# CVEs published 2026-06-12

280 CVEs were published on June 12, 2026: 32 critical, 114 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-11443](https://cve.now/CVE-2026-11443.md): Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability (CVSS 4.6, Allegra)
- [CVE-2026-11442](https://cve.now/CVE-2026-11442.md): Allegra exportReport Directory Traversal Information Disclosure Vulnerability (CVSS 6.5, Allegra)
- [CVE-2026-12068](https://cve.now/CVE-2026-12068.md): Avira Password Manager credential disclosure via cross-origin autofill in Firefox (CVSS 7.4, Gen Digital Avira Password Manager)
- [CVE-2026-6676](https://cve.now/CVE-2026-6676.md): Avira antivirus engine heap buffer OOB write when scanning a malformed POSIX tar archive (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-14098](https://cve.now/CVE-2025-14098.md): Avira antivirus engine heap buffer OOB write when scanning a malformed MS-DOS executable file (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-9033](https://cve.now/CVE-2025-9033.md): Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 3) (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-9032](https://cve.now/CVE-2025-9032.md): Avira antivirus engine heap buffer OOB read when scanning a malformed PE file (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-7019](https://cve.now/CVE-2025-7019.md): Avast antivirus stack overflow when scanning a malformed Office Open XML file (CVSS 5.5, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7018](https://cve.now/CVE-2025-7018.md): Avira antivirus engine null pointer dereference when scanning a malformed PE file (CVSS 5.5, Gen Digital Avira Antivirus)
- [CVE-2025-7017](https://cve.now/CVE-2025-7017.md): Avira antivirus engine heap buffer OOB read when scanning a malformed Windows MSI file (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-7011](https://cve.now/CVE-2025-7011.md): Avast antivirus heap OOB when scanning a malformed zip file (CVSS 7.8, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7010](https://cve.now/CVE-2025-7010.md): Avast antivirus stack overflow when scanning a malformed PDF file (CVSS 5.5, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7009](https://cve.now/CVE-2025-7009.md): Avast antivirus heap buffer OOB read when scanning a malformed PE file (CVSS 7.8, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7008](https://cve.now/CVE-2025-7008.md): Avast antivirus heap buffer OOB read when scanning a malformed PE file (CVSS 7.8, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7006](https://cve.now/CVE-2025-7006.md): Avast antivirus use of stack memory after free when scanning a malformed PE file (CVSS 5.5, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7005](https://cve.now/CVE-2025-7005.md): Avast antivirus infinite recursion when scanning a malformed PE file (CVSS 5.5, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7004](https://cve.now/CVE-2025-7004.md): Avast antivirus heap buffer OOB write when scanning a malformed PE file (CVSS 7.8, Gen Digital Avast Antivirus · Gen Digital AVG Antivirus +3)
- [CVE-2025-7003](https://cve.now/CVE-2025-7003.md): Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 1) (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2025-7002](https://cve.now/CVE-2025-7002.md): Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 2) (CVSS 7.8, Gen Digital Avira Antivirus)
- [CVE-2026-41158](https://cve.now/CVE-2026-41158.md): GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-53868](https://cve.now/CVE-2026-53868.md): Capgo \< 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion (CVSS 8.7, Capgo)
- [CVE-2026-53867](https://cve.now/CVE-2026-53867.md): Capgo \< 12.128.2 - Orphaned File Retention via Profile Image Replacement (CVSS 5.3, Capgo)
- [CVE-2026-53839](https://cve.now/CVE-2026-53839.md): OpenClaw \< 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validation (CVSS 6.0, OpenClaw)
- [CVE-2026-53838](https://cve.now/CVE-2026-53838.md): OpenClaw \< 2026.5.27 - Node Pairing State Mutation via Reconnection (CVSS 6.0, OpenClaw)
- [CVE-2026-53837](https://cve.now/CVE-2026-53837.md): OpenClaw \< 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers (CVSS 6.3, OpenClaw)
- [CVE-2026-53836](https://cve.now/CVE-2026-53836.md): OpenClaw \< 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases (CVSS 8.7, OpenClaw)
- [CVE-2026-53835](https://cve.now/CVE-2026-53835.md): OpenClaw \< 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent Bindings (CVSS 2.3, OpenClaw)
- [CVE-2026-53834](https://cve.now/CVE-2026-53834.md): OpenClaw \< 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commands (CVSS 8.2, OpenClaw)
- [CVE-2026-53833](https://cve.now/CVE-2026-53833.md): QQBot for OpenClaw \< 2026.4.29 - Authorization Bypass via QQBot Streaming Command (CVSS 7.4, OpenClaw)
- [CVE-2026-53832](https://cve.now/CVE-2026-53832.md): OpenClaw \< 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration (CVSS 7.4, OpenClaw)
- [CVE-2026-53831](https://cve.now/CVE-2026-53831.md): OpenClaw \< 2026.5.18 - Arbitrary File Read via Shell Expansion in system.run Safe-bin Allowlist (CVSS 7.6, OpenClaw)
- [CVE-2026-53830](https://cve.now/CVE-2026-53830.md): OpenClaw \< 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reload (CVSS 6.0, OpenClaw)
- [CVE-2026-53829](https://cve.now/CVE-2026-53829.md): OpenClaw \< 2026.5.18 - Command Truncation in Exec Approval Display (CVSS 8.5, OpenClaw)
- [CVE-2026-53828](https://cve.now/CVE-2026-53828.md): OpenClaw \< 2026.5.6 - Native Command Authorization Bypass via Owner-Command Enforcement (CVSS 7.7, OpenClaw)
