CVEs published June 12, 2026
280 CVEs were published on June 12, 2026: 32 critical, 114 high. 1 is now in CISA KEV.
- Published
- 280
- Critical
- 32
- High
- 114
- Medium
- 126
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 223
Most affected products
- OpenClaw
- 20
- misp
- 12
- Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- 11
- discourse
- 11
- frappe
- 11
- nezhahq nezha · github.com/nezhahq/nezha
- 11
- patriksimek vm2 · vm2
- 9
- Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- 8
- Gen Digital Avira Antivirus
- 8
- MariaDB server
- 7
Critical 32
- CVE-2026-41157GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3DImagination Technologies Graphics DDK
- CVE-2026-53519Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_keynezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-46716Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cronnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-53609Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassapostrophecms apostrophe · apostrophe
- CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`apostrophecms sanitize-html · sanitize-html
- CVE-2026-50101Naxclow IoT Platform Not using password agingNaxclow Smart Doorbell X3 · Naxclow X Smart Home +1
- CVE-2026-28742Naxclow IoT Platform Use of hard-coded cryptographic keyNaxclow Smart Doorbell X3 · Naxclow X Smart Home +1
- CVE-2026-48558SimpleHelp Authentication Bypass via Missing OIDC JWT Signature VerificationSimpleHelp
- CVE-2026-45833A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary cChromaDB
- CVE-2026-50091Aqara Home Android SDK hardcoded keyscom.lumiunited.aqarahome
- CVE-2026-50090Aqara OAuth redirect_uri validation bypassAqara Cloud OAuth Authorization Endpoint
- CVE-2026-50086Aqara unauthenticated AES oracleAqara IAM/SSO Gateway
- CVE-2026-50084Aqara API cross-account accessAqara Cloud Production API
- CVE-2026-50083Aqara hardcoded OAuth client credentialsAqara Aquara IAM/SSO Gateway
- CVE-2026-47210vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypasspatriksimek vm2 · vm2
- CVE-2026-47208vm2: Sandbox Breakout Using Promise Speciespatriksimek vm2 · vm2
- CVE-2026-47140vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code executionpatriksimek vm2 · vm2
- CVE-2026-47137vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCEpatriksimek vm2 · vm2
- CVE-2026-47131vm2: Sandbox Escapepatriksimek vm2 · vm2
- CVE-2026-10557Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded CredentialsYarbo Android/IOS mobile application · Yarbo Cloud MQTT inf…
- CVE-2026-54133jmespath.php has CompilerRuntime code injection via unescaped function namesjmespath.php · mtdowling/jmespath.php
- CVE-2026-53787Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File UploadAmasty Order Attributes for Magento
- CVE-2026-6853OTP Bypass in Başbelen Group's Pause+ Mobile AppBaşbelen Group Food Cafe Businesses Industry and Trade Ltd.…
- CVE-2026-11849IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded CredentialsIEI Integration iRM-TSi410X
- CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security ControlApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-50627Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token ValidatorApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-11535An unauthorized access vulnerability exists in the PcSuite APP.vivo PcSuite
- CVE-2026-47370A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deUbiquiti UniFi OS Server · Ubiquiti Express +29
- CVE-2026-47369A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deUbiquiti UniFi OS Server · Ubiquiti Express +29
- CVE-2026-47367A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID EnterpUbiquiti UID Enterprise Agent
- CVE-2026-47365Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass croWebPros WordPress-Toolkit
- CVE-2026-48611Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to uphpBB
High 114
- CVE-2026-12068Avira Password Manager credential disclosure via cross-origin autofill in FirefoxGen Digital Avira Password Manager
- CVE-2026-6676Avira antivirus engine heap buffer OOB write when scanning a malformed POSIX tar archiveGen Digital Avira Antivirus
- CVE-2025-14098Avira antivirus engine heap buffer OOB write when scanning a malformed MS-DOS executable fileGen Digital Avira Antivirus
- CVE-2025-9033Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 3)Gen Digital Avira Antivirus
- CVE-2025-9032Avira antivirus engine heap buffer OOB read when scanning a malformed PE fileGen Digital Avira Antivirus
- CVE-2025-7017Avira antivirus engine heap buffer OOB read when scanning a malformed Windows MSI fileGen Digital Avira Antivirus
- CVE-2025-7011Avast antivirus heap OOB when scanning a malformed zip fileGen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- CVE-2025-7009Avast antivirus heap buffer OOB read when scanning a malformed PE fileGen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- CVE-2025-7008Avast antivirus heap buffer OOB read when scanning a malformed PE fileGen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- CVE-2025-7004Avast antivirus heap buffer OOB write when scanning a malformed PE fileGen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- CVE-2025-7003Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 1)Gen Digital Avira Antivirus
