# CVEs published 2026-06-18

151 CVEs were published on June 18, 2026: 26 critical, 54 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-40624](https://cve.now/CVE-2026-40624.md): AVer PTC cameras Files or Directories Accessible to External Parties (CVSS 9.8, AVer PTC500S · AVer PTC115 +2)
- [CVE-2026-50034](https://cve.now/CVE-2026-50034.md): Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmission of Sensitive Information (CVSS 6.5, Apollo Pharmacy Blood Glucose Monitoring System)
- [CVE-2026-52866](https://cve.now/CVE-2026-52866.md): Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing Authorization (CVSS 6.5, Apollo Pharmacy Blood Glucose Monitoring System)
- [CVE-2026-12049](https://cve.now/CVE-2026-12049.md): pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter (CVSS 4.3, pgadmin.org pgAdmin)
- [CVE-2026-12048](https://cve.now/CVE-2026-12048.md): pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser (CVSS 9.3, pgadmin.org pgAdmin)
- [CVE-2026-12047](https://cve.now/CVE-2026-12047.md): pgAdmin 4: HTML injection in cloud verify\_credentials / deploy endpoints via unsanitised SDK exception text (CVSS 3.5, pgadmin.org pgAdmin)
- [CVE-2026-12046](https://cve.now/CVE-2026-12046.md): pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update\_connection routes enables remote code execution (CVSS 9.0, pgadmin.org pgAdmin)
- [CVE-2026-12045](https://cve.now/CVE-2026-12045.md): pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution (CVSS 9.0, pgadmin.org pgAdmin)
- [CVE-2026-12050](https://cve.now/CVE-2026-12050.md): pgAdmin 4: SQL injection in named restore point endpoint (CVSS 4.3, pgadmin.org pgAdmin)
- [CVE-2026-12044](https://cve.now/CVE-2026-12044.md): pgAdmin 4: SQL injection in COMMENT ON ... IS '\<description\>' rendering across dialog templates (CVSS 8.8, pgadmin.org pgAdmin)
- [CVE-2026-56078](https://cve.now/CVE-2026-56078.md): PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor (CVSS 8.7, PraisonAI · praisonaiagents)
- [CVE-2026-56077](https://cve.now/CVE-2026-56077.md): PraisonAI - Information Disclosure via Shared MultiAgentLedger State (CVSS 7.1, PraisonAI)
- [CVE-2026-56076](https://cve.now/CVE-2026-56076.md): PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint (CVSS 8.6, PraisonAI)
- [CVE-2026-56075](https://cve.now/CVE-2026-56075.md): PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override (CVSS 8.7, PraisonAI)
- [CVE-2026-56074](https://cve.now/CVE-2026-56074.md): PraisonAI - Tool Approval Cache Bypass via Coarse-Grained Caching (CVSS 6.8, PraisonAI · praisonaiagents)
- [CVE-2026-47647](https://cve.now/CVE-2026-47647.md): Dynamics 365 Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Dynamics)
- [CVE-2026-54130](https://cve.now/CVE-2026-54130.md): M365 Copilot Information Disclosure Vulnerability (CVSS 9.8, Microsoft 365 Copilot)
- [CVE-2026-32174](https://cve.now/CVE-2026-32174.md): Azure Bot Service Elevation of Privilege Vulnerability (CVSS 7.7, Microsoft Azure AI Bot Service)
- [CVE-2026-47633](https://cve.now/CVE-2026-47633.md): Microsoft Cost Management Information Disclosure Vulnerability (CVSS 7.5, Microsoft Cost Management)
- [CVE-2026-8668](https://cve.now/CVE-2026-8668.md): Hardcoded credentials in embedded content (CVSS 2.3, Progress Chef Chef360)
- [CVE-2026-8100](https://cve.now/CVE-2026-8100.md): Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific cond (CVSS 8.6, Progress Chef Chef360)