- [CVE-2026-53827](https://cve.now/CVE-2026-53827.md): OpenClaw \< 2026.5.2 - Credential Exposure via Model-Supplied Loopback URLs in message.action Forwarding (CVSS 6.0, OpenClaw)
- [CVE-2026-53826](https://cve.now/CVE-2026-53826.md): OpenClaw \< 2026.4.26 - Information Disclosure via Sandboxed Session Spawn (CVSS 2.3, OpenClaw)
- [CVE-2026-53825](https://cve.now/CVE-2026-53825.md): OpenClaw \< 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scope (CVSS 7.1, OpenClaw)
- [CVE-2026-53824](https://cve.now/CVE-2026-53824.md): Mattermost plugin for OpenClaw \< 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delay (CVSS 6.0, OpenClaw)
- [CVE-2026-53823](https://cve.now/CVE-2026-53823.md): OpenClaw \< 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFrom (CVSS 8.6, OpenClaw)
- [CVE-2026-53822](https://cve.now/CVE-2026-53822.md): OpenClaw \< 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution (CVSS 8.7, OpenClaw)
- [CVE-2026-53821](https://cve.now/CVE-2026-53821.md): OpenClaw \< 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocket (CVSS 8.7, OpenClaw)
- [CVE-2026-53820](https://cve.now/CVE-2026-53820.md): OpenClaw \< 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session Spawn (CVSS 6.9, OpenClaw)
- [CVE-2026-41157](https://cve.now/CVE-2026-41157.md): GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D (CVSS 9.8, Imagination Technologies Graphics DDK)
- [CVE-2026-41155](https://cve.now/CVE-2026-41155.md): GPU DDK - SharedSecMem mapped into all GPU virtual address spaces (CVSS 5.5, Imagination Technologies Graphics DDK)
- [CVE-2026-34195](https://cve.now/CVE-2026-34195.md): GPU DDK - Kernel heap OOB write in PMRChangeSparseMemOSMem due to incorrect physical page translation from virtual page indexes (CVSS 8.8, Imagination Technologies Graphics DDK)
- [CVE-2026-12131](https://cve.now/CVE-2026-12131.md): CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection (CVSS 5.3, CodeAstro Human Resource Management System)
- [CVE-2026-54398](https://cve.now/CVE-2026-54398.md): MISP object edit authorization bypass allows unauthorized sharing group assignment (CVSS 5.3, misp)
- [CVE-2026-53523](https://cve.now/CVE-2026-53523.md): Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection (CVSS 6.8, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53522](https://cve.now/CVE-2026-53522.md): Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS (CVSS 6.5, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53521](https://cve.now/CVE-2026-53521.md): Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context (CVSS 6.4, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53520](https://cve.now/CVE-2026-53520.md): Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing (CVSS 6.5, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53519](https://cve.now/CVE-2026-53519.md): Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt\_secret\_key (CVSS 9.1, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-49397](https://cve.now/CVE-2026-49397.md): Nezha Monitoring: Private services (\`EnableShowInService: false\`) are enumerable via per-server endpoints, leaking name and timing data (CVSS 5.3, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-49396](https://cve.now/CVE-2026-49396.md): Nezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents (CVSS 7.1, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-48119](https://cve.now/CVE-2026-48119.md): Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services (CVSS 7.1, nezhahq nezha · github.com/nezhahq/nezha +1)
- [CVE-2026-47124](https://cve.now/CVE-2026-47124.md): Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members (CVSS 6.5, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-47120](https://cve.now/CVE-2026-47120.md): Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) (CVSS 7.1, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-46717](https://cve.now/CVE-2026-46717.md): Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification (CVSS 7.7, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-46716](https://cve.now/CVE-2026-46716.md): Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron (CVSS 9.9, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-53609](https://cve.now/CVE-2026-53609.md): Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass (CVSS 9.1, apostrophecms apostrophe · apostrophe)
- [CVE-2026-53608](https://cve.now/CVE-2026-53608.md): @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag (CVSS 8.7, @apostrophecms/seo)
- [CVE-2026-47268](https://cve.now/CVE-2026-47268.md): Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host (CVSS 6.4, nezhahq nezha · github.com/naiba/nezha +1)
- [CVE-2026-54397](https://cve.now/CVE-2026-54397.md): MISP event editing allows unauthorized assignment to undisclosed sharing groups (CVSS 6.1, misp)
- [CVE-2026-53607](https://cve.now/CVE-2026-53607.md): @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header (CVSS 3.7, apostrophecms apostrophe · apostrophe)
- [CVE-2026-4870](https://cve.now/CVE-2026-4870.md): Qiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions. (CVSS 7.5, IBM Qiskit SDK)
- [CVE-2026-53606](https://cve.now/CVE-2026-53606.md): sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes (CVSS 5.4, apostrophecms sanitize-html · sanitize-html)
- [CVE-2026-45014](https://cve.now/CVE-2026-45014.md): Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip (CVSS 5.3, apostrophecms apostrophe)
- [CVE-2026-54396](https://cve.now/CVE-2026-54396.md): MISP AuthKey edit endpoint allows authenticated user email enumeration (CVSS 5.3, misp)