- CVE-2025-7002Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 2)Gen Digital Avira Antivirus
- CVE-2026-41158GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrinkImagination Technologies Graphics DDK
- CVE-2026-53868Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and DeletionCapgo
- CVE-2026-53836OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command AliasesOpenClaw
- CVE-2026-53834OpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash CommandsOpenClaw
- CVE-2026-53833QQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming CommandOpenClaw
- CVE-2026-53832OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy ConfigurationOpenClaw
- CVE-2026-53831OpenClaw < 2026.5.18 - Arbitrary File Read via Shell Expansion in system.run Safe-bin AllowlistOpenClaw
- CVE-2026-53829OpenClaw < 2026.5.18 - Command Truncation in Exec Approval DisplayOpenClaw
- CVE-2026-53828OpenClaw < 2026.5.6 - Native Command Authorization Bypass via Owner-Command EnforcementOpenClaw
- CVE-2026-53825OpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write ScopeOpenClaw
- CVE-2026-53823OpenClaw < 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFromOpenClaw
- CVE-2026-53822OpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and ExecutionOpenClaw
- CVE-2026-53821OpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocketOpenClaw
- CVE-2026-34195GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexesImagination Technologies Graphics DDK
- CVE-2026-49396Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agentsnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-48119Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' servicesnezhahq nezha · github.com/nezhahq/nezha +1
- CVE-2026-47120Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)nezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-46717Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notificationnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-53608@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag@apostrophecms/seo
- CVE-2026-4870Qiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions.IBM Qiskit SDK
- CVE-2026-45013Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validationapostrophecms apostrophe · apostrophe
- CVE-2026-45012Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widgetapostrophecms apostrophe · apostrophe
- CVE-2026-45011Apostrophe has stored XSS via javascript: URL in Image Widget Linkapostrophecms apostrophe · apostrophe
- CVE-2026-44786Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible usersdiscourse
- CVE-2026-54057Kitty vulnerable to command injection via unsanitized OSC 21 query replykovidgoyal kitty
- CVE-2026-54056Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop stagingkovidgoyal kitty
- CVE-2026-42851@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCEkovidgoyal kitty
- CVE-2026-54361MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation recordsmisp
- CVE-2026-42850Kitty has a shell command injectionkovidgoyal kitty
- CVE-2026-54360MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groupsmisp
- CVE-2026-54359MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by defaultmisp
- CVE-2026-54358MISP organization administrators can target site administrator accounts for password resetmisp
- CVE-2026-47260Koel Vulnerable to SSRF via Podcast Episode Enclosure URLskoel · phanan/koel
- CVE-2026-50287Missing Authentication for Critical Function in @agenticmail/mcpagenticmail · @agenticmail/mcp
- CVE-2026-12043Heap double-free in AWS Common Runtime aws-c-httpaws-c-http
- CVE-2026-47138Parse Server: Pre-authentication denial of service via client version header regex backtrackingparse-community parse-server · parse-server
- CVE-2026-42947Naxclow IoT Platform Authorization bypass through User-Controlled keyNaxclow Smart Doorbell X3 · Naxclow X Smart Home +1
- CVE-2026-50108Naxclow IoT Platform Missing AuthorizationNaxclow Smart Doorbell X3 · Naxclow X Smart Home +1
- CVE-2026-42306Moby: Race condition in docker cp allows bind mount redirection to host pathmoby · github.com/docker/docker +2
- CVE-2026-12143form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)form-data
- CVE-2026-53408Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may alloZoom Communications Zoom Workplace
- CVE-2026-53407Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may alloZoom Communications Zoom Workplace
- CVE-2026-53406Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an autheZoom Communications Remote Control for Zoom Contact Center
- CVE-2026-48165MariaDB: unsafe usage of `wsrep_sst_receive_address` values on the joiner sideMariaDB server
- CVE-2026-48163MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)MariaDB server
- CVE-2026-44168MariaDB: wsrep SST unsafe parameter handling on the donor sideMariaDB server
