# CVEs published 2026-06-19

194 CVEs were published on June 19, 2026: 22 critical, 111 high. Days are UTC.

- [CVE-2026-11551](https://cve.now/CVE-2026-11551.md): Branda – White Label & Branding, Free Login Page Customizer \<= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8, wpmudev Branda – White Label & Branding, Free Login Page Cu…)
- [CVE-2026-56082](https://cve.now/CVE-2026-56082.md): Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record\_build\_time RPC (CVSS 8.7, Cap-go capgo)
- [CVE-2026-56081](https://cve.now/CVE-2026-56081.md): Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email (CVSS 9.3, Cap-go capgo)
- [CVE-2026-56080](https://cve.now/CVE-2026-56080.md): Cap-go - Authentication Logic Flaw in Enforce Password Policy (CVSS 6.9, Cap-go capgo)
- [CVE-2026-56079](https://cve.now/CVE-2026-56079.md): Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access (CVSS 7.1, Capgo)
- [CVE-2026-56073](https://cve.now/CVE-2026-56073.md): Cap-go - OTP Bypass via Response Manipulation in Email Verification (CVSS 9.3, Cap-go capgo)
- [CVE-2026-47645](https://cve.now/CVE-2026-47645.md): Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft 365 Copilot)
- [CVE-2026-48582](https://cve.now/CVE-2026-48582.md): Microsoft Exchange Online Elevation of Privilege Vulnerability (CVSS 9.6, Microsoft Exchange Online)
- [CVE-2026-50519](https://cve.now/CVE-2026-50519.md): Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft GitHub Copilot Chat)
- [CVE-2026-48584](https://cve.now/CVE-2026-48584.md): Microsoft Azure Synapse Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Azure Synapse)
- [CVE-2026-42895](https://cve.now/CVE-2026-42895.md): Microsoft Copilot Tampering Vulnerability (CVSS 6.5, Microsoft 365 Copilot)
- [CVE-2026-45480](https://cve.now/CVE-2026-45480.md): Azure Active Directory Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Active Directory)
- [CVE-2026-32208](https://cve.now/CVE-2026-32208.md): Microsoft Entra ID Spoofing Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2026-50559](https://cve.now/CVE-2026-50559.md): Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities (CVSS 7.5, quarkusio quarkus · io.quarkus:quarkus-vertx-http)
- [CVE-2026-48794](https://cve.now/CVE-2026-48794.md): Authelia has an Edge Case Access Control Rule Mismatch (CVSS 1.3, authelia · github.com/authelia/authelia +1)
- [CVE-2026-47203](https://cve.now/CVE-2026-47203.md): Authelia Missing Username Canonicalization in Basic Auth (LDAP) (CVSS 2.9, authelia · github.com/authelia/authelia/v4 +1)
- [CVE-2026-48129](https://cve.now/CVE-2026-48129.md): Kestra task inputFiles accepts traversal filenames for worker file writes (CVSS 6.5, kestra-io kestra)
- [CVE-2026-49346](https://cve.now/CVE-2026-49346.md): libde265 has a heap buffer overflow in de265\_image\_get\_buffer via SPS dimension integer overflow (CVSS 7.1, strukturag libde265)
- [CVE-2026-49295](https://cve.now/CVE-2026-49295.md): libde265 has an out-of-bounds write in process\_reference\_picture\_set via predicted short-term RPS (CVSS 7.1, strukturag libde265)
- [CVE-2026-49337](https://cve.now/CVE-2026-49337.md): libde265 has an unbounded memory leak via orphaned slice headers in \`read\_slice\_NAL\` (CVSS 4.3, strukturag libde265)
- [CVE-2026-48787](https://cve.now/CVE-2026-48787.md): gin-vue-admin vulnerable to RCE (CVSS 7.4, flipped-aurora gin-vue-admin)
