embeds: Unauthenticated SSRF / open proxy via REST media-proxy endpointstefanbohacek fediverse-embeds-wordpress-plugin
- CVE-2026-3329Nexus Repository Manager - Improper Restriction of Excessive Authentication AttemptsSonatype Nexus Repository Manager
- CVE-2026-49982tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/templateraszi node-tmp · tmp
- CVE-2026-44705tmp: Path Traversal via unsanitized prefix/postfix enables directory escaperaszi node-tmp · tmp
- CVE-2026-44486Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionaxios
- CVE-2026-44487Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapteraxios
- CVE-2026-44488Axios: Allocation of Resources Without Limits or Throttling in axiosaxios
- CVE-2026-44496Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injectionaxios
- CVE-2026-44495Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Mergeaxios
- CVE-2026-44494Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`axios
- CVE-2026-44492Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)axios
- CVE-2026-53777Perry < 0.5.1159 Path Traversal via ArtifactReady WebSocketPerryTS perry
- CVE-2026-7787Unauthenticated Session History Access via Public Flow ExecutionIBM Langflow OSS
- CVE-2026-7870IBM i is Affected by Privilege Escalation []IBM i
- CVE-2026-10847Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OScheckpoint Identity Agent
- CVE-2026-8406openSIS Classic 9.3 - Insecure Direct Object Reference in Sent MailOS4ED openSIS-Classic
- CVE-2026-11816Path Traversal in keras-team/keraskeras-team/keras · keras
- CVE-2026-53661boruta-server sent sensitive session cookies without the Secure attributemalach-it boruta-server
- CVE-2026-8464Path traversal in Neuron Soft Golem OEE MESNeuron Soft Golem OEE MES
- CVE-2026-7250Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-8589Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-10087Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-5497Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllmvllm-project/vllm · vllm
- CVE-2026-53901Cerebrate before v1.37 allows mass assignment of record identifiers during object creationcerebrate
- CVE-2023-33999WordPress WP Mail Log plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityWPVibes WP Mail Log
- CVE-2026-10795UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpcdavidanderson UpdraftPlus: WP Backup & Migration Plugin
- CVE-2026-41856Spring GraphQL Annotation Detection VulnerabilitySpring for GraphQL · org.springframework.graphql:spring-gra…
- CVE-2026-41700Cross-Site WebSocket Hijacking in Spring for GraphQLSpring for GraphQL · org.springframework.graphql:spring-gra…
- CVE-2026-41699Unsafe Deserialization in Spring GraphQLSpring for GraphQL · org.springframework.graphql:spring-gra…
- CVE-2026-40999Spring WS SSRF via unvalidated WS-Addressing reply destinationsSpring Web Services · org.springframework.ws:spring-ws-core
- CVE-2026-40998Jaxp13 XPath XXE via StreamSource and SAXSourceSpring Web Services · org.springframework.ws:spring-xml
- CVE-2026-40994Wss4jSecurityInterceptor disables WS-I BSP validation by defaultSpring Web Services · org.springframework.ws:spring-ws-secu…
- CVE-2026-40987Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalizationSpring Integration · org.springframework.integration:spring…
Medium, low and unrated 80
- CVE-2026-49482ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle OverwriteMacWarrior clipbucket-v5
- CVE-2026-47238ClipBucket: IDOR in videos subtitle editorMacWarrior clipbucket-v5
- CVE-2026-12033Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process toGoogle Chrome
- CVE-2026-12032Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-12026Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-12025Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-12024Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass same origin policy Google Chrome
- CVE-2026-12017Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-12015Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obGoogle Chrome
- CVE-2026-53818OpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP LoopbackOpenClaw
- CVE-2026-53812OpenClaw < 2026.5.18 - Private-Network Navigation Bypass via Browser Act InteractionsOpenClaw
- CVE-2026-53809OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner PolicyOpenClaw
- CVE-2026-53808OpenClaw < 2026.5.6 - Approval Policy Bypass in Skill Workshop Apply FlowOpenClaw
- CVE-2026-53782Summarize < 0.17.0 SSRF via podcast:transcript URL fetchsteipete summarize · @steipete/summarize
- CVE-2026-53781Summarize < 0.17.0 Disk Exhaustion via Uncapped Media Downloadsteipete summarize · @steipete/summarize-core
- CVE-2026-45802FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of ServiceSetasign FPDI · setasign/fpdi
- CVE-2026-49949CodexBar < 0.33.0 Credential Leakage via HTTP Redirectsteipete CodexBar
- CVE-2025-30431The issue was addressed with improved checks.Apple macOS
- CVE-2025-24268A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2025-43339An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-46293This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2025-30459A privacy issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-24165A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-46313A logging issue was addressed with improved data redaction.Apple macOS
- CVE-2025-43278This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2025-46308An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS
- CVE-2026-47250mcp-server-kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltrationFlux159 mcp-server-kubernetes · mcp-server-kubernetes