- CVE-2026-47216Typesense: Unauthenticated Denial of Service in the Typesense /multi_search Endpointtypesense
- CVE-2026-47965Acrobat Reader | Out-of-bounds Write (CWE-787)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-53982Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier AssociationCap-go capgo
- CVE-2026-6961CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation syncMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-7387Mattermost group syncable endpoints allow privilege escalation via scheme_adminMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-3840Path Traversal in kedro-org/kedrokedro-org/kedro
- CVE-2026-53981Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change MechanismCap-go
- CVE-2026-45832All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing atChromaDB
- CVE-2026-45831The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a useChromaDB
- CVE-2026-50088Aqara Developer Portal cross-origin resource sharingAqara Developer Portal · Aqara Developer Test Portal
- CVE-2026-50087Aqara IAM/SSO Gateway cross-origin resource sharingAqara IAM/SSO Gateway
- CVE-2026-50085Aqara Board IoT insecure debug APIAqara Board service
- CVE-2026-50011Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthnetty · io.netty:netty-codec-redis
- CVE-2026-50010Netty's wrapping plain trust manager silently disables hostname verificationnetty · io.netty:netty-handler
- CVE-2026-8828A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily readChromaDB
- CVE-2026-45830A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily rChromaDB
- CVE-2026-48748Netty HTTP/3 QPACK Blocked Streams Memory Exhaustionnetty · io.netty:netty-codec-http3
- CVE-2026-48059Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustionnetty · io.netty:netty-codec-haproxy
- CVE-2026-9638Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for saltsARODLAND Crypt::PBKDF2
- CVE-2026-48006Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatornetty · io.netty:netty-codec-redis
- CVE-2026-47691Netty has Insufficient Bailiwick Validation for NS Recordsnetty · io.netty:netty-resolver-dns
- CVE-2026-40677The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leadAMD Management Console · AMD Ryzen™ Master +1
- CVE-2026-46340Netty: SCTP reassembly nests buffers without boundnetty · io.netty:netty-transport-sctp
- CVE-2026-45674Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Recordsnetty · io.netty:netty-resolver-dns
- CVE-2026-47139vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_serverpatriksimek vm2 · vm2
- CVE-2026-47135vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checkspatriksimek vm2 · vm2
- CVE-2026-47209vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chainpatriksimek vm2 · vm2
- CVE-2026-6211Arbitrary File Upload in Global IT's WEOLLGlobal IT Informatics Services WEOLL
- CVE-2026-45416Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesnetty · io.netty:netty-handler
- CVE-2026-44894Netty's Default QUIC token handler accepts any client-supplied tokennetty · io.netty:netty-codec-classes-quic
- CVE-2026-7368Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing AuthorizationYarbo Android/IOS mobile application · Yarbo Cloud MQTT inf…
- CVE-2026-44893Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthnetty · io.netty:netty-codec-haproxy
- CVE-2026-53721Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matchernuxt
- CVE-2026-11967Arbitrary code execution in MobaXterm Personal Edition (Portable)Mobatek MobaXterm Personal Edition
- CVE-2026-11879Arbitrary code execution in MobaXterm Personal Edition (Portable)Mobatek MobaXterm Personal Edition
- CVE-2026-47197Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commandsduck-organization questbot
- CVE-2026-47195Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.duck-organization questbot
- CVE-2026-47196Quest Bot: Empty automod rule causes every guild message to be deletedduck-organization questbot
- CVE-2026-9266A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and contrMoxa UC-1200A Series
- CVE-2026-11848IEI Integration Corp｜ iRM-IEI Remote Management - Missing AuthenticationIEI Integration iRM-TSi410X
- CVE-2026-11846IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File DeletionIEI Integration iVEC TANK-XM811
- CVE-2026-11845IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command InjectionIEI Integration iVEC TANK-XM811
- CVE-2026-50645Apache CXF: No restriction on attachment headers per messageApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-50633Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImplApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-50632Apache CXF: JNDI Injection Vulnerability in JMSConfigFactoryApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-50631Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token ProcessingApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-12059Cellopoint｜CelloOS - Improper Access ControlCellopoint CelloOS
- CVE-2026-44892Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Sizenetty · io.netty:netty-codec-http3