- [CVE-2026-48089](https://cve.now/CVE-2026-48089.md): DevGuard has improper authorization on public assets (CVSS 7.1, l3montree-dev devguard · github.com/l3montree-dev/devguard)
- [CVE-2026-48774](https://cve.now/CVE-2026-48774.md): ProxySQL MCP run\_sql\_readonly executes side-effecting MySQL multi-statements despite read-only contract (CVSS 7.5, sysown proxysql)
- [CVE-2026-48772](https://cve.now/CVE-2026-48772.md): ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql\_query\_rules.client\_addr ACL (CVSS 10.0, sysown proxysql)
- [CVE-2026-48773](https://cve.now/CVE-2026-48773.md): ProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling (CVSS 9.8, sysown proxysql)
- [CVE-2026-49345](https://cve.now/CVE-2026-49345.md): Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF) (CVSS 5.3, sourcentis mercator)
- [CVE-2026-49344](https://cve.now/CVE-2026-49344.md): Mercator has a Personal Identifiable Information Leak from Query Executor feature (CVSS 7.1, sourcentis mercator)
- [CVE-2026-48715](https://cve.now/CVE-2026-48715.md): radvdump's Route Information Option Parser has a Stack Buffer Overflow (CVSS 7.7, radvd-project radvdump)
- [CVE-2026-49342](https://cve.now/CVE-2026-49342.md): YARD static cache reads raw traversal paths before router sanitization (CVSS 5.3, lsegal yard · yard)
- [CVE-2026-49340](https://cve.now/CVE-2026-49340.md): gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host (CVSS 8.1, sentriz gonic · go.senan.xyz/gonic)
- [CVE-2026-49338](https://cve.now/CVE-2026-49338.md): Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) (CVSS 7.1, sentriz gonic · go.senan.xyz/gonic)
- [CVE-2026-27878](https://cve.now/CVE-2026-27878.md): Tempo TraceQL query with exemplar hint could result in unbounded memory usage (CVSS 6.5, Grafana Enterprise Traces · Grafana Tempo +1)
- [CVE-2026-12726](https://cve.now/CVE-2026-12726.md): Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses\_url exfiltrates pat credential (CVSS 6.3, Red Hat Ansible Automation Platform)
- [CVE-2026-12238](https://cve.now/CVE-2026-12238.md): WP Go Maps \<= 10.1.01 - Unauthenticated Arbitrary Record Creation (CVSS 5.3, wpgmaps WP Go Maps – Google Map, OpenStreetMap, Leaflet Map)
- [CVE-2026-49339](https://cve.now/CVE-2026-49339.md): Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist (CVSS 7.1, sentriz gonic · go.senan.xyz/gonic)
- [CVE-2026-49336](https://cve.now/CVE-2026-49336.md): @microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter (CVSS 5.5, microsoft kiota-typescript · @microsoft/kiota-http-fetchlib…)
- [CVE-2026-49293](https://cve.now/CVE-2026-49293.md): CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals (CVSS 7.5, sunnyadn js-toml · js-toml)
- [CVE-2026-49288](https://cve.now/CVE-2026-49288.md): Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources (CVSS 4.3, statamic cms · statamic/cms)
- [CVE-2026-49291](https://cve.now/CVE-2026-49291.md): mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call (CVSS 8.1, doobidoo mcp-memory-service · mcp-memory-service)
- [CVE-2023-54357](https://cve.now/CVE-2023-54357.md): Joomla com\_booking 2.4.9 Information Disclosure via Account Enumeration (CVSS 8.7, Artio Joomla! com\_booking component)
- [CVE-2019-25762](https://cve.now/CVE-2019-25762.md): Joomla! Component JoomProject 1.1.3.2 Information Disclosure (CVSS 8.7, Joomboost JoomProject)