- [CVE-2026-45013](https://cve.now/CVE-2026-45013.md): Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation (CVSS 8.1, apostrophecms apostrophe · apostrophe)
- [CVE-2026-24618](https://cve.now/CVE-2026-24618.md): WordPress Hash Elements plugin \<= 1.5.4 - Sensitive Data Exposure vulnerability (CVSS 4.3, HashThemes Hash Elements)
- [CVE-2026-12130](https://cve.now/CVE-2026-12130.md): CodeAstro Human Resource Management System Projects Management Add\_Projects cross site scripting (CVSS 5.1, CodeAstro Human Resource Management System)
- [CVE-2026-45012](https://cve.now/CVE-2026-45012.md): Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget (CVSS 7.6, apostrophecms apostrophe · apostrophe)
- [CVE-2026-45011](https://cve.now/CVE-2026-45011.md): Apostrophe has stored XSS via javascript: URL in Image Widget Link (CVSS 7.3, apostrophecms apostrophe · apostrophe)
- [CVE-2026-44990](https://cve.now/CVE-2026-44990.md): Apostrophe has default XSS via \`xmp\` raw-text passthrough in \`sanitize-html\` (CVSS 9.3, apostrophecms sanitize-html · sanitize-html)
- [CVE-2026-42853](https://cve.now/CVE-2026-42853.md): @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input (CVSS 6.5, @apostrophecms/cli)
- [CVE-2026-54395](https://cve.now/CVE-2026-54395.md): MISP UiBeta event index reflected XSS in advanced filter popup (CVSS 5.3, misp)
- [CVE-2026-54394](https://cve.now/CVE-2026-54394.md): MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files (CVSS 5.3, misp)
- [CVE-2026-12129](https://cve.now/CVE-2026-12129.md): CodeAstro Human Resource Management System Dashboard add\_tod cross site scripting (CVSS 5.1, CodeAstro Human Resource Management System)
- [CVE-2026-47264](https://cve.now/CVE-2026-47264.md): Discourse: Don't leak restricted tag group names via tag info (CVSS 5.3, discourse)
- [CVE-2026-47263](https://cve.now/CVE-2026-47263.md): Discourse: Prevent webhook payload disclosure on event redelivery (CVSS 4.3, discourse)
- [CVE-2026-45775](https://cve.now/CVE-2026-45775.md): Discourse: Cross-site backup access via path traversal in multisite local backups (CVSS 6.8, discourse)
- [CVE-2026-45085](https://cve.now/CVE-2026-45085.md): Discourse: Chat misauthorization and information disclosure (CVSS 5.3, discourse)
- [CVE-2026-44785](https://cve.now/CVE-2026-44785.md): Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts (CVSS 4.3, discourse)
- [CVE-2026-44784](https://cve.now/CVE-2026-44784.md): Discourse: Non-staff group owners can see email password in plaintext through group history (CVSS 6.5, discourse)
- [CVE-2026-44783](https://cve.now/CVE-2026-44783.md): Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts (CVSS 5.4, discourse)
- [CVE-2026-44782](https://cve.now/CVE-2026-44782.md): Discourse: GroupPostSerializer leaks hidden full names through reaction post association (CVSS 4.3, discourse)
- [CVE-2026-44780](https://cve.now/CVE-2026-44780.md): Discourse: Category queue reviewers can read raw incoming emails from queued posts (CVSS 4.3, discourse)
- [CVE-2026-44779](https://cve.now/CVE-2026-44779.md): Discourse: Bot debug endpoints disclose whisper translation audit logs (CVSS 4.3, discourse)
- [CVE-2026-44786](https://cve.now/CVE-2026-44786.md): Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users (CVSS 7.5, discourse)
- [CVE-2026-54393](https://cve.now/CVE-2026-54393.md): MISP Overmind theme stored XSS via unvalidated homepage setting (CVSS 5.1, misp)
- [CVE-2026-54362](https://cve.now/CVE-2026-54362.md): MISP template builder exposes non-visible custom galaxies across organisations (CVSS 5.3, misp)
- [CVE-2026-54057](https://cve.now/CVE-2026-54057.md): Kitty vulnerable to command injection via unsanitized OSC 21 query reply (CVSS 7.3, kovidgoyal kitty)
- [CVE-2026-54056](https://cve.now/CVE-2026-54056.md): Kitty has an arbitrary file overwrite via symlink following in \`kitten dnd\` remote drop staging (CVSS 7.6, kovidgoyal kitty)
- [CVE-2026-54055](https://cve.now/CVE-2026-54055.md): Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol (CVSS 5.0, kovidgoyal kitty)
- [CVE-2026-42851](https://cve.now/CVE-2026-42851.md): @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE (CVSS 7.8, kovidgoyal kitty)
- [CVE-2026-54361](https://cve.now/CVE-2026-54361.md): MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records (CVSS 8.8, misp)
- [CVE-2026-42850](https://cve.now/CVE-2026-42850.md): Kitty has a shell command injection (CVSS 7.4, kovidgoyal kitty)
- [CVE-2026-54360](https://cve.now/CVE-2026-54360.md): MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups (CVSS 8.4, misp)
- [CVE-2026-54359](https://cve.now/CVE-2026-54359.md): MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default (CVSS 7.1, misp)
- [CVE-2026-54358](https://cve.now/CVE-2026-54358.md): MISP organization administrators can target site administrator accounts for password reset (CVSS 7.5, misp)
- [CVE-2026-54357](https://cve.now/CVE-2026-54357.md): MISP improper authorization allows organization administrators to modify site administrator user settings (CVSS 5.1, misp)
- [CVE-2026-43872](https://cve.now/CVE-2026-43872.md): actual-server has a path traversal vulnerability (CVSS 5.3, actualbudget actual)
- [CVE-2026-42890](https://cve.now/CVE-2026-42890.md): actual Allows Electron to Run As Node (CVSS 4.8, actualbudget actual · actual)
- [CVE-2026-50552](https://cve.now/CVE-2026-50552.md): Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail (CVSS 6.3, koel · phanan/koel)