- CVE-2026-45169Idira Privileged Access Manager (PAM) Self-Hosted Vault: Denial of Service due to Unexpected Input ProcessingCyberArk Software, a Palo Alto Networks Company PAM SH Vault
- CVE-2026-48613SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, phpBB
- CVE-2026-47368A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtaiUbiquiti UniFi OS Server · Ubiquiti Express +29
- CVE-2026-48612Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s aphpBB
- CVE-2026-48610Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found Ubiquiti UDM · Ubiquiti UDM-Pro +13
- CVE-2026-47366Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticatphpBB
- CVE-2026-11933Post-authentication use-after-free in server-side JavaScript BSON-to-array conversionMongoDB
- CVE-2026-45170Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate ValidationCyberArk Software, a Palo Alto Networks Company Vendor PAM
Medium, low and unrated 134
- CVE-2026-11443Allegra downloadAttachment Cross-Site Scripting Authentication Bypass VulnerabilityAllegra
- CVE-2026-11442Allegra exportReport Directory Traversal Information Disclosure VulnerabilityAllegra
- CVE-2025-7019Avast antivirus stack overflow when scanning a malformed Office Open XML fileGen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- CVE-2025-7018Avira antivirus engine null pointer dereference when scanning a malformed PE fileGen Digital Avira Antivirus
- CVE-2025-7010Avast antivirus stack overflow when scanning a malformed PDF fileGen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- CVE-2025-7006Avast antivirus use of stack memory after free when scanning a malformed PE fileGen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- CVE-2025-7005Avast antivirus infinite recursion when scanning a malformed PE fileGen Digital Avast Antivirus · Gen Digital AVG Antivirus +3
- CVE-2026-53867Capgo < 12.128.2 - Orphaned File Retention via Profile Image ReplacementCapgo
- CVE-2026-53839OpenClaw < 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint ValidationOpenClaw
- CVE-2026-53838OpenClaw < 2026.5.27 - Node Pairing State Mutation via ReconnectionOpenClaw
- CVE-2026-53837OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event HandlersOpenClaw
- CVE-2026-53835OpenClaw < 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent BindingsOpenClaw
- CVE-2026-53830OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reloadOpenClaw
- CVE-2026-53827OpenClaw < 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action ForwardingOpenClaw
- CVE-2026-53826OpenClaw < 2026.4.26 - Information Disclosure via Sandboxed Session SpawnOpenClaw
- CVE-2026-53824Mattermost plugin for OpenClaw < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh DelayOpenClaw
- CVE-2026-53820OpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session SpawnOpenClaw
- CVE-2026-41155GPU DDK - SharedSecMem mapped into all GPU virtual address spacesImagination Technologies Graphics DDK
- CVE-2026-12131CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injectionCodeAstro Human Resource Management System
- CVE-2026-54398MISP object edit authorization bypass allows unauthorized sharing group assignmentmisp
- CVE-2026-53523Nezha Monitoring: OAuth2 Redirect URL — Host Header Injectionnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-53522Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoSnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-53521Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile contextnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-53520Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routingnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-49397Nezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing datanezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-47124Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated membersnezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-47268Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard hostnezhahq nezha · github.com/naiba/nezha +1
- CVE-2026-54397MISP event editing allows unauthorized assignment to undisclosed sharing groupsmisp
- CVE-2026-53607@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host headerapostrophecms apostrophe · apostrophe
- CVE-2026-53606sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributesapostrophecms sanitize-html · sanitize-html
- CVE-2026-45014Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltipapostrophecms apostrophe
- CVE-2026-54396MISP AuthKey edit endpoint allows authenticated user email enumerationmisp
- CVE-2026-24618WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerabilityHashThemes Hash Elements
- CVE-2026-12130CodeAstro Human Resource Management System Projects Management Add_Projects cross site scriptingCodeAstro Human Resource Management System
- CVE-2026-42853@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input@apostrophecms/cli
- CVE-2026-54395MISP UiBeta event index reflected XSS in advanced filter popupmisp
- CVE-2026-54394MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG filesmisp