- [CVE-2019-25761](https://cve.now/CVE-2019-25761.md): Joomla! Component JoomCRM 1.1.1 SQL Injection via deal\_id (CVSS 7.1, Joomboost JoomCRM)
- [CVE-2019-25760](https://cve.now/CVE-2019-25760.md): Joomla! Component Easy Shop 1.2.3 Local File Inclusion (CVSS 6.9, Joomtech Easy Shop)
- [CVE-2019-25759](https://cve.now/CVE-2019-25759.md): Joomla! Component vBizz 1.0.7 SQL Injection (CVSS 7.1, Wdmtech vBizz)
- [CVE-2026-49287](https://cve.now/CVE-2026-49287.md): Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction (CVSS 7.4, statamic cms · statamic/cms)
- [CVE-2019-25758](https://cve.now/CVE-2019-25758.md): Joomla! Component vBizz 1.0.7 Remote Code Execution (CVSS 8.7, Wdmtech vBizz)
- [CVE-2019-25757](https://cve.now/CVE-2019-25757.md): Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter (CVSS 7.1, Wdmtech vWishlist)
- [CVE-2026-49290](https://cve.now/CVE-2026-49290.md): Slopsmith has path traversal in archive extractors that allows arbitrary file write → potential RCE (CVSS 7.6, byrongamatos slopsmith)
- [CVE-2019-25756](https://cve.now/CVE-2019-25756.md): Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard (CVSS 8.8, Wdmtech vAccount)
- [CVE-2019-25755](https://cve.now/CVE-2019-25755.md): Joomla vReview 1.9.11 SQL Injection via editReview (CVSS 8.8, Wdmtech vReview)
- [CVE-2019-25754](https://cve.now/CVE-2019-25754.md): Joomla vRestaurant 1.9.4 SQL Injection via menu-listing-layout (CVSS 8.8, Wdmtech vRestaurant)
- [CVE-2019-25753](https://cve.now/CVE-2019-25753.md): Joomla! Component VMap 1.9.6 SQL Injection via loadmarker (CVSS 8.8, Wdmtech VMap)
- [CVE-2026-49271](https://cve.now/CVE-2026-49271.md): libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (CVSS 6.5, strukturag libheif)
- [CVE-2019-25752](https://cve.now/CVE-2019-25752.md): Joomla! Component J-BusinessDirectory 4.9.7 SQL Injection (CVSS 8.8, Cmsjunkie J-BusinessDirectory)
- [CVE-2019-25751](https://cve.now/CVE-2019-25751.md): Joomla J-ClassifiedsManager 3.0.5 SQL Injection (CVSS 8.8, Cmsjunkie ClassifiedsManager)
- [CVE-2019-25750](https://cve.now/CVE-2019-25750.md): Joomla J-MultipleHotelReservation 6.0.7 SQL Injection (CVSS 8.8, Cmsjunkie MultipleHotelReservation)
- [CVE-2026-49359](https://cve.now/CVE-2026-49359.md): PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option (CVSS 6.5, pontedilana php-weasyprint · pontedilana/php-weasyprint)
- [CVE-2019-25749](https://cve.now/CVE-2019-25749.md): Joomla J-CruisePortal 6.0.4 SQL Injection via cruises (CVSS 7.1, Cmsjunkie J-CruisePortal)
- [CVE-2026-49286](https://cve.now/CVE-2026-49286.md): PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass) (CVSS 8.1, pontedilana php-weasyprint · pontedilana/php-weasyprint)
- [CVE-2019-25748](https://cve.now/CVE-2019-25748.md): Joomla JHotelReservation 6.0.7 SQL Injection via search-hotels (CVSS 8.8, Cmsjunkie JHotelReservation)
- [CVE-2026-49260](https://cve.now/CVE-2026-49260.md): PhpWeasyPrint: shell command injection via configurable WeasyPrint binary path due to inverted is\_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc) (CVSS 8.2, pontedilana php-weasyprint · pontedilana/php-weasyprint)
- [CVE-2017-20282](https://cve.now/CVE-2017-20282.md): Joomla! Component jCart for OpenCart 2.0 SQL Injection (CVSS 8.8, Soft-Php jCart for OpenCart)
- [CVE-2017-20281](https://cve.now/CVE-2017-20281.md): Joomla! Component Extra Search 2.2.8 SQL Injection (CVSS 8.8, Joomlaboat Extra Search)