- [CVE-2026-47260](https://cve.now/CVE-2026-47260.md): Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs (CVSS 7.7, koel · phanan/koel)
- [CVE-2026-50287](https://cve.now/CVE-2026-50287.md): Missing Authentication for Critical Function in @agenticmail/mcp (CVSS 8.7, agenticmail · @agenticmail/mcp)
- [CVE-2026-42604](https://cve.now/CVE-2026-42604.md): Actual has an OpenID \`client\_secret\` Disclosure via Broken Authorization Guard in \`/openid/config\` (CVSS 6.9, actualbudget actual)
- [CVE-2026-53726](https://cve.now/CVE-2026-53726.md): Parse Server: Relation \`$relatedTo\` query bypasses \`protectedFields\` and owning-object ACL (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-12043](https://cve.now/CVE-2026-12043.md): Heap double-free in AWS Common Runtime aws-c-http (CVSS 8.8, aws-c-http)
- [CVE-2026-53725](https://cve.now/CVE-2026-53725.md): Parse Server: Endpoints \`/login\` and \`/verifyPassword\` disclose MFA secrets and protected fields when \`\_User\` get is denied (CVSS 5.9, parse-community parse-server · parse-server)
- [CVE-2026-53724](https://cve.now/CVE-2026-53724.md): Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist (CVSS 2.1, parse-community parse-server · parse-server)
- [CVE-2026-50099](https://cve.now/CVE-2026-50099.md): Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory (CVSS 5.1, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-50008](https://cve.now/CVE-2026-50008.md): Parse Server: Server option routeAllowList is bypassable through batch sub-requests (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-10715](https://cve.now/CVE-2026-10715.md): Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint (CVSS 5.1, Camaleon CMS)
- [CVE-2026-47138](https://cve.now/CVE-2026-47138.md): Parse Server: Pre-authentication denial of service via client version header regex backtracking (CVSS 8.7, parse-community parse-server · parse-server)
- [CVE-2026-47248](https://cve.now/CVE-2026-47248.md): Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers (CVSS 6.9, parse-community parse-server · parse-server)
- [CVE-2026-50244](https://cve.now/CVE-2026-50244.md): Naxclow IoT Platform Missing Authorization (CVSS 6.9, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-42932](https://cve.now/CVE-2026-42932.md): Naxclow IoT Platform Generation of Predictable Numbers or Identifiers (CVSS 6.9, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-42947](https://cve.now/CVE-2026-42947.md): Naxclow IoT Platform Authorization bypass through User-Controlled key (CVSS 8.7, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-47236](https://cve.now/CVE-2026-47236.md): Solidtime team page exposes pending invitation and member emails to employees who lack invitations:view/members:view permission (CVSS 4.3, solidtime-io solidtime)
- [CVE-2026-50108](https://cve.now/CVE-2026-50108.md): Naxclow IoT Platform Missing Authorization (CVSS 8.7, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-42306](https://cve.now/CVE-2026-42306.md): Moby: Race condition in docker cp allows bind mount redirection to host path (CVSS 7.2, moby · github.com/docker/docker +2)
- [CVE-2026-41568](https://cve.now/CVE-2026-41568.md): Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap (CVSS 6.1, moby · github.com/docker/docker +2)
- [CVE-2026-50101](https://cve.now/CVE-2026-50101.md): Naxclow IoT Platform Not using password aging (CVSS 9.2, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-28742](https://cve.now/CVE-2026-28742.md): Naxclow IoT Platform Use of hard-coded cryptographic key (CVSS 9.2, Naxclow Smart Doorbell X3 · Naxclow X Smart Home +1)
- [CVE-2026-12143](https://cve.now/CVE-2026-12143.md): form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) (CVSS 8.7, form-data)
- [CVE-2026-53408](https://cve.now/CVE-2026-53408.md): Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allo (CVSS 8.1, Zoom Communications Zoom Workplace)
- [CVE-2026-53407](https://cve.now/CVE-2026-53407.md): Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allo (CVSS 8.1, Zoom Communications Zoom Workplace)
- [CVE-2026-53406](https://cve.now/CVE-2026-53406.md): Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an authe (CVSS 7.8, Zoom Communications Remote Control for Zoom Contact Center)
- [CVE-2026-48165](https://cve.now/CVE-2026-48165.md): MariaDB: unsafe usage of \`wsrep\_sst\_receive\_address\` values on the joiner side (CVSS 8.0, MariaDB server)
- [CVE-2026-48163](https://cve.now/CVE-2026-48163.md): MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync) (CVSS 8.0, MariaDB server)
- [CVE-2026-44173](https://cve.now/CVE-2026-44173.md): MariaDB: FILE privilege was not checked for subqueries in the FROM clause (CVSS 5.0, MariaDB server)
- [CVE-2026-44172](https://cve.now/CVE-2026-44172.md): MariaDB: mysql\_real\_escape\_string() incorrectly handled big5 (CVSS 6.9, MariaDB server · mariadb)
- [CVE-2026-44171](https://cve.now/CVE-2026-44171.md): MariaDB: path traversal in mbstream (CVSS 6.3, MariaDB server)
- [CVE-2026-44169](https://cve.now/CVE-2026-44169.md): MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions (CVSS 4.3, MariaDB server)
- [CVE-2026-44168](https://cve.now/CVE-2026-44168.md): MariaDB: wsrep SST unsafe parameter handling on the donor side (CVSS 8.0, MariaDB server)
- [CVE-2026-44170](https://cve.now/CVE-2026-44170.md): MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL (CVSS 6.3, MariaDB server)
- [CVE-2026-47216](https://cve.now/CVE-2026-47216.md): Typesense: Unauthenticated Denial of Service in the Typesense /multi\_search Endpoint (CVSS 8.7, typesense)