- CVE-2026-12129CodeAstro Human Resource Management System Dashboard add_tod cross site scriptingCodeAstro Human Resource Management System
- CVE-2026-47264Discourse: Don't leak restricted tag group names via tag infodiscourse
- CVE-2026-47263Discourse: Prevent webhook payload disclosure on event redeliverydiscourse
- CVE-2026-45775Discourse: Cross-site backup access via path traversal in multisite local backupsdiscourse
- CVE-2026-45085Discourse: Chat misauthorization and information disclosurediscourse
- CVE-2026-44785Discourse: Hidden reply-to post raw can be disclosed through AI explain promptsdiscourse
- CVE-2026-44784Discourse: Non-staff group owners can see email password in plaintext through group historydiscourse
- CVE-2026-44783Discourse: Replying to a whisper lets non-whisperers create staff-only whisper postsdiscourse
- CVE-2026-44782Discourse: GroupPostSerializer leaks hidden full names through reaction post associationdiscourse
- CVE-2026-44780Discourse: Category queue reviewers can read raw incoming emails from queued postsdiscourse
- CVE-2026-44779Discourse: Bot debug endpoints disclose whisper translation audit logsdiscourse
- CVE-2026-54393MISP Overmind theme stored XSS via unvalidated homepage settingmisp
- CVE-2026-54362MISP template builder exposes non-visible custom galaxies across organisationsmisp
- CVE-2026-54055Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocolkovidgoyal kitty
- CVE-2026-54357MISP improper authorization allows organization administrators to modify site administrator user settingsmisp
- CVE-2026-43872actual-server has a path traversal vulnerabilityactualbudget actual
- CVE-2026-42890actual Allows Electron to Run As Nodeactualbudget actual · actual
- CVE-2026-50552Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bailkoel · phanan/koel
- CVE-2026-42604Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config`actualbudget actual
- CVE-2026-53726Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACLparse-community parse-server · parse-server
- CVE-2026-53725Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is deniedparse-community parse-server · parse-server
- CVE-2026-53724Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklistparse-community parse-server · parse-server
- CVE-2026-50099Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directoryNaxclow Smart Doorbell X3 · Naxclow X Smart Home +1
- CVE-2026-50008Parse Server: Server option routeAllowList is bypassable through batch sub-requestsparse-community parse-server · parse-server
- CVE-2026-10715Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpointCamaleon CMS
- CVE-2026-47248Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callersparse-community parse-server · parse-server
- CVE-2026-50244Naxclow IoT Platform Missing AuthorizationNaxclow Smart Doorbell X3 · Naxclow X Smart Home +1
- CVE-2026-42932Naxclow IoT Platform Generation of Predictable Numbers or IdentifiersNaxclow Smart Doorbell X3 · Naxclow X Smart Home +1
- CVE-2026-47236Solidtime team page exposes pending invitation and member emails to employees who lack invitations:view/members:view permissionsolidtime-io solidtime
- CVE-2026-41568Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapmoby · github.com/docker/docker +2
- CVE-2026-44173MariaDB: FILE privilege was not checked for subqueries in the FROM clauseMariaDB server
- CVE-2026-44172MariaDB: mysql_real_escape_string() incorrectly handled big5MariaDB server · mariadb
- CVE-2026-44171MariaDB: path traversal in mbstreamMariaDB server
- CVE-2026-44169MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitionsMariaDB server
- CVE-2026-44170MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URLMariaDB server
- CVE-2026-47225Improper Search Cache Isolation for Scoped Search API Keys in Typesensetypesense
- CVE-2026-47223NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflowM2Team NanaZip
- CVE-2026-47224NanaZip: Heap buffer-overflow read in NanaZip LVM metadata CRC checkM2Team NanaZip
- CVE-2026-47222NanaZip: Heap out-of-bounds read in NanaZip AVB property descriptor parser via unsigned integer underflowM2Team NanaZip
- CVE-2026-6046Plugin bot username conflict allows user account to be used as bot identity in Mattermost ServerMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-6689*Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*Mattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-7184Mattermost Remote Cluster PATCH API Leaks Authentication TokensMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-6739Mattermost: Delegated admins could patch protected default system rolesMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-3433Mattermost fails to scope role_updated websocket events to authorized team and channel membersMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-50089Aqara IAM/SSO Gateway open redirectAqara IAM/SSO Gateway
- CVE-2026-50082Aqara Developer Portal insecure authentication tokenAqara Cloud Developer Portal
- CVE-2026-50560Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signaturenetty · io.netty:netty-codec-http2
- CVE-2026-9641Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterationsARODLAND Crypt::PBKDF2