- [CVE-2026-49205](https://cve.now/CVE-2026-49205.md): phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) (CVSS 6.5, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-54017](https://cve.now/CVE-2026-54017.md): Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal (CVSS 7.7, open-webui)
- [CVE-2026-22674](https://cve.now/CVE-2026-22674.md): Hashgraph Guardian Stored XSS via branding companyName field (CVSS 4.8, hashgraph guardian)
- [CVE-2026-49257](https://cve.now/CVE-2026-49257.md): mcp-pinot: Unauthenticated tool invocation via default oauth\_enabled=False + host 0.0.0.0 bind (CVSS 10.0, startreedata mcp-pinot · mcp-pinot-server)
- [CVE-2026-49454](https://cve.now/CVE-2026-49454.md): Relyra SAML SignatureValue not cryptographically verified -\> authentication bypass (CVSS 9.1, szTheory relyra)
- [CVE-2026-46699](https://cve.now/CVE-2026-46699.md): conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices\[bot\] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository (CVSS 7.6, conda-forge conda-smithy)
- [CVE-2026-45696](https://cve.now/CVE-2026-45696.md): OpenEXR HTJ2K decoder heap buffer over-read in ht\_undo\_impl() (DoS) (CVSS 8.3, AcademySoftwareFoundation openexr)
- [CVE-2026-44663](https://cve.now/CVE-2026-44663.md): OpenEXR: Integer overflow in the HTJ2K decoder leads to heap-buffer-overflow (CVSS 6.1, AcademySoftwareFoundation openexr)
- [CVE-2025-15661](https://cve.now/CVE-2025-15661.md): libssh2 - Heap Buffer Over-read via sftp\_symlink() in sftp.c (CVSS 8.3, libssh2)
- [CVE-2026-49252](https://cve.now/CVE-2026-49252.md): deepstream is vulnerable to prototype pollution (CVSS 9.9, deepstreamIO deepstream.io · @deepstream/server)
- [CVE-2026-49248](https://cve.now/CVE-2026-49248.md): OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar (CVSS 8.3, theonedev onedev)
- [CVE-2026-43994](https://cve.now/CVE-2026-43994.md): Coturn: Stack buffer overflow in decode\_oauth\_token\_gcm() (CVSS 8.1, coturn)
- [CVE-2026-25865](https://cve.now/CVE-2026-25865.md): Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec (CVSS 8.5, Yandex Punto Switcher)
- [CVE-2026-43915](https://cve.now/CVE-2026-43915.md): Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username (CVSS 5.4, coturn)
- [CVE-2026-56099](https://cve.now/CVE-2026-56099.md): OpenBSD mpls\_do\_error Kernel Stack Memory Disclosure via MPLS Input (CVSS 6.9, openbsd src)
- [CVE-2026-48980](https://cve.now/CVE-2026-48980.md): pam\_usb: getenv() used in PAM context allows environment variable injection into local-check logic (CVSS 6.3, mcdope pam\_usb)
- [CVE-2026-48983](https://cve.now/CVE-2026-48983.md): pam\_usb: TOCTOU race condition in pad directory creation allows symlink substitution (CVSS 5.8, mcdope pam\_usb)
- [CVE-2026-48982](https://cve.now/CVE-2026-48982.md): pam\_usb: Missing O\_EXCL on pad temp file creation allows concurrent update race (CVSS 5.8, mcdope pam\_usb)
- [CVE-2026-48981](https://cve.now/CVE-2026-48981.md): pam\_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c (CVSS 6.7, mcdope pam\_usb)
- [CVE-2026-48716](https://cve.now/CVE-2026-48716.md): nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write (CVSS 8.7, HKUDS nanobot)
- [CVE-2026-47846](https://cve.now/CVE-2026-47846.md): Bitnami Cassandra container images are affected by a retained default superuser vulnerability. (CVSS 9.8, bitnami/cassandra)
- [CVE-2026-47847](https://cve.now/CVE-2026-47847.md): Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replicatio (CVSS 5.3, bitnami/mariadb-galera)
- [CVE-2026-12390](https://cve.now/CVE-2026-12390.md): Access of resource using incompatible type ('type confusion') in AzeoTech DAQFactory (CVSS 8.4, AzeoTech DAQFactory)