- [CVE-2026-47225](https://cve.now/CVE-2026-47225.md): Improper Search Cache Isolation for Scoped Search API Keys in Typesense (CVSS 6.0, typesense)
- [CVE-2026-47965](https://cve.now/CVE-2026-47965.md): Acrobat Reader | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Acrobat DC · Adobe Acrobat Reader DC +1)
- [CVE-2026-48558](https://cve.now/CVE-2026-48558.md): SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification (CVSS 9.5, KEV, SimpleHelp)
- [CVE-2026-47223](https://cve.now/CVE-2026-47223.md): NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow (CVSS 5.4, M2Team NanaZip)
- [CVE-2026-47224](https://cve.now/CVE-2026-47224.md): NanaZip: Heap buffer-overflow read in NanaZip LVM metadata CRC check (CVSS 4.3, M2Team NanaZip)
- [CVE-2026-47222](https://cve.now/CVE-2026-47222.md): NanaZip: Heap out-of-bounds read in NanaZip AVB property descriptor parser via unsigned integer underflow (CVSS 5.4, M2Team NanaZip)
- [CVE-2026-53982](https://cve.now/CVE-2026-53982.md): Cap-go Console \< 12.28.2 Account Deletion DoS via Device Identifier Association (CVSS 7.1, Cap-go capgo)
- [CVE-2026-6961](https://cve.now/CVE-2026-6961.md): CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync (CVSS 7.6, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-7387](https://cve.now/CVE-2026-7387.md): Mattermost group syncable endpoints allow privilege escalation via scheme\_admin (CVSS 8.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-6046](https://cve.now/CVE-2026-6046.md): Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server (CVSS 5.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-6689](https://cve.now/CVE-2026-6689.md): \*Missing\* {{invite\_user}} \*permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings\* (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-7184](https://cve.now/CVE-2026-7184.md): Mattermost Remote Cluster PATCH API Leaks Authentication Tokens (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-6739](https://cve.now/CVE-2026-6739.md): Mattermost: Delegated admins could patch protected default system roles (CVSS 6.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-3433](https://cve.now/CVE-2026-3433.md): Mattermost fails to scope role\_updated websocket events to authorized team and channel members (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-3840](https://cve.now/CVE-2026-3840.md): Path Traversal in kedro-org/kedro (CVSS 7.1, kedro-org/kedro)
- [CVE-2026-53981](https://cve.now/CVE-2026-53981.md): Cap-go \< v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism (CVSS 7.2, Cap-go)
- [CVE-2026-45833](https://cve.now/CVE-2026-45833.md): A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary c (CVSS 9.4, ChromaDB)
- [CVE-2026-45832](https://cve.now/CVE-2026-45832.md): All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing at (CVSS 8.8, ChromaDB)
- [CVE-2026-45831](https://cve.now/CVE-2026-45831.md): The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a use (CVSS 8.8, ChromaDB)
- [CVE-2026-50091](https://cve.now/CVE-2026-50091.md): Aqara Home Android SDK hardcoded keys (CVSS 9.1, com.lumiunited.aqarahome)
- [CVE-2026-50090](https://cve.now/CVE-2026-50090.md): Aqara OAuth redirect\_uri validation bypass (CVSS 9.3, Aqara Cloud OAuth Authorization Endpoint)
- [CVE-2026-50089](https://cve.now/CVE-2026-50089.md): Aqara IAM/SSO Gateway open redirect (CVSS 6.1, Aqara IAM/SSO Gateway)
- [CVE-2026-50088](https://cve.now/CVE-2026-50088.md): Aqara Developer Portal cross-origin resource sharing (CVSS 8.2, Aqara Developer Portal · Aqara Developer Test Portal)
- [CVE-2026-50087](https://cve.now/CVE-2026-50087.md): Aqara IAM/SSO Gateway cross-origin resource sharing (CVSS 8.2, Aqara IAM/SSO Gateway)
- [CVE-2026-50086](https://cve.now/CVE-2026-50086.md): Aqara unauthenticated AES oracle (CVSS 10.0, Aqara IAM/SSO Gateway)
- [CVE-2026-50085](https://cve.now/CVE-2026-50085.md): Aqara Board IoT insecure debug API (CVSS 8.6, Aqara Board service)
- [CVE-2026-50084](https://cve.now/CVE-2026-50084.md): Aqara API cross-account access (CVSS 9.6, Aqara Cloud Production API)
- [CVE-2026-50083](https://cve.now/CVE-2026-50083.md): Aqara hardcoded OAuth client credentials (CVSS 9.1, Aqara Aquara IAM/SSO Gateway)
- [CVE-2026-50082](https://cve.now/CVE-2026-50082.md): Aqara Developer Portal insecure authentication token (CVSS 6.5, Aqara Cloud Developer Portal)
- [CVE-2026-50560](https://cve.now/CVE-2026-50560.md): Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (CVSS 6.9, netty · io.netty:netty-codec-http2)
- [CVE-2026-9641](https://cve.now/CVE-2026-9641.md): Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations (CVSS 5.3, ARODLAND Crypt::PBKDF2)
- [CVE-2026-46690](https://cve.now/CVE-2026-46690.md): unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race (CVSS 5.8, spearman unbounded-spsc · unbounded-spsc)
- [CVE-2026-50020](https://cve.now/CVE-2026-50020.md): Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted (CVSS 5.3, netty · io.netty:netty-codec-http)
- [CVE-2026-50011](https://cve.now/CVE-2026-50011.md): Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length (CVSS 7.5, netty · io.netty:netty-codec-redis)
- [CVE-2026-44967](https://cve.now/CVE-2026-44967.md): opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response (CVSS 5.3, open-telemetry opentelemetry-cpp)
- [CVE-2026-50010](https://cve.now/CVE-2026-50010.md): Netty's wrapping plain trust manager silently disables hostname verification (CVSS 7.5, netty · io.netty:netty-handler)
- [CVE-2026-8828](https://cve.now/CVE-2026-8828.md): A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read (CVSS 8.8, ChromaDB)