- [CVE-2017-20280](https://cve.now/CVE-2017-20280.md): Joomla Component Myportfolio 3.0.2 SQL Injection via pid Parameter (CVSS 8.8, Myportfolio)
- [CVE-2017-20279](https://cve.now/CVE-2017-20279.md): Joomla Payage 2.05 SQL Injection via aid Parameter (CVSS 8.8, Extensions Joomla Payage)
- [CVE-2017-20278](https://cve.now/CVE-2017-20278.md): Joomla JoomRecipe 1.0.3 SQL Injection via category parameter (CVSS 8.8, Joomboost JoomRecipe)
- [CVE-2017-20277](https://cve.now/CVE-2017-20277.md): Joomla JoomRecipe 1.0.4 Component Blind SQL Injection via search\_author (CVSS 8.8, Joomboost Joomla JoomRecipe)
- [CVE-2017-20276](https://cve.now/CVE-2017-20276.md): Joomla! Component SIMGenealogy 2.1.5 SQL Injection (CVSS 8.8, Simbunch SIMGenealogy)
- [CVE-2017-20275](https://cve.now/CVE-2017-20275.md): Joomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter (CVSS 8.8, Henryschorradt Bridge)
- [CVE-2017-20274](https://cve.now/CVE-2017-20274.md): Joomla LMS King Professional 3.2.4.0 SQL Injection via learningpath (CVSS 8.8, King-products LMS King Professional)
- [CVE-2026-56211](https://cve.now/CVE-2026-56211.md): Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames (CVSS 7.1, Red Hat Enterprise Linux AI 3.3 for RHEL · Red Hat Enter… +6)
- [CVE-2026-56210](https://cve.now/CVE-2026-56210.md): Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl\_set\_layer\_id (CVSS 7.1, Red Hat Enterprise Linux AI 3.3 for RHEL · Red Hat Enter… +6)
- [CVE-2026-56208](https://cve.now/CVE-2026-56208.md): Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode (CVSS 7.6, Red Hat Enterprise Linux 10.0 Extended Update Support ·… +4)
- [CVE-2026-56209](https://cve.now/CVE-2026-56209.md): Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack (CVSS 7.1, Red Hat Enterprise Linux AI 3.3 for RHEL · Red Hat Enter… +6)
- [CVE-2017-20273](https://cve.now/CVE-2017-20273.md): Joomla Event Registration Pro Calendar 4.1.3 SQL Injection (CVSS 8.8, Joomlashowroom Event Registration Pro Calendar)
- [CVE-2017-20272](https://cve.now/CVE-2017-20272.md): Joomla Ultimate Property Listing 1.0.2 SQL Injection via sf\_selectuser\_id (CVSS 8.8, Faboba Ultimate Property Listing)
- [CVE-2026-3195](https://cve.now/CVE-2026-3195.md): Qemu-kvm: virtio-snd: heap buffer overflow in virtio\_snd\_pcm\_in\_cb (incomplete fix for cve-2024-7730) (CVSS 7.4, qemu · Red Hat Enterprise Linux +1)
- [CVE-2026-3196](https://cve.now/CVE-2026-3196.md): Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation (CVSS 5.5, qemu · Red Hat Enterprise Linux +1)
- [CVE-2017-20271](https://cve.now/CVE-2017-20271.md): Joomla StreetGuessr Game 1.1.8 SQL Injection via catid (CVSS 8.8, Nordmograph StreetGuessr Game)
- [CVE-2017-20270](https://cve.now/CVE-2017-20270.md): Joomla! Component Twitch Tv 1.1 SQL Injection (CVSS 8.8, Raindropsinfotech Twitch Tv)
- [CVE-2017-20269](https://cve.now/CVE-2017-20269.md): Joomla! Component KissGallery 1.0.0 SQL Injection (CVSS 8.8, Terrywcarter KissGallery)
- [CVE-2017-20268](https://cve.now/CVE-2017-20268.md): Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection (CVSS 8.8, Zcontent Zap Calendar Lite)
- [CVE-2017-20267](https://cve.now/CVE-2017-20267.md): Joomla! Component Calendar Planner 1.0.1 SQL Injection (CVSS 8.8, Joomlathat Calendar Planner)
