CVEs published June 18, 2026
151 CVEs were published on June 18, 2026: 26 critical, 54 high. 1 is now in CISA KEV.
- Published
- 151
- Critical
- 26
- High
- 54
- Medium
- 66
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 84
Most affected products
- mcdope pam_usb
- 7
- pgadmin.org pgAdmin
- 7
- Significant-Gravitas AutoGPT
- 6
- UBB Systems UBB.threads
- 6
- Cotonti · cotonti/cotonti
- 4
- Government Accountability Office Electronic Protest Docketi…
- 4
- Xen
- 4
- LMS
- 3
- MCP Toolbox for Databases · github.com/googleapis/mcp-toolb…
- 3
- PraisonAI
- 3
Critical 26
- CVE-2026-40624AVer PTC cameras Files or Directories Accessible to External PartiesAVer PTC500S · AVer PTC115 +2
- CVE-2026-12048pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parserpgadmin.org pgAdmin
- CVE-2026-12046pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code executionpgadmin.org pgAdmin
- CVE-2026-12045pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code executionpgadmin.org pgAdmin
- CVE-2026-47647Dynamics 365 Elevation of Privilege VulnerabilityMicrosoft Dynamics
- CVE-2026-54130M365 Copilot Information Disclosure VulnerabilityMicrosoft 365 Copilot
- CVE-2026-49257mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bindstartreedata mcp-pinot · mcp-pinot-server
- CVE-2026-49454Relyra SAML SignatureValue not cryptographically verified -> authentication bypassszTheory relyra
- CVE-2026-49252deepstream is vulnerable to prototype pollutiondeepstreamIO deepstream.io · @deepstream/server
- CVE-2026-47846Bitnami Cassandra container images are affected by a retained default superuser vulnerability.bitnami/cassandra
- CVE-2026-54390JTL Shop < 5.7.2 Server-Side Template Injection via Smarty RendererJTL Software JTL Shop
- CVE-2026-54103U.S. GAO EPDS and CBCA EDS unauthenticated password changeGovernment Accountability Office Electronic Protest Docketi…
- CVE-2026-55203HAProxy - Integer Overflow in FCGI Demux Record Length Fieldhaproxy
- CVE-2026-11718An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.MCP Toolbox for Databases · github.com/googleapis/mcp-toolb…
- CVE-2026-11717An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.MCP Toolbox for Databases · github.com/googleapis/mcp-toolb…
- CVE-2026-54419PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_queryclaudiopizzillo PIAF-HMS
- CVE-2026-8024Deserialization vulnerability in ibaPDA and ibaDatCoordinatoribaPDA · ibaDatCoordinator
- CVE-2025-10560Hardcoded cloud credentials in Worksnaps client application binaries expose production cloud resourcesSilver Leaf Technologies Worksnaps.net Worksnaps
- CVE-2026-28573In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check.Google Android
- CVE-2026-55742Cotonti CSRF in admin.rights.php allows privilege escalationCotonti · cotonti/cotonti
- CVE-2026-55740SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameterNur-Alam39 bus-ticket
- CVE-2026-12569Remote Code Execution (RCE) vulnerability in Windchill PDMlinkPTC Windchill PDMLink · PTC FlexPLM
- CVE-2026-38714InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vuln
- CVE-2026-38715InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vuln
- CVE-2026-38716InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vuln
- CVE-2026-38717InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vuln
High 54
- CVE-2026-12044pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templatespgadmin.org pgAdmin
- CVE-2026-56078PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitorPraisonAI · praisonaiagents
- CVE-2026-56077PraisonAI - Information Disclosure via Shared MultiAgentLedger StatePraisonAI
- CVE-2026-56076PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI EndpointPraisonAI
- CVE-2026-56075PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode OverridePraisonAI
- CVE-2026-32174Azure Bot Service Elevation of Privilege VulnerabilityMicrosoft Azure AI Bot Service
- CVE-2026-47633Microsoft Cost Management Information Disclosure VulnerabilityMicrosoft Cost Management
- CVE-2026-8100Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific condProgress Chef Chef360
- CVE-2026-54017Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversalopen-webui
- CVE-2026-46699conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repositoryconda-forge conda-smithy
- CVE-2026-45696OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS)AcademySoftwareFoundation openexr
- CVE-2025-15661libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.clibssh2
- CVE-2026-49248OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untartheonedev onedev
- CVE-2026-43994Coturn: Stack buffer overflow in decode_oauth_token_gcm()coturn
- CVE-2026-25865Punto Switcher 4.5.0.583 Unquoted Search Path via WinExecYandex Punto Switcher
- CVE-2026-48716nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file writeHKUDS nanobot
- CVE-2026-12390Access of resource using incompatible type ('type confusion') in AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2025-53114CometD has acknowledgement extension out of memorycometd · org.cometd.java:cometd-java-server-common
- CVE-2026-55237AutoGPT SignUp Page has DOM-Based XSS and Open RedirectSignificant-Gravitas AutoGPT
- CVE-2025-32437AutoGPT has a DoS vulnerability in MediaDurationBlockSignificant-Gravitas AutoGPT
- CVE-2025-32436AutoGPT has a DoS vulnerability in AddAudioToVideoBlockSignificant-Gravitas AutoGPT