- [CVE-2026-47190](https://cve.now/CVE-2026-47190.md): IPAM controller service account granted unnecessary full access to Secrets (CVSS 4.4, metal3-io ip-address-manager · github.com/metal3-io/ip-addr…)
- [CVE-2026-50009](https://cve.now/CVE-2026-50009.md): Netty QUIC stateless reset token material exposed through header-visible connection IDs (CVSS 4.8, netty · io.netty:netty-codec-classes-quic)
- [CVE-2026-45830](https://cve.now/CVE-2026-45830.md): A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily r (CVSS 8.8, ChromaDB)
- [CVE-2026-53568](https://cve.now/CVE-2026-53568.md): Frappe: Stored XSS in Frappe Report/List View via 'set\_link\_title\_field\_value' (CVSS 6.9, frappe)
- [CVE-2026-48748](https://cve.now/CVE-2026-48748.md): Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion (CVSS 7.5, netty · io.netty:netty-codec-http3)
- [CVE-2026-50026](https://cve.now/CVE-2026-50026.md): Frappe: Lack of permissions checks in 'relink' and 'set\_email\_password' endpoints (CVSS 6.9, frappe)
- [CVE-2026-48059](https://cve.now/CVE-2026-48059.md): Netty HAProxy: Unbalanced Reference Count in Nested PP2\_TYPE\_SSL TLV Parsing Leads to Memory Exhaustion (CVSS 8.7, netty · io.netty:netty-codec-haproxy)
- [CVE-2026-9638](https://cve.now/CVE-2026-9638.md): Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts (CVSS 7.5, ARODLAND Crypt::PBKDF2)
- [CVE-2026-47182](https://cve.now/CVE-2026-47182.md): Frappe: Broken Access Control on Private Files (CVSS 5.3, frappe)
- [CVE-2026-48043](https://cve.now/CVE-2026-48043.md): netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion (CVSS 5.3, netty · io.netty:netty-codec-http2)
- [CVE-2026-44976](https://cve.now/CVE-2026-44976.md): Frappe: IDOR in update\_onboarding\_step (CVSS 5.3, frappe)
- [CVE-2026-48006](https://cve.now/CVE-2026-48006.md): Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVSS 8.7, netty · io.netty:netty-codec-redis)
- [CVE-2026-44975](https://cve.now/CVE-2026-44975.md): Frappe: Missing authorization on reset form tours (CVSS 5.3, frappe)
- [CVE-2026-44206](https://cve.now/CVE-2026-44206.md): Frappe: DB Schema Enumeration via Frappe-Authorization-Source (CVSS 6.9, frappe)
- [CVE-2026-47691](https://cve.now/CVE-2026-47691.md): Netty has Insufficient Bailiwick Validation for NS Records (CVSS 8.7, netty · io.netty:netty-resolver-dns)
- [CVE-2026-40677](https://cve.now/CVE-2026-40677.md): The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially lead (CVSS 7.7, AMD Management Console · AMD Ryzen™ Master +1)
- [CVE-2026-44207](https://cve.now/CVE-2026-44207.md): Frappe: Insecure Direct Object Reference for email accounts (CVSS 6.9, frappe)
- [CVE-2026-5792](https://cve.now/CVE-2026-5792.md): Authentication Bypass in Hedef Media's Related Marketing Cloud (RMC) (CVSS 6.5, Hedef Media Promotion Interactive Media Marketing Related M…)
- [CVE-2026-44208](https://cve.now/CVE-2026-44208.md): Frappe: IDOR in \`submit\_discussion()\` (CVSS 6.9, frappe)
- [CVE-2026-47244](https://cve.now/CVE-2026-47244.md): Netty HTTP/2: Advertised MAX\_CONCURRENT\_STREAMS are not enforced (CVSS 5.3, netty · io.netty:netty-codec-http2)
- [CVE-2026-44205](https://cve.now/CVE-2026-44205.md): Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload (CVSS 6.9, frappe)
- [CVE-2026-41581](https://cve.now/CVE-2026-41581.md): Frappe Vulnerable to Possible SQL Injection via get\_blog\_list (CVSS 6.9, frappe)
- [CVE-2026-47739](https://cve.now/CVE-2026-47739.md): Frappe: Stored XSS in Note (CVSS 6.9, frappe)
- [CVE-2026-46340](https://cve.now/CVE-2026-46340.md): Netty: SCTP reassembly nests buffers without bound (CVSS 7.5, netty · io.netty:netty-transport-sctp)
- [CVE-2026-45674](https://cve.now/CVE-2026-45674.md): Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (CVSS 8.7, netty · io.netty:netty-resolver-dns)
- [CVE-2026-47141](https://cve.now/CVE-2026-47141.md): vm2: NodeVM observability builtins leak host process and HTTP request data (CVSS 6.9, patriksimek vm2 · vm2)
- [CVE-2026-47210](https://cve.now/CVE-2026-47210.md): vm2 sandbox escape via JSPI-backed Promise \`.finally()\` species bypass (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2026-47208](https://cve.now/CVE-2026-47208.md): vm2: Sandbox Breakout Using Promise Species (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-47140](https://cve.now/CVE-2026-47140.md): vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-45673](https://cve.now/CVE-2026-45673.md): Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port (CVSS 6.8, netty · io.netty:netty-resolver-dns)
- [CVE-2026-47139](https://cve.now/CVE-2026-47139.md): vm2: NodeVM network builtin exclusions bypass via internal \_http\_client and \_http\_server (CVSS 8.6, patriksimek vm2 · vm2)
- [CVE-2026-47137](https://cve.now/CVE-2026-47137.md): vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-47135](https://cve.now/CVE-2026-47135.md): vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks (CVSS 8.7, patriksimek vm2 · vm2)
- [CVE-2026-47131](https://cve.now/CVE-2026-47131.md): vm2: Sandbox Escape (CVSS 10.0, patriksimek vm2 · vm2)
- [CVE-2026-47209](https://cve.now/CVE-2026-47209.md): vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain (CVSS 8.6, patriksimek vm2 · vm2)
- [CVE-2026-45536](https://cve.now/CVE-2026-45536.md): Netty: Unix-socket fd receive leaks descriptors when peer sends two at once (CVSS 4.0, netty · io.netty:netty-transport-native-epoll +1)