- [CVE-2017-20266](https://cve.now/CVE-2017-20266.md): Joomla SP Movie Database 1.3 SQL Injection via searchword (CVSS 8.8, Joomshaper SP Movie Database)
- [CVE-2017-20265](https://cve.now/CVE-2017-20265.md): Joomla! Component Flip Wall 8.0 SQL Injection (CVSS 7.1, Pulseextensions Flip Wall)
- [CVE-2026-12620](https://cve.now/CVE-2026-12620.md): Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server (CVSS 4.6, Microchip GridTime)
- [CVE-2017-20264](https://cve.now/CVE-2017-20264.md): Joomla! Component Sponsor Wall 8.0 SQL Injection (CVSS 7.1, Pulseextensions Sponsor Wall)
- [CVE-2017-20263](https://cve.now/CVE-2017-20263.md): Joomla! FocalPoint Pro Free 1.2.3 SQL Injection via location (CVSS 8.8, Focalpointx FocalPoint Pro / Free)
- [CVE-2026-12621](https://cve.now/CVE-2026-12621.md): Cross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server (CVSS 5.3, Microchip GridTime)
- [CVE-2017-20262](https://cve.now/CVE-2017-20262.md): Joomla! Component Ajax Quiz 1.8 SQL Injection (CVSS 8.8, Webkul Ajax Quiz)
- [CVE-2026-12622](https://cve.now/CVE-2026-12622.md): Open Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time Server (CVSS 5.3, Microchip GridTime)
- [CVE-2017-20261](https://cve.now/CVE-2017-20261.md): Joomla! Component Bargain Product VM3 1.0 SQL Injection (CVSS 8.8, Weborange Bargain Product VM3)
- [CVE-2017-20260](https://cve.now/CVE-2017-20260.md): Joomla! Component Price Alert 3.0.2 SQL Injection (CVSS 8.8, Weborange Price Alert)
- [CVE-2017-20259](https://cve.now/CVE-2017-20259.md): Joomla OSDownloads 1.7.4 SQL Injection via item view (CVSS 8.8, Joomlashack OSDownloads)
- [CVE-2026-12619](https://cve.now/CVE-2026-12619.md): GridTime™ 3000 GNSS Time Server CSRF to XSS (CVSS 5.1, Microchip GridTime)
- [CVE-2017-20258](https://cve.now/CVE-2017-20258.md): Joomla! Component RPC Responsive Portfolio 1.6.1 SQL Injection (CVSS 8.8, Extro RPC)
- [CVE-2017-20257](https://cve.now/CVE-2017-20257.md): Joomla! Component Quiz Deluxe 3.7.4 SQL Injection (CVSS 8.8, Joomplace Quiz Deluxe)
- [CVE-2017-20256](https://cve.now/CVE-2017-20256.md): Joomla Survey Force Deluxe 3.2.4 SQL Injection via invite Parameter (CVSS 8.8, Joomplace Survey Force Deluxe)
- [CVE-2017-20255](https://cve.now/CVE-2017-20255.md): Joomla! Component JB Visa 1.0 SQL Injection via visatype (CVSS 8.8, Joombooking JB Visa)
- [CVE-2017-20254](https://cve.now/CVE-2017-20254.md): Joomla! Component User Bench 1.0 SQL Injection via userid (CVSS 8.8, Gegabyte User Bench)
- [CVE-2017-20253](https://cve.now/CVE-2017-20253.md): Joomla! Component My Projects 2.0 SQL Injection (CVSS 8.8, Gegabyte My Projects)
- [CVE-2017-20252](https://cve.now/CVE-2017-20252.md): Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter (CVSS 8.8, nextgeneditor NextGen Editor)
- [CVE-2026-49358](https://cve.now/CVE-2026-49358.md): PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles (CVSS 3.0, pontedilana php-weasyprint · pontedilana/php-weasyprint)
- [CVE-2026-21768](https://cve.now/CVE-2026-21768.md): HCL Verse for Android is susceptible to an injection vulnerability (CVSS 6.3, HCLSoftware Verse for Android)
- [CVE-2026-52910](https://cve.now/CVE-2026-52910.md): bpf: Free reuseport cBPF prog after RCU grace period. (CVSS 7.8, Linux)
- [CVE-2026-52909](https://cve.now/CVE-2026-52909.md): ip6\_vti: set netns\_immutable on the fallback device. (CVSS 7.8, Linux)
- [CVE-2025-71326](https://cve.now/CVE-2025-71326.md): AVAST Antivirus 25.11 Unquoted Service Path Privilege Escalation (CVSS 8.5, AVAST Antivirus)