- CVE-2026-52859Vim: Out-of-bounds Read in Terminal Screen Snapshotvim
- CVE-2026-47167Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regexvim
- CVE-2026-47188Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.duck-organization quest-bot
- CVE-2026-47177Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channelduck-organization quest-bot
- CVE-2026-47176Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channelduck-organization quest-bot
- CVE-2026-47175Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pingsduck-organization quest-bot
- CVE-2026-47173Quest Bot: Ticket reason allows mass-mention injectionduck-organization quest-bot
- CVE-2026-53702Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parserRed Hat Enterprise Linux
- CVE-2026-53701Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parserRed Hat Enterprise Linux
- CVE-2026-47157aiograpi: Unsafe signup challenge path handlingsubzeroid aiograpi · aiograpi
- CVE-2026-46698Fediverse Embeds: Public-nonce SSRF via ftf_get_site_info AJAX actionstefanbohacek fediverse-embeds-wordpress-plugin
- CVE-2026-11986Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloakRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +1
- CVE-2026-11945PostgreSQL Anonymizer: SQL injection in the rules import functionsDALIBO PostgreSQL Anonymizer
- CVE-2026-44490Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsaxios
- CVE-2026-44489Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fixaxios
- CVE-2024-45636IBM Security QRadar EDR Software has a vulnerability where user credentials may be stored in plain text, potentially exposing sensitive information.IBM Security QRadar EDR
- CVE-2026-3341IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal ServicesIBM Langflow Desktop
- CVE-2026-4096A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests.IBM DevOps Plan
- CVE-2026-6338HTTP request smuggling in Kong Enteprise GatewayKong Enterprise Gateway
- CVE-2026-53723guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminatorguzzle-services · guzzlehttp/guzzle-services
- CVE-2026-49214guzzlehttp/psr7 has CRLF Injection via URI Host Componentguzzle psr7 · guzzlehttp/psr7
- CVE-2026-48998guzzlehttp/psr7 has Host Confusion via Authority Reinterpretationguzzle psr7 · guzzlehttp/psr7
- CVE-2026-11956TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attributeTwiN gatus
- CVE-2023-32959WordPress MetroStore theme <= 1.3.2 - Broken Access ControlSparkle WP MetroStore
- CVE-2023-25969WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerabilityThemeHunk Contact Form & Lead Form Elementor Builder
- CVE-2026-53423Unauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_pluginmembraneframework membrane_mp4_plugin
- CVE-2022-47150WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerabilityweDevs WooCommerce Conversion Tracking
- CVE-2022-45813WordPress Advanced AJAX Product Filters plugin <= 1.6.3.3 - Broken Access Control + CSRFBeRocket Advanced AJAX Product Filters
- CVE-2026-1500Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-3553Incorrect Authorization in GitLabGitLab
- CVE-2026-6269Incorrect Authorization in GitLabGitLab
- CVE-2026-6277Incorrect Authorization in GitLabGitLab
- CVE-2026-6976Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-9204Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2026-9694Improper Neutralization of Substitution Characters in GitLabGitLab
- CVE-2026-10733Improper Restriction of Rendered UI Layers or Frames in GitLabGitLab
- CVE-2026-53912Cerebrate self-registration password hash exposure via inbox and audit log viewscerebrate
- CVE-2022-44630WordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF)YITH WooCommerce Product Slider Carousel
- CVE-2026-11850Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds readRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2022-42479WordPress Soledad premium theme <= 8.2.5 - Broken Access Control vulnerabilityTemplateHouse Soledad
- CVE-2026-53911Cerebrate primary key mass assignment in CRUD edit operations allows authenticated users to overwrite unrelated recordscerebrate
- CVE-2025-7064Freelance Security Lock – Access to Windows OSABB Freelance
- CVE-2023-40200WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerabilityEssential Plugin WP Logo Showcase Responsive Slider and Car…
- CVE-2024-32110WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityMagepeople WpEvently
- CVE-2026-41001Predictable Temp Directory in Artemis Auto-configurationSpring Boot · org.springframework.boot:spring-boot-autoconf…
- CVE-2026-41000WSS4J validation does not use configured replay cacheSpring Web Services · org.springframework.ws:spring-ws-secu…
- CVE-2026-40997SOAP security faults leak Spring Security account stateSpring Web Services · org.springframework.ws:spring-ws-secu…
- CVE-2026-40996Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by defaultSpring Web Services · org.springframework.ws:spring-ws-secu…
- CVE-2026-40995X.509 authentication bypasses Spring Security account checksSpring Web Services · org.springframework.ws:spring-ws-secu…
- CVE-2026-40992Mail Auto-Configuration Does Not Enable SSL Hostname VerificationSpring Boot · org.springframework.boot:spring-boot-starter-…
- CVE-2026-40986Spring Web Flow JS RemotingHandler renders non-HTML Response as HTMLSpring Web Flow · org.springframework.webflow:spring-webflow
- CVE-2026-40985Data Binding Vulnerability in Spring Web Flow with Unified EL ParserSpring Web Flow · org.springframework.webflow:spring-webflow
- CVE-2026-2827Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'100plugins Open User Map PRO