# CVEs published 2026-06-13

22 CVEs were published on June 13, 2026: 2 critical, 7 high. Days are UTC.

- [CVE-2026-12176](https://cve.now/CVE-2026-12176.md): SourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scripting (CVSS 5.3, SourceCodester CET Automated Grading System with AI Predict…)
- [CVE-2026-12175](https://cve.now/CVE-2026-12175.md): CodeAstro Student Attendance Management System createStudents.php sql injection (CVSS 5.1, CodeAstro Student Attendance Management System)
- [CVE-2026-12174](https://cve.now/CVE-2026-12174.md): D-Link DCS-935L HTTP rhea snprintf format string (CVSS 8.7, D-Link DCS-935L)
- [CVE-2026-12183](https://cve.now/CVE-2026-12183.md): Nefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary Credentials (CVSS 9.3, Nefteprodukttekhnika BUK TS-G Gas Station Automation System)
- [CVE-2026-6428](https://cve.now/CVE-2026-6428.md): Koha SQL Injection in reports/catalogue\_out.pl via Filter URL Parameter (CVSS 5.6, Koha Community Koha)
- [CVE-2026-5513](https://cve.now/CVE-2026-5513.md): Online Scheduling and Appointment Booking System – Bookly \<= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie (CVSS 7.2, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-11624](https://cve.now/CVE-2026-11624.md): The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DN (CVSS 9.4, Google MCP Toolbox for Databases · github.com/googleapis… +1)
- [CVE-2026-1291](https://cve.now/CVE-2026-1291.md): Meow Gallery \<= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation (CVSS 4.3, tigroumeow Meow Gallery)
- [CVE-2026-9629](https://cve.now/CVE-2026-9629.md): Canvas \<= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute (CVSS 6.4, codesupplyco Canvas)
- [CVE-2026-2470](https://cve.now/CVE-2026-2470.md): Pagelayer \<= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts' (CVSS 4.3, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2026-3297](https://cve.now/CVE-2026-3297.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block (CVSS 6.4, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2026-9134](https://cve.now/CVE-2026-9134.md): Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel \<= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom\_attribute\_key' Shortcode Parameter (CVSS 6.4, fooplugins Photo Gallery by FooGallery : Responsive Image G…)
- [CVE-2026-9062](https://cve.now/CVE-2026-9062.md): Agile Store Locator \< 1.6.9 - Admin+ Arbitrary File Read via Path Traversal (CVSS 3.4, Store Locator WordPress)
- [CVE-2026-9061](https://cve.now/CVE-2026-9061.md): Agile Store Locator \< 1.6.9 - Admin+ Stored XSS via logo\_name (CVSS 3.5, Store Locator WordPress)
- [CVE-2026-9109](https://cve.now/CVE-2026-9109.md): GPTranslate \<= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage (CVSS 7.2, john-dagelmore GPTranslate – Multilingual AI Translation fo…)
- [CVE-2026-11769](https://cve.now/CVE-2026-11769.md): Operator - Namespaced User Path Traversal (CVSS 6.4, Grafana Operator · github.com/grafana/grafana-operator/v5 +3)
- [CVE-2026-54231](https://cve.now/CVE-2026-54231.md): Abrt: unsanitized systemd journal content written to dump directory files enables content injection (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-54230](https://cve.now/CVE-2026-54230.md): Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (CVSS 7.0, Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red…)
- [CVE-2026-54229](https://cve.now/CVE-2026-54229.md): Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking (CVSS 7.0, Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red…)
- [CVE-2026-54228](https://cve.now/CVE-2026-54228.md): Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories (CVSS 7.8, Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red…)
- [CVE-2026-9848](https://cve.now/CVE-2026-9848.md): WP Ticket \<= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter (CVSS 7.5, emarket-design Customer Support Ticket System & Helpdesk)
- [CVE-2026-12089](https://cve.now/CVE-2026-12089.md): WS Optimize – All-in-One Speed Booster & Cache Tools \<= 3.3.19 - Authenticated (Editor+) Arbitrary File Read (CVSS 4.9, aurelienlws LWS Optimize – All-in-One Speed Booster & Cache…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.