- [CVE-2023-54353](https://cve.now/CVE-2023-54353.md): Chromacam 4.0.3.0 Unquoted Service Path Privilege Escalation (CVSS 8.5, Personifyinc Chromacam)
- [CVE-2022-50971](https://cve.now/CVE-2022-50971.md): Malwarebytes 4.5 Unquoted Service Path Privilege Escalation (CVSS 8.5, Malwarebytes)
- [CVE-2021-47985](https://cve.now/CVE-2021-47985.md): Brother SAPSprint 7.60 Unquoted Service Path Privilege Escalation (CVSS 8.5, Brother SAPSprint)
- [CVE-2020-37254](https://cve.now/CVE-2020-37254.md): Wondershare PDFelement 5.2.9 Privilege Escalation via Unquoted Service Path (CVSS 8.5, Wondershare PDFelement)
- [CVE-2020-37253](https://cve.now/CVE-2020-37253.md): Winstep 18.06.0096 Unquoted Service Path Privilege Escalation (CVSS 8.5, Winstep)
- [CVE-2020-37252](https://cve.now/CVE-2020-37252.md): Realtek Audio Service 1.0.0.55 Unquoted Service Path Privilege Escalation (CVSS 8.5, Realtek Audio Service)
- [CVE-2020-37251](https://cve.now/CVE-2020-37251.md): RealTimes Desktop Service 18.1.4 Unquoted Service Path Privilege Escalation (CVSS 8.5, RealTimes Desktop Service)
- [CVE-2020-37250](https://cve.now/CVE-2020-37250.md): TFTP Broadband 4.3.0.1465 Unquoted Service Path Privilege Escalation (CVSS 8.5, Weird-Solutions TFTP Broadband)
- [CVE-2019-25747](https://cve.now/CVE-2019-25747.md): Network Inventory Advisor 5.0.26.0 Unquoted Service Path Privilege Escalation (CVSS 8.5, Network-Inventory-Advisor Network Inventory Advisor)
- [CVE-2016-20095](https://cve.now/CVE-2016-20095.md): Matrix42 Remote Control Host 3.20.0031 Unquoted Path Privilege Escalation (CVSS 8.5, Matrix42 Remote Control Host)
- [CVE-2016-20094](https://cve.now/CVE-2016-20094.md): AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege (CVSS 8.5, AnyDesk)
- [CVE-2016-20093](https://cve.now/CVE-2016-20093.md): Wise Care 365 4.27 and Wise Disk Cleaner 9.29 Unquoted Service Path Privilege Escalation (CVSS 8.5, Wisecleaner Wise Care · Wisecleaner Wise Disk Cleaner)
- [CVE-2016-20092](https://cve.now/CVE-2016-20092.md): NetDrive 2.6.12 Unquoted Service Path Elevation of Privilege (CVSS 8.5, NetDrive)
- [CVE-2016-20091](https://cve.now/CVE-2016-20091.md): Windows Firewall Control 4.8.6.0 Unquoted Service Path Privilege Escalation (CVSS 8.5, Binisoft Windows Firewall Control)
- [CVE-2016-20090](https://cve.now/CVE-2016-20090.md): Comodo Dragon Browser 52.15.25.663 Privilege Escalation via Unquoted Service Path (CVSS 8.5, Comodo Dragon Browser)
- [CVE-2016-20089](https://cve.now/CVE-2016-20089.md): Iperius Remote 1.7.0 Unquoted Service Path Elevation of Privilege (CVSS 8.5, Iperiusremote Iperius Remote)
- [CVE-2016-20088](https://cve.now/CVE-2016-20088.md): Comodo Chromodo Browser 52.15.25.664 Unquoted Service Path Privilege Escalation (CVSS 8.5, Comodo Chromodo Browser)
- [CVE-2016-20087](https://cve.now/CVE-2016-20087.md): Fortitude HTTP 1.0.4.0 Unquoted Service Path Elevation of Privilege (CVSS 8.5, Networkdls Fortitude HTTP)
- [CVE-2016-20086](https://cve.now/CVE-2016-20086.md): Vembu StoreGrid 4.0 Unquoted Service Path Privilege Escalation (CVSS 8.5, Vembu StoreGrid)
- [CVE-2016-20085](https://cve.now/CVE-2016-20085.md): Realtek High Definition Audio Driver 6.0.1.6730 Privilege Escalation (CVSS 8.5, Realtek High Definition Audio Driver)