- [CVE-2026-47833](https://cve.now/CVE-2026-47833.md): setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. (CVSS 6.1, Cloud Foundry Foundation bpm-release)
- [CVE-2026-48937](https://cve.now/CVE-2026-48937.md): A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a \`GOAWAY\` frame. (CVSS 5.3, nodejs node)
- [CVE-2026-55392](https://cve.now/CVE-2026-55392.md): NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s\_log\_block\_size (CVSS 6.7, nilfs-dev nilfs-utils)
- [CVE-2026-9692](https://cve.now/CVE-2026-9692.md): Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely (CVSS 5.3, HAYAJO Mojolicious::Sessions::Storable)
- [CVE-2026-54390](https://cve.now/CVE-2026-54390.md): JTL Shop \< 5.7.2 Server-Side Template Injection via Smarty Renderer (CVSS 9.3, JTL Software JTL Shop)
- [CVE-2026-48985](https://cve.now/CVE-2026-48985.md): pam\_usb: NULL Dereference Crash in pusb\_is\_loginctl\_local when loginctl Returns Empty Remote Field (CVSS 5.5, mcdope pam\_usb)
- [CVE-2026-48986](https://cve.now/CVE-2026-48986.md): pam\_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication (CVSS 4.7, mcdope pam\_usb)
- [CVE-2026-48984](https://cve.now/CVE-2026-48984.md): pam\_usb: xfree() does not call explicit\_bzero — sensitive cryptographic material may linger in freed heap (CVSS 4.7, mcdope pam\_usb)
- [CVE-2025-53114](https://cve.now/CVE-2025-53114.md): CometD has acknowledgement extension out of memory (CVSS 7.5, cometd · org.cometd.java:cometd-java-server-common)
- [CVE-2026-11982](https://cve.now/CVE-2026-11982.md): Stored XSS via missing XSS safety check in Admin2 Pages API partial validation (CVSS 5.1, grav-plugin-api)
- [CVE-2026-55237](https://cve.now/CVE-2026-55237.md): AutoGPT SignUp Page has DOM-Based XSS and Open Redirect (CVSS 8.8, Significant-Gravitas AutoGPT)
- [CVE-2026-48617](https://cve.now/CVE-2026-48617.md): A flaw in Node.js Permission Model enforcement allows Bypass via \`process.report.writeReport()\` Path Misvalidation. (CVSS 1.8, nodejs node)
- [CVE-2025-32437](https://cve.now/CVE-2025-32437.md): AutoGPT has a DoS vulnerability in MediaDurationBlock (CVSS 8.7, Significant-Gravitas AutoGPT)
- [CVE-2025-32436](https://cve.now/CVE-2025-32436.md): AutoGPT has a DoS vulnerability in AddAudioToVideoBlock (CVSS 7.1, Significant-Gravitas AutoGPT)
- [CVE-2025-32424](https://cve.now/CVE-2025-32424.md): AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock (CVSS 8.7, Significant-Gravitas AutoGPT)
- [CVE-2026-54106](https://cve.now/CVE-2026-54106.md): U.S. GAO EPDS and CBCA EDS network access control bypass (CVSS 4.7, Government Accountability Office Electronic Protest Docketi…)
- [CVE-2026-54105](https://cve.now/CVE-2026-54105.md): U.S. GAO EPDS and CBCA EDS user information disclosure (CVSS 6.9, Government Accountability Office Electronic Protest Docketi…)
- [CVE-2026-54104](https://cve.now/CVE-2026-54104.md): U.S. GAO EPDS and CBCA EDS client-based privilege escalation (CVSS 8.8, Government Accountability Office Electronic Protest Docketi…)
- [CVE-2025-32422](https://cve.now/CVE-2025-32422.md): AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock (CVSS 8.7, Significant-Gravitas AutoGPT)
- [CVE-2026-54103](https://cve.now/CVE-2026-54103.md): U.S. GAO EPDS and CBCA EDS unauthenticated password change (CVSS 9.8, Government Accountability Office Electronic Protest Docketi…)
- [CVE-2026-56020](https://cve.now/CVE-2026-56020.md): Webmin HTTP header authentication bypass (CVSS 8.1, Webmin)
- [CVE-2026-56021](https://cve.now/CVE-2026-56021.md): Webmin information disclosure via regex pattern (CVSS 5.3, Webmin)