- CVE-2026-46690unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX racespearman unbounded-spsc · unbounded-spsc
- CVE-2026-50020Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permittednetty · io.netty:netty-codec-http
- CVE-2026-44967opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP responseopen-telemetry opentelemetry-cpp
- CVE-2026-47190IPAM controller service account granted unnecessary full access to Secretsmetal3-io ip-address-manager · github.com/metal3-io/ip-addr…
- CVE-2026-50009Netty QUIC stateless reset token material exposed through header-visible connection IDsnetty · io.netty:netty-codec-classes-quic
- CVE-2026-53568Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'frappe
- CVE-2026-50026Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpointsfrappe
- CVE-2026-47182Frappe: Broken Access Control on Private Filesfrappe
- CVE-2026-48043netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustionnetty · io.netty:netty-codec-http2
- CVE-2026-44976Frappe: IDOR in update_onboarding_stepfrappe
- CVE-2026-44975Frappe: Missing authorization on reset form toursfrappe
- CVE-2026-44206Frappe: DB Schema Enumeration via Frappe-Authorization-Sourcefrappe
- CVE-2026-44207Frappe: Insecure Direct Object Reference for email accountsfrappe
- CVE-2026-5792Authentication Bypass in Hedef Media's Related Marketing Cloud (RMC)Hedef Media Promotion Interactive Media Marketing Related M…
- CVE-2026-44208Frappe: IDOR in `submit_discussion()`frappe
- CVE-2026-47244Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforcednetty · io.netty:netty-codec-http2
- CVE-2026-44205Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Uploadfrappe
- CVE-2026-41581Frappe Vulnerable to Possible SQL Injection via get_blog_listfrappe
- CVE-2026-47739Frappe: Stored XSS in Notefrappe
- CVE-2026-47141vm2: NodeVM observability builtins leak host process and HTTP request datapatriksimek vm2 · vm2
- CVE-2026-45673Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Portnetty · io.netty:netty-resolver-dns
- CVE-2026-45536Netty: Unix-socket fd receive leaks descriptors when peer sends two at oncenetty · io.netty:netty-transport-native-epoll +1
- CVE-2026-8694Improper access control on the API documentation endpoint in PowerShell UniversalDevolutions PowerShell Universal
- CVE-2026-53722Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLnuxt
- CVE-2026-1836Stored credentials in RedmineRedmine
- CVE-2017-20240Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacksARODLAND Crypt::PBKDF2
- CVE-2026-12066PbootCMS Password MemberController.php retrieve password recoveryPbootCMS
- CVE-2026-47200Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`nuxt · @nuxt/nitro-server
- CVE-2026-49993@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)nuxt · @nuxt/webpack-builder +1
- CVE-2026-45669Nuxt: Reflected XSS in `navigateTo()` external redirectnuxt
- CVE-2026-45670Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)nuxt · @nuxt/rspack-builder +1
- CVE-2026-46342Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoningnuxt · @nuxt/nitro-server
- CVE-2026-12065Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url schemeGroww Stock, Mutual Fund, Gold App
- CVE-2026-49347Quest Bot: Ticket creation has no per-user open-ticket limit or cooldownduck-organization questbot
- CVE-2026-48485Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.duck-organization questbot
- CVE-2026-48914Qemu-kvm: heap buffer overflow in virtio-blk scsi request handlingqemu · Red Hat Enterprise Linux +1
- CVE-2026-11847Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File DeletionIEI Integration iVEC TANK-XM811
- CVE-2026-11844IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File ReadIEI Integration iVEC TANK-XM811
- CVE-2026-50634Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entryApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-50630Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm InjectionApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-50629Apache CXF: OAuth2: Log Injection via Unsanitized Client IdentifierApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-49875Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtilsApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-50623Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionServiceApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2026-12058The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed.vivo PcSuite
- CVE-2026-12060Hepta Platforms｜Heptabase - Exposed DangerousHepta Platforms Heptabase
- CVE-2026-9271KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSSKeepInMind Dashboard Notes
- CVE-2026-9269Secure Copy Content Protection and Content Locking < 5.1.5 - Admin+ Stored XSS via ays_sccp_sub_icon_image ParameterSecure Copy Content Protection and Content Locking
- CVE-2026-20746PingDirectory copying of virtual attributes leads to memory exhaustionPing Identity PingDirectory
- CVE-2026-9125The Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute2winfactor Presto Player