- CVE-2025-32424AutoGPT has a DoS vulnerability in ScreenshotWebPageBlockSignificant-Gravitas AutoGPT
- CVE-2026-54104U.S. GAO EPDS and CBCA EDS client-based privilege escalationGovernment Accountability Office Electronic Protest Docketi…
- CVE-2025-32422AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlockSignificant-Gravitas AutoGPT
- CVE-2026-56020Webmin HTTP header authentication bypassWebmin
- CVE-2025-32392AutoGPT has a DoS vulnerability in LoopVideoBlockSignificant-Gravitas AutoGPT
- CVE-2026-55204HAProxy - NULL Pointer Dereference in hpack_dht_insert Functionhaproxy
- CVE-2026-44691In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g.Eclipse Foundation Eclipse Theia · @theia/debug +2
- CVE-2025-52465GeoServer has an arbitrary file write vulnerability in its Master Password Dump Pageorg.geoserver.web:gs-web-app · org.geoserver.web:gs-web-sec…
- CVE-2026-46580In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded andEclipse Foundation Eclipse Theia · @theia/ai-chat-ui +5
- CVE-2025-27511GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connectionorg.geoserver.extension:gs-db2
- CVE-2026-44688In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context withEclipse Foundation Eclipse Theia · @theia/ai-chat-ui +6
- CVE-2026-50141Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonationwoodpecker-ci woodpecker · go.woodpecker-ci.org/woodpeck… +2
- CVE-2026-56012WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-42488x86: mismatched mapcache metadataXen
- CVE-2026-42487x86 HVM I/O port list traversalXen
- CVE-2026-54224Denial of Service in UBB.threadsUBB Systems UBB.threads
- CVE-2026-54223Remote Code Execution via arbitrary file read and write in UBB.threadsUBB Systems UBB.threads
- CVE-2026-54222Blind SQL Injection in UBB.threadsUBB Systems UBB.threads
- CVE-2026-54220Cross-Site Request Forgery in UBB.threadsUBB Systems UBB.threads
- CVE-2026-11719An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocMCP Toolbox for Databases · github.com/googleapis/mcp-toolb…
- CVE-2026-8461Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoderFFmpeg
- CVE-2026-11958Local privilege escalation in ANSSI’s DFIR-ORCANSSI DFIR-ORC
- CVE-2026-40456OS Command Injection in LMSLMS
- CVE-2026-40455SQL Injection in LMSLMS
- CVE-2026-8811Path traversal in PDF generation moduleSEPPmail AG Secure Email Gateway
- CVE-2026-11395CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Hostmariovalney CF7 to Webhook
- CVE-2026-55746Cotonti stored XSS via PFS folder titleCotonti · cotonti/cotonti
- CVE-2026-55744Cotonti CSRF in PFS allows forced arbitrary file uploadCotonti · cotonti/cotonti
- CVE-2026-55741Cotonti CSRF in admin.config.php allows unauthorized configuration changesCotonti
- CVE-2026-9860Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Actionvanyukov Offload, AI & Optimize with Cloudflare Images
- CVE-2026-12407E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameteroleksandrz E2Pdf – Export Pdf Tool for WordPress
- CVE-2026-12505Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcallRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-38718InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a buffer overflow vulner
Medium, low and unrated 71
- CVE-2026-50034Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmission of Sensitive InformationApollo Pharmacy Blood Glucose Monitoring System
- CVE-2026-52866Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing AuthorizationApollo Pharmacy Blood Glucose Monitoring System
- CVE-2026-12049pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameterpgadmin.org pgAdmin
- CVE-2026-12047pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception textpgadmin.org pgAdmin
- CVE-2026-12050pgAdmin 4: SQL injection in named restore point endpointpgadmin.org pgAdmin
- CVE-2026-56074PraisonAI - Tool Approval Cache Bypass via Coarse-Grained CachingPraisonAI · praisonaiagents
- CVE-2026-8668Hardcoded credentials in embedded contentProgress Chef Chef360
- CVE-2026-49205phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)thorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-22674Hashgraph Guardian Stored XSS via branding companyName fieldhashgraph guardian
- CVE-2026-44663OpenEXR: Integer overflow in the HTJ2K decoder leads to heap-buffer-overflowAcademySoftwareFoundation openexr
- CVE-2026-43915Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN usernamecoturn
- CVE-2026-56099OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Inputopenbsd src
- CVE-2026-48980pam_usb: getenv() used in PAM context allows environment variable injection into local-check logicmcdope pam_usb
- CVE-2026-48983pam_usb: TOCTOU race condition in pad directory creation allows symlink substitutionmcdope pam_usb
- CVE-2026-48982pam_usb: Missing O_EXCL on pad temp file creation allows concurrent update racemcdope pam_usb
- CVE-2026-48981pam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.cmcdope pam_usb
- CVE-2026-47847Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replicatiobitnami/mariadb-galera
- CVE-2026-47833setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow.Cloud Foundry Foundation bpm-release
- CVE-2026-48937A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.nodejs node
- CVE-2026-55392NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_sizenilfs-dev nilfs-utils
- CVE-2026-9692Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurelyHAYAJO Mojolicious::Sessions::Storable