- [CVE-2026-56022](https://cve.now/CVE-2026-56022.md): Webmin MFA bypass (CVSS 5.3, Webmin)
- [CVE-2025-32392](https://cve.now/CVE-2025-32392.md): AutoGPT has a DoS vulnerability in LoopVideoBlock (CVSS 8.7, Significant-Gravitas AutoGPT)
- [CVE-2026-55204](https://cve.now/CVE-2026-55204.md): HAProxy - NULL Pointer Dereference in hpack\_dht\_insert Function (CVSS 8.7, haproxy)
- [CVE-2026-55203](https://cve.now/CVE-2026-55203.md): HAProxy - Integer Overflow in FCGI Demux Record Length Field (CVSS 9.0, haproxy)
- [CVE-2026-55205](https://cve.now/CVE-2026-55205.md): Hermes WebUI \< 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint (CVSS 6.9, nesquena hermes-webui)
- [CVE-2026-56024](https://cve.now/CVE-2026-56024.md): WordPress WP EasyPay plugin \<= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, Saad Iqbal WP EasyPay)
- [CVE-2026-11791](https://cve.now/CVE-2026-11791.md): 389-ds-base: 389-ds-base: use-after-free in schema reload via attr\_syntax\_swap\_ht() (CVSS 5.0, Red Hat Directory Server · Red Hat Enterprise Linux)
- [CVE-2026-44691](https://cve.now/CVE-2026-44691.md): In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. (CVSS 8.4, Eclipse Foundation Eclipse Theia · @theia/debug +2)
- [CVE-2026-22551](https://cve.now/CVE-2026-22551.md): In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary (CVSS 6.7, Eclipse Foundation Eclipse Theia · @theia/ai-chat-ui +6)
- [CVE-2025-58175](https://cve.now/CVE-2025-58175.md): GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution (CVSS 6.5, org.geoserver.web:gs-web-app · org.geoserver:gs-main)
- [CVE-2025-52465](https://cve.now/CVE-2025-52465.md): GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page (CVSS 7.2, org.geoserver.web:gs-web-app · org.geoserver.web:gs-web-sec…)
- [CVE-2026-46580](https://cve.now/CVE-2026-46580.md): In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/\*.prompttemplate in a workspace were automatically loaded and (CVSS 8.4, Eclipse Foundation Eclipse Theia · @theia/ai-chat-ui +5)
- [CVE-2025-27511](https://cve.now/CVE-2025-27511.md): GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection (CVSS 7.2, org.geoserver.extension:gs-db2)
- [CVE-2026-44688](https://cve.now/CVE-2026-44688.md): In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context with (CVSS 8.4, Eclipse Foundation Eclipse Theia · @theia/ai-chat-ui +6)
- [CVE-2026-50141](https://cve.now/CVE-2026-50141.md): Woodpecker gRPC agent\_id metadata can be spoofed- cross-tenant agent impersonation (CVSS 7.1, woodpecker-ci woodpecker · go.woodpecker-ci.org/woodpeck… +2)
- [CVE-2026-9158](https://cve.now/CVE-2026-9158.md): In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dang (CVSS 5.2, Eclipse Foundation Eclipse 4diac)
- [CVE-2026-56012](https://cve.now/CVE-2026-56012.md): WordPress Media LIbrary Assistant plugin \<= 3.35 - SQL Injection vulnerability (CVSS 8.5, David Lingren Media LIbrary Assistant)
- [CVE-2026-12527](https://cve.now/CVE-2026-12527.md): A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmwar (CVSS 6.0, Shenzhen Liandian Communication Technology V380 IP Camera /…)
- [CVE-2026-12539](https://cve.now/CVE-2026-12539.md): Docker Sandboxes ICMP egress restriction bypass after daemon restart (CVSS 5.1, Docker Sandboxes)
- [CVE-2026-12039](https://cve.now/CVE-2026-12039.md): Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution (CVSS 5.7, Docker Sandboxes)
- [CVE-2026-42488](https://cve.now/CVE-2026-42488.md): x86: mismatched mapcache metadata (CVSS 8.1, Xen)
