CVEs published June 13, 2026
22 CVEs were published on June 13, 2026: 2 critical, 7 high.
- Published
- 22
- Critical
- 2
- High
- 7
- Medium
- 11
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red…
- 3
- softaculous Page Builder: Pagelayer – Drag and Drop website…
- 2
- Store Locator WordPress
- 2
- aurelienlws LWS Optimize – All-in-One Speed Booster & Cache…
- 1
- CodeAstro Student Attendance Management System
- 1
- codesupplyco Canvas
- 1
- D-Link DCS-935L
- 1
- emarket-design Customer Support Ticket System & Helpdesk
- 1
- fooplugins Photo Gallery by FooGallery : Responsive Image G…
- 1
- Google MCP Toolbox for Databases · github.com/googleapis… +1
- 1
Critical 2
- CVE-2026-12183Nefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary CredentialsNefteprodukttekhnika BUK TS-G Gas Station Automation System
- CVE-2026-11624The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNGoogle MCP Toolbox for Databases · github.com/googleapis… +1
High 7
- CVE-2026-12174D-Link DCS-935L HTTP rhea snprintf format stringD-Link DCS-935L
- CVE-2026-5513Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookieladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-9109GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storagejohn-dagelmore GPTranslate – Multilingual AI Translation fo…
- CVE-2026-54230Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwritesRed Hat Enterprise Linux 7 Extended Lifecycle Support · Red…
- CVE-2026-54229Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate lockingRed Hat Enterprise Linux 7 Extended Lifecycle Support · Red…
- CVE-2026-54228Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directoriesRed Hat Enterprise Linux 7 Extended Lifecycle Support · Red…
- CVE-2026-9848WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameteremarket-design Customer Support Ticket System & Helpdesk
Medium, low and unrated 13
- CVE-2026-12176SourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scriptingSourceCodester CET Automated Grading System with AI Predict…
- CVE-2026-12175CodeAstro Student Attendance Management System createStudents.php sql injectionCodeAstro Student Attendance Management System
- CVE-2026-6428Koha SQL Injection in reports/catalogue_out.pl via Filter URL ParameterKoha Community Koha
- CVE-2026-1291Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creationtigroumeow Meow Gallery
- CVE-2026-9629Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attributecodesupplyco Canvas
- CVE-2026-2470Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'softaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2026-3297Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Blocksoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2026-9134Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameterfooplugins Photo Gallery by FooGallery : Responsive Image G…
- CVE-2026-9062Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path TraversalStore Locator WordPress
- CVE-2026-9061Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_nameStore Locator WordPress
- CVE-2026-11769Operator - Namespaced User Path TraversalGrafana Operator · github.com/grafana/grafana-operator/v5 +3
- CVE-2026-54231Abrt: unsanitized systemd journal content written to dump directory files enables content injectionRed Hat Enterprise Linux
- CVE-2026-12089WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Readaurelienlws LWS Optimize – All-in-One Speed Booster & Cache…