- [CVE-2026-8694](https://cve.now/CVE-2026-8694.md): Improper access control on the API documentation endpoint in PowerShell Universal (CVSS 5.3, Devolutions PowerShell Universal)
- [CVE-2026-6211](https://cve.now/CVE-2026-6211.md): Arbitrary File Upload in Global IT's WEOLL (CVSS 8.7, Global IT Informatics Services WEOLL)
- [CVE-2026-45416](https://cve.now/CVE-2026-45416.md): Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (CVSS 7.5, netty · io.netty:netty-handler)
- [CVE-2026-44894](https://cve.now/CVE-2026-44894.md): Netty's Default QUIC token handler accepts any client-supplied token (CVSS 7.5, netty · io.netty:netty-codec-classes-quic)
- [CVE-2026-10557](https://cve.now/CVE-2026-10557.md): Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials (CVSS 9.3, Yarbo Android/IOS mobile application · Yarbo Cloud MQTT inf…)
- [CVE-2026-7368](https://cve.now/CVE-2026-7368.md): Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization (CVSS 8.6, Yarbo Android/IOS mobile application · Yarbo Cloud MQTT inf…)
- [CVE-2026-44893](https://cve.now/CVE-2026-44893.md): Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length (CVSS 7.5, netty · io.netty:netty-codec-haproxy)
- [CVE-2026-54133](https://cve.now/CVE-2026-54133.md): jmespath.php has CompilerRuntime code injection via unescaped function names (CVSS 9.8, jmespath.php · mtdowling/jmespath.php)
- [CVE-2026-53787](https://cve.now/CVE-2026-53787.md): Amasty Order Attributes for Magento 2 \< 4.0.0 Unauthenticated Arbitrary File Upload (CVSS 9.3, Amasty Order Attributes for Magento)
- [CVE-2026-6853](https://cve.now/CVE-2026-6853.md): OTP Bypass in Başbelen Group's Pause+ Mobile App (CVSS 9.8, Başbelen Group Food Cafe Businesses Industry and Trade Ltd.…)
- [CVE-2026-53722](https://cve.now/CVE-2026-53722.md): Nuxt: Reflected XSS in \`\<NuxtLink\>\` via unsanitised \`javascript:\` or \`data:\` URL (CVSS 5.1, nuxt)
- [CVE-2026-53721](https://cve.now/CVE-2026-53721.md): Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher (CVSS 8.8, nuxt)
- [CVE-2026-11967](https://cve.now/CVE-2026-11967.md): Arbitrary code execution in MobaXterm Personal Edition (Portable) (CVSS 8.5, Mobatek MobaXterm Personal Edition)
- [CVE-2026-11879](https://cve.now/CVE-2026-11879.md): Arbitrary code execution in MobaXterm Personal Edition (Portable) (CVSS 8.5, Mobatek MobaXterm Personal Edition)
- [CVE-2026-1836](https://cve.now/CVE-2026-1836.md): Stored credentials in Redmine (CVSS 5.3, Redmine)
- [CVE-2017-20240](https://cve.now/CVE-2017-20240.md): Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks (CVSS 5.9, ARODLAND Crypt::PBKDF2)
- [CVE-2026-12066](https://cve.now/CVE-2026-12066.md): PbootCMS Password MemberController.php retrieve password recovery (CVSS 6.9, PbootCMS)
- [CVE-2026-47200](https://cve.now/CVE-2026-47200.md): Nuxt: Route middleware not enforced when rendering \`.server.vue\` pages via \`/\_\_nuxt\_island/page\_\*\` (CVSS 6.3, nuxt · @nuxt/nitro-server)
- [CVE-2026-49993](https://cve.now/CVE-2026-49993.md): @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) (CVSS 5.9, nuxt · @nuxt/webpack-builder +1)
- [CVE-2026-45669](https://cve.now/CVE-2026-45669.md): Nuxt: Reflected XSS in \`navigateTo()\` external redirect (CVSS 5.3, nuxt)
- [CVE-2026-45670](https://cve.now/CVE-2026-45670.md): Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) (CVSS 5.9, nuxt · @nuxt/rspack-builder +1)
- [CVE-2026-46342](https://cve.now/CVE-2026-46342.md): Nuxt: \`\_\_nuxt\_island\` endpoint does not bind responses to request props, enabling shared-cache poisoning (CVSS 2.3, nuxt · @nuxt/nitro-server)
- [CVE-2026-12065](https://cve.now/CVE-2026-12065.md): Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme (CVSS 1.0, Groww Stock, Mutual Fund, Gold App)
- [CVE-2026-49347](https://cve.now/CVE-2026-49347.md): Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown (CVSS 5.3, duck-organization questbot)
- [CVE-2026-48485](https://cve.now/CVE-2026-48485.md): Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through \`/warns\`. (CVSS 2.1, duck-organization questbot)
- [CVE-2026-47197](https://cve.now/CVE-2026-47197.md): Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands (CVSS 7.2, duck-organization questbot)
- [CVE-2026-47195](https://cve.now/CVE-2026-47195.md): Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands. (CVSS 7.1, duck-organization questbot)
- [CVE-2026-47196](https://cve.now/CVE-2026-47196.md): Quest Bot: Empty automod rule causes every guild message to be deleted (CVSS 8.4, duck-organization questbot)
- [CVE-2026-9266](https://cve.now/CVE-2026-9266.md): A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and contr (CVSS 7.0, Moxa UC-1200A Series)
- [CVE-2026-11849](https://cve.now/CVE-2026-11849.md): IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded Credentials (CVSS 9.3, IEI Integration iRM-TSi410X)
- [CVE-2026-11848](https://cve.now/CVE-2026-11848.md): IEI Integration Corp｜ iRM-IEI Remote Management - Missing Authentication (CVSS 7.9, IEI Integration iRM-TSi410X)
- [CVE-2026-48914](https://cve.now/CVE-2026-48914.md): Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling (CVSS 6.7, qemu · Red Hat Enterprise Linux +1)
- [CVE-2026-11847](https://cve.now/CVE-2026-11847.md): Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion (CVSS 5.3, IEI Integration iVEC TANK-XM811)
- [CVE-2026-11846](https://cve.now/CVE-2026-11846.md): IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion (CVSS 7.2, IEI Integration iVEC TANK-XM811)
- [CVE-2026-11845](https://cve.now/CVE-2026-11845.md): IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command Injection (CVSS 8.6, IEI Integration iVEC TANK-XM811)