- [CVE-2026-42490](https://cve.now/CVE-2026-42490.md): domctl lock open to abuse (CVSS 6.5, Xen)
- [CVE-2026-42489](https://cve.now/CVE-2026-42489.md): domctl lock open to abuse (CVSS 5.3, Xen)
- [CVE-2026-42487](https://cve.now/CVE-2026-42487.md): x86 HVM I/O port list traversal (CVSS 7.9, Xen)
- [CVE-2026-54224](https://cve.now/CVE-2026-54224.md): Denial of Service in UBB.threads (CVSS 7.1, UBB Systems UBB.threads)
- [CVE-2026-54223](https://cve.now/CVE-2026-54223.md): Remote Code Execution via arbitrary file read and write in UBB.threads (CVSS 8.6, UBB Systems UBB.threads)
- [CVE-2026-54222](https://cve.now/CVE-2026-54222.md): Blind SQL Injection in UBB.threads (CVSS 8.6, UBB Systems UBB.threads)
- [CVE-2026-54221](https://cve.now/CVE-2026-54221.md): Reflected XSS in UBB.threads (CVSS 5.1, UBB Systems UBB.threads)
- [CVE-2026-54220](https://cve.now/CVE-2026-54220.md): Cross-Site Request Forgery in UBB.threads (CVSS 8.6, UBB Systems UBB.threads)
- [CVE-2026-54219](https://cve.now/CVE-2026-54219.md): Stored XSS in UBB.threads (CVSS 5.1, UBB Systems UBB.threads)
- [CVE-2026-11719](https://cve.now/CVE-2026-11719.md): An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protoc (CVSS 8.6, MCP Toolbox for Databases · github.com/googleapis/mcp-toolb…)
- [CVE-2026-11718](https://cve.now/CVE-2026-11718.md): An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. (CVSS 9.3, MCP Toolbox for Databases · github.com/googleapis/mcp-toolb…)
- [CVE-2026-11717](https://cve.now/CVE-2026-11717.md): An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. (CVSS 9.3, MCP Toolbox for Databases · github.com/googleapis/mcp-toolb…)
- [CVE-2026-8461](https://cve.now/CVE-2026-8461.md): Heap out-of-bounds write via odd slice\_height in FFmpeg MagicYUV decoder (CVSS 8.8, FFmpeg)
- [CVE-2026-11958](https://cve.now/CVE-2026-11958.md): Local privilege escalation in ANSSI’s DFIR-ORC (CVSS 7.3, ANSSI DFIR-ORC)
- [CVE-2026-40457](https://cve.now/CVE-2026-40457.md): Reflected XSS in LMS (CVSS 2.1, LMS)
- [CVE-2026-40456](https://cve.now/CVE-2026-40456.md): OS Command Injection in LMS (CVSS 8.6, LMS)
- [CVE-2026-40455](https://cve.now/CVE-2026-40455.md): SQL Injection in LMS (CVSS 8.6, LMS)
- [CVE-2026-56009](https://cve.now/CVE-2026-56009.md): WordPress Bricksable for Bricks Builder plugin \<= 1.6.83 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Bricksable for Bricks Builder)
- [CVE-2026-54419](https://cve.now/CVE-2026-54419.md): PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql\_query (CVSS 9.8, claudiopizzillo PIAF-HMS)
- [CVE-2026-44942](https://cve.now/CVE-2026-44942.md): libzypp .repo files can have an optional path which can lead to path traversal attacks (CVSS 6.5, SUSE libzypp)
- [CVE-2026-56007](https://cve.now/CVE-2026-56007.md): WordPress Ocean Product Sharing plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, OceanWP Ocean Product Sharing)
- [CVE-2026-8024](https://cve.now/CVE-2026-8024.md): Deserialization vulnerability in ibaPDA and ibaDatCoordinator (CVSS 9.3, ibaPDA · ibaDatCoordinator)
- [CVE-2026-8811](https://cve.now/CVE-2026-8811.md): Path traversal in PDF generation module (CVSS 7.1, SEPPmail AG Secure Email Gateway)
- [CVE-2026-50643](https://cve.now/CVE-2026-50643.md): Out‑of‑Bounds Read in 8cc (CVSS 5.1, rui314 8cc)
- [CVE-2025-10560](https://cve.now/CVE-2025-10560.md): Hardcoded cloud credentials in Worksnaps client application binaries expose production cloud resources (CVSS 9.3, Silver Leaf Technologies Worksnaps.net Worksnaps)
- [CVE-2026-2021](https://cve.now/CVE-2026-2021.md): Slideshow Gallery LITE \<= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute (CVSS 6.4, contrid Slideshow Gallery LITE)