- [CVE-2026-52908](https://cve.now/CVE-2026-52908.md): RDMA: During rereg\_mr ensure that REREG\_ACCESS is compatible (CVSS 7.8, Linux)
- [CVE-2026-9143](https://cve.now/CVE-2026-9143.md): Incorrect Conversion between Numeric Types in NI grpc-device due to missing range checks in CodeGen (CVSS 3.7, NI grpc-device · NI InstrumentStudio)
- [CVE-2026-12104](https://cve.now/CVE-2026-12104.md): Authenticated OS Command Injection in Bondix (CVSS 8.6, SIMA Bondix Server)
- [CVE-2026-9142](https://cve.now/CVE-2026-9142.md): Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present (CVSS 9.1, NI grpc-device · NI InstrumentStudio)
- [CVE-2026-48141](https://cve.now/CVE-2026-48141.md): Memory leak in NI grpc-device BeginSidebandStream (CVSS 5.3, NI grpc-device · NI InstrumentStudio)
- [CVE-2026-48140](https://cve.now/CVE-2026-48140.md): Unchecked enum cast vulnerability in NI grpc-device in BeginSidebandStream (CVSS 6.5, NI grpc-device · NI InstrumentStudio)
- [CVE-2026-48139](https://cve.now/CVE-2026-48139.md): NULL pointer dereference vulnerability in NI grpc-device data moniker service (CVSS 7.5, NI grpc-device · NI InstrumentStudio)
- [CVE-2026-49872](https://cve.now/CVE-2026-49872.md): Apache APISIX: Improper authentication in cas-auth plugin (CVSS 5.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-49871](https://cve.now/CVE-2026-49871.md): Apache APISIX: cas-auth login CSRF / session injection issue (CVSS 2.1, Apache Software Foundation Apache APISIX)
- [CVE-2026-47341](https://cve.now/CVE-2026-47341.md): Apache APISIX: Session replay issue in hmac-auth (CVSS 6.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-48895](https://cve.now/CVE-2026-48895.md): Apache APISIX: Cas-auth Host header influence on CAS service URL (CVSS 2.1, Apache Software Foundation Apache APISIX)
- [CVE-2026-48138](https://cve.now/CVE-2026-48138.md): Out-of-bounds read vulnerability in the NI grpc-device streaming API (CVSS 7.5, NI grpc-device · NI InstrumentStudio)
- [CVE-2026-4027](https://cve.now/CVE-2026-4027.md): FlexNet Manager Suite Attachment File Disclosure (CVSS 7.1, Flexera FlexNet Manager Suite)
- [CVE-2026-49231](https://cve.now/CVE-2026-49231.md): Apache APISIX: Identity spoofing issue in APISIX opa plugin (CVSS 2.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-49230](https://cve.now/CVE-2026-49230.md): Apache APISIX: Authentication bypass in jwe-decrypt (CVSS 6.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-44915](https://cve.now/CVE-2026-44915.md): Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value (CVSS 2.1, Apache Software Foundation Apache APISIX)
- [CVE-2026-44087](https://cve.now/CVE-2026-44087.md): Apache APISIX: Openid-connect plugin Identity Header Spoofing (CVSS 5.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-49357](https://cve.now/CVE-2026-49357.md): Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication (CVSS 8.8, dtwang line-desktop-mcp · line-desktop-mcp)
- [CVE-2026-47339](https://cve.now/CVE-2026-47339.md): Apache APISIX: authz-casdoor incorrect session sharing (CVSS 5.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-44046](https://cve.now/CVE-2026-44046.md): Apache APISIX: wolf-rbac plugin Identity Spoofing (CVSS 2.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-39999](https://cve.now/CVE-2026-39999.md): Apache APISIX: JWT Algorithm Confusion allows authentication bypass (CVSS 7.0, Apache Software Foundation Apache APISIX)