- [CVE-2026-11844](https://cve.now/CVE-2026-11844.md): IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Read (CVSS 6.9, IEI Integration iVEC TANK-XM811)
- [CVE-2026-50645](https://cve.now/CVE-2026-50645.md): Apache CXF: No restriction on attachment headers per message (CVSS 7.5, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-50634](https://cve.now/CVE-2026-50634.md): Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry (CVSS 6.5, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-50633](https://cve.now/CVE-2026-50633.md): Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl (CVSS 8.1, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-50632](https://cve.now/CVE-2026-50632.md): Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory (CVSS 8.1, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-50631](https://cve.now/CVE-2026-50631.md): Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing (CVSS 7.4, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-50630](https://cve.now/CVE-2026-50630.md): Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection (CVSS 6.5, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-50629](https://cve.now/CVE-2026-50629.md): Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier (CVSS 5.3, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-50628](https://cve.now/CVE-2026-50628.md): Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control (CVSS 9.8, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-50627](https://cve.now/CVE-2026-50627.md): Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator (CVSS 9.1, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-49875](https://cve.now/CVE-2026-49875.md): Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils (CVSS 6.5, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-50623](https://cve.now/CVE-2026-50623.md): Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService (CVSS 4.8, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2026-12058](https://cve.now/CVE-2026-12058.md): The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed. (CVSS 5.3, vivo PcSuite)
- [CVE-2026-11535](https://cve.now/CVE-2026-11535.md): An unauthorized access vulnerability exists in the PcSuite APP. (CVSS 9.4, vivo PcSuite)
- [CVE-2026-12060](https://cve.now/CVE-2026-12060.md): Hepta Platforms｜Heptabase - Exposed Dangerous (CVSS 6.9, Hepta Platforms Heptabase)
- [CVE-2026-12059](https://cve.now/CVE-2026-12059.md): Cellopoint｜CelloOS - Improper Access Control (CVSS 8.7, Cellopoint CelloOS)
- [CVE-2026-9271](https://cve.now/CVE-2026-9271.md): KeepInMind - Dashboard Notes \< 0.8.4.2 - Contributor+ Stored XSS (CVSS 5.9, KeepInMind Dashboard Notes)
- [CVE-2026-9269](https://cve.now/CVE-2026-9269.md): Secure Copy Content Protection and Content Locking \< 5.1.5 - Admin+ Stored XSS via ays\_sccp\_sub\_icon\_image Parameter (CVSS 3.5, Secure Copy Content Protection and Content Locking)
- [CVE-2026-44892](https://cve.now/CVE-2026-44892.md): Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size (CVSS 7.5, netty · io.netty:netty-codec-http3)
- [CVE-2026-45169](https://cve.now/CVE-2026-45169.md): Idira Privileged Access Manager (PAM) Self-Hosted Vault: Denial of Service due to Unexpected Input Processing (CVSS 8.7, CyberArk Software, a Palo Alto Networks Company PAM SH Vault)
- [CVE-2026-47370](https://cve.now/CVE-2026-47370.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain de (CVSS 9.9, Ubiquiti UniFi OS Server · Ubiquiti Express +29)
- [CVE-2026-47369](https://cve.now/CVE-2026-47369.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain de (CVSS 9.9, Ubiquiti UniFi OS Server · Ubiquiti Express +29)
- [CVE-2026-48613](https://cve.now/CVE-2026-48613.md): SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, (CVSS 7.1, phpBB)
- [CVE-2026-47368](https://cve.now/CVE-2026-47368.md): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtai (CVSS 8.6, Ubiquiti UniFi OS Server · Ubiquiti Express +29)
- [CVE-2026-48612](https://cve.now/CVE-2026-48612.md): Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s a (CVSS 8.0, phpBB)
- [CVE-2026-47367](https://cve.now/CVE-2026-47367.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterp (CVSS 9.9, Ubiquiti UID Enterprise Agent)
- [CVE-2026-48610](https://cve.now/CVE-2026-48610.md): Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found (CVSS 8.1, Ubiquiti UDM · Ubiquiti UDM-Pro +13)
- [CVE-2026-47366](https://cve.now/CVE-2026-47366.md): Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticat (CVSS 7.2, phpBB)
- [CVE-2026-47365](https://cve.now/CVE-2026-47365.md): Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cro (CVSS 9.9, WebPros WordPress-Toolkit)
- [CVE-2026-48611](https://cve.now/CVE-2026-48611.md): Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to u (CVSS 9.8, phpBB)
- [CVE-2026-20746](https://cve.now/CVE-2026-20746.md): PingDirectory copying of virtual attributes leads to memory exhaustion (CVSS 6.3, Ping Identity PingDirectory)
- [CVE-2026-11933](https://cve.now/CVE-2026-11933.md): Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion (CVSS 8.8, MongoDB)
- [CVE-2026-9125](https://cve.now/CVE-2026-9125.md): The Ultimate Video Player For WordPress \<= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link\_url' Shortcode Attribute (CVSS 6.4, 2winfactor Presto Player)
- [CVE-2026-45170](https://cve.now/CVE-2026-45170.md): Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation (CVSS 7.5, CyberArk Software, a Palo Alto Networks Company Vendor PAM)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.