- [CVE-2026-8039](https://cve.now/CVE-2026-8039.md): Fancy Testimonials \<= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, dijitul Fancy Testimonials)
- [CVE-2026-12111](https://cve.now/CVE-2026-12111.md): Appointment Booking Calendar \<= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter (CVSS 4.3, codepeople Appointment Booking Calendar)
- [CVE-2026-11395](https://cve.now/CVE-2026-11395.md): CF7 to Webhook \<= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host (CVSS 7.2, mariovalney CF7 to Webhook)
- [CVE-2026-12098](https://cve.now/CVE-2026-12098.md): PowerPress Podcasting plugin by Blubrry \<= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field (CVSS 6.4, PowerPress Podcasting plugin by Blubrry)
- [CVE-2026-12137](https://cve.now/CVE-2026-12137.md): SysBasics Customize My Account for WooCommerce \<= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter (CVSS 6.1, phppoet SysBasics Customize My Account for WooCommerce – Da…)
- [CVE-2026-12102](https://cve.now/CVE-2026-12102.md): UsersWP \<= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user\_id' Parameter (CVSS 2.7, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2026-12136](https://cve.now/CVE-2026-12136.md): SysBasics Customize My Account for WooCommerce \<= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, phppoet SysBasics Customize My Account for WooCommerce – Da…)
- [CVE-2026-55746](https://cve.now/CVE-2026-55746.md): Cotonti stored XSS via PFS folder title (CVSS 7.6, Cotonti · cotonti/cotonti)
- [CVE-2026-28573](https://cve.now/CVE-2026-28573.md): In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. (CVSS 10.0, Google Android)
- [CVE-2026-55745](https://cve.now/CVE-2026-55745.md): Cotonti CSRF in PFS folder edit allows unauthorized folder modification (CVSS 5.4, Cotonti · cotonti/cotonti)
- [CVE-2026-55744](https://cve.now/CVE-2026-55744.md): Cotonti CSRF in PFS allows forced arbitrary file upload (CVSS 8.1, Cotonti · cotonti/cotonti)
- [CVE-2026-55742](https://cve.now/CVE-2026-55742.md): Cotonti CSRF in admin.rights.php allows privilege escalation (CVSS 9.6, Cotonti · cotonti/cotonti)
- [CVE-2026-55741](https://cve.now/CVE-2026-55741.md): Cotonti CSRF in admin.config.php allows unauthorized configuration changes (CVSS 8.8, Cotonti)
- [CVE-2026-9815](https://cve.now/CVE-2026-9815.md): MagicForm \<= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE (CVSS 6.5, MagicForm)
- [CVE-2026-55740](https://cve.now/CVE-2026-55740.md): SQL Injection in Nur-Alam39 bus-ticket bus\_info.php via busid parameter (CVSS 9.8, Nur-Alam39 bus-ticket)
- [CVE-2026-11358](https://cve.now/CVE-2026-11358.md): Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More \<= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter (CVSS 4.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2026-11402](https://cve.now/CVE-2026-11402.md): Services Section Block \<= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute (CVSS 6.4, bplugins Services Section Block – Showcase Service Details…)
- [CVE-2026-11784](https://cve.now/CVE-2026-11784.md): Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization \<= 4.2.6 - Cross-Site Request Forgery via 'optml\_replace\_file' AJAX Action (CVSS 4.3, Optimole – Optimize Images | Convert WebP & AVIF | CDN & La…)
- [CVE-2026-12093](https://cve.now/CVE-2026-12093.md): Simple Membership \<= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook (CVSS 5.3, wpinsider-1 Simple Membership)