- CVE-2026-48985pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Fieldmcdope pam_usb
- CVE-2026-48986pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authenticationmcdope pam_usb
- CVE-2026-48984pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heapmcdope pam_usb
- CVE-2026-11982Stored XSS via missing XSS safety check in Admin2 Pages API partial validationgrav-plugin-api
- CVE-2026-48617A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.nodejs node
- CVE-2026-54106U.S. GAO EPDS and CBCA EDS network access control bypassGovernment Accountability Office Electronic Protest Docketi…
- CVE-2026-54105U.S. GAO EPDS and CBCA EDS user information disclosureGovernment Accountability Office Electronic Protest Docketi…
- CVE-2026-56021Webmin information disclosure via regex patternWebmin
- CVE-2026-56022Webmin MFA bypassWebmin
- CVE-2026-55205Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpointnesquena hermes-webui
- CVE-2026-56024WordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerabilitySaad Iqbal WP EasyPay
- CVE-2026-11791389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()Red Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-22551In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitraryEclipse Foundation Eclipse Theia · @theia/ai-chat-ui +6
- CVE-2025-58175GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolutionorg.geoserver.web:gs-web-app · org.geoserver:gs-main
- CVE-2026-9158In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangEclipse Foundation Eclipse 4diac
- CVE-2026-12527A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmwarShenzhen Liandian Communication Technology V380 IP Camera /…
- CVE-2026-12539Docker Sandboxes ICMP egress restriction bypass after daemon restartDocker Sandboxes
- CVE-2026-12039Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolutionDocker Sandboxes
- CVE-2026-42490domctl lock open to abuseXen
- CVE-2026-42489domctl lock open to abuseXen
- CVE-2026-54221Reflected XSS in UBB.threadsUBB Systems UBB.threads
- CVE-2026-54219Stored XSS in UBB.threadsUBB Systems UBB.threads
- CVE-2026-40457Reflected XSS in LMSLMS
- CVE-2026-56009WordPress Bricksable for Bricks Builder plugin <= 1.6.83 - Cross Site Scripting (XSS) vulnerabilityBricksable for Bricks Builder
- CVE-2026-44942libzypp .repo files can have an optional path which can lead to path traversal attacksSUSE libzypp
- CVE-2026-56007WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityOceanWP Ocean Product Sharing
- CVE-2026-50643Out‑of‑Bounds Read in 8ccrui314 8cc
- CVE-2026-2021Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attributecontrid Slideshow Gallery LITE
- CVE-2026-8039Fancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scriptingdijitul Fancy Testimonials
- CVE-2026-12111Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parametercodepeople Appointment Booking Calendar
- CVE-2026-12098PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta FieldPowerPress Podcasting plugin by Blubrry
- CVE-2026-12137SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameterphppoet SysBasics Customize My Account for WooCommerce – Da…
- CVE-2026-12102UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameterstiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2026-12136SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesphppoet SysBasics Customize My Account for WooCommerce – Da…
- CVE-2026-55745Cotonti CSRF in PFS folder edit allows unauthorized folder modificationCotonti · cotonti/cotonti
- CVE-2026-9815MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCEMagicForm
- CVE-2026-11358Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameterthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2026-11402Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attributebplugins Services Section Block – Showcase Service Details…
- CVE-2026-11784Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX ActionOptimole – Optimize Images | Convert WebP & AVIF | CDN & La…
- CVE-2026-12093Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhookwpinsider-1 Simple Membership
- CVE-2026-10736Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-10623PressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' ParametersPressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assess…
- CVE-2026-11360Advanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameteralgolplus Advanced Order Export For WooCommerce
- CVE-2026-11357Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localizationstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2026-11776Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' ParameterForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-10029Event Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpointseventkoi Event Koi Lite – Events Calendar, Event Management…
- CVE-2026-12120FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameterfireplugins FireBox Popups – Increase Sales and Grow Your E…
- CVE-2026-11777Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' ParameterForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-9199Equalize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameterequalizedigital Equalize Digital Accessibility Checker – WC…
- CVE-2026-10023Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlersdokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…