- [CVE-2026-10736](https://cve.now/CVE-2026-10736.md): Tutor LMS \<= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter (CVSS 4.9, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-10623](https://cve.now/CVE-2026-10623.md): PressPrimer Quiz \<= 2.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz\_id', 'item\_id', and 'rule\_id' Parameters (CVSS 4.3, PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assess…)
- [CVE-2026-11360](https://cve.now/CVE-2026-11360.md): Advanced Order Export For WooCommerce \<= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort\_direction' Parameter (CVSS 4.9, algolplus Advanced Order Export For WooCommerce)
- [CVE-2026-11357](https://cve.now/CVE-2026-11357.md): Kadence Blocks \<= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization (CVSS 4.3, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-11776](https://cve.now/CVE-2026-11776.md): Form Maker by 10Web \<= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter (CVSS 4.9, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-10029](https://cve.now/CVE-2026-10029.md): Event Koi Lite \<= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints (CVSS 5.3, eventkoi Event Koi Lite – Events Calendar, Event Management…)
- [CVE-2026-9860](https://cve.now/CVE-2026-9860.md): Offload, AI & Optimize with Cloudflare Images \<= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf\_images\_do\_setup AJAX Action (CVSS 8.8, vanyukov Offload, AI & Optimize with Cloudflare Images)
- [CVE-2026-12120](https://cve.now/CVE-2026-12120.md): FireBox Popups \<= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form\_id' Parameter (CVSS 5.3, fireplugins FireBox Popups – Increase Sales and Grow Your E…)
- [CVE-2026-11777](https://cve.now/CVE-2026-11777.md): Form Maker by 10Web \<= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter (CVSS 4.9, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-9199](https://cve.now/CVE-2026-9199.md): Equalize Digital Accessibility Checker \<= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter (CVSS 4.3, equalizedigital Equalize Digital Accessibility Checker – WC…)
- [CVE-2026-12407](https://cve.now/CVE-2026-12407.md): E2Pdf \<= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen\_action' Parameter (CVSS 8.8, oleksandrz E2Pdf – Export Pdf Tool for WordPress)
- [CVE-2026-10023](https://cve.now/CVE-2026-10023.md): Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \<= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers (CVSS 4.3, dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…)
- [CVE-2026-12505](https://cve.now/CVE-2026-12505.md): Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall (CVSS 7.8, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-12569](https://cve.now/CVE-2026-12569.md): Remote Code Execution (RCE) vulnerability in Windchill PDMlink (CVSS 9.3, KEV, PTC Windchill PDMLink · PTC FlexPLM)
- [CVE-2026-38714](https://cve.now/CVE-2026-38714.md): InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vuln (CVSS 9.8)
- [CVE-2026-38715](https://cve.now/CVE-2026-38715.md): InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vuln (CVSS 9.8)
- [CVE-2026-38716](https://cve.now/CVE-2026-38716.md): InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vuln (CVSS 9.8)
- [CVE-2026-38717](https://cve.now/CVE-2026-38717.md): InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vuln (CVSS 9.8)
- [CVE-2026-38718](https://cve.now/CVE-2026-38718.md): InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a buffer overflow vulner (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.