- [CVE-2026-48137](https://cve.now/CVE-2026-48137.md): Untrusted pointer dereference in NI grpc-device sideband streaming API (CVSS 9.1, NI grpc-device · NI InstrumentStudio)
- [CVE-2026-39998](https://cve.now/CVE-2026-39998.md): Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup (CVSS 5.8, Apache Software Foundation Apache APISIX)
- [CVE-2026-4026](https://cve.now/CVE-2026-4026.md): FlexNet Manager Suite Privilege Escalation Vulnerability (CVSS 8.7, Flexera FlexNet Manager Suite)
- [CVE-2026-44939](https://cve.now/CVE-2026-44939.md): Command injection through unsanitized YAML parameter in Rancher (CVSS 9.4, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2026-50242](https://cve.now/CVE-2026-50242.md): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via di (CVSS 10.0, JetBrains Hub)
- [CVE-2026-56142](https://cve.now/CVE-2026-56142.md): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by atta (CVSS 9.6, JetBrains Hub)
- [CVE-2026-56141](https://cve.now/CVE-2026-56141.md): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predict (CVSS 9.8, JetBrains Hub)
- [CVE-2026-53915](https://cve.now/CVE-2026-53915.md): In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration (CVSS 7.1, JetBrains GoLand)
- [CVE-2026-12706](https://cve.now/CVE-2026-12706.md): Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode\_move() (CVSS 6.5, Red Hat Enterprise Linux AI (RHEL AI) · Red Hat OpenShift AI)
- [CVE-2026-11941](https://cve.now/CVE-2026-11941.md): Use-after-free in connection ID iterator and FFI functions (CVSS 5.6, Cloudflare Quiche · quiche)
- [CVE-2026-41156](https://cve.now/CVE-2026-41156.md): GPU DDK - kernel\<-\>fw CCB contains SYNC\_PRIMITIVE\_BLOCK firmware address without holding reference (CVSS 7.7, Imagination Technologies Graphics DDK)
- [CVE-2026-34192](https://cve.now/CVE-2026-34192.md): GPU DDK - \_MMU\_AllocLevel error recovery paths leave dangling page table entries (CVSS 7.7, Imagination Technologies Graphics DDK)
- [CVE-2026-8296](https://cve.now/CVE-2026-8296.md): In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts. (CVSS 5.6, Octopus Deploy Octopus Server)
- [CVE-2026-11576](https://cve.now/CVE-2026-11576.md): The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared clean (CVSS 7.5, Eclipse Foundation Eclipse ThreadX - NetX Duo)
- [CVE-2026-56138](https://cve.now/CVE-2026-56138.md): Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files (CVSS 5.3, ail-project ail-framework)
- [CVE-2026-46461](https://cve.now/CVE-2026-46461.md): Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. (CVSS 7.8, Dell Server Hardware Manager)
- [CVE-2026-6798](https://cve.now/CVE-2026-6798.md): 2Download Connector for 2DL Hosted Checkout \<= 0.1.5 - Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload\_email' Parameter (CVSS 5.3, 2Download Connector for 2DL Hosted Checkout)
- [CVE-2026-3640](https://cve.now/CVE-2026-3640.md): STRABL \<= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint (CVSS 5.3, strablengineering STRABL – A checkout solution)
- [CVE-2026-9822](https://cve.now/CVE-2026-9822.md): WP Hotel Booking \< 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers (CVSS 6.5, WP Hotel Booking)
- [CVE-2026-54414](https://cve.now/CVE-2026-54414.md): FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover (CVSS 9.8, error311 FileRise)
- [CVE-2026-7515](https://cve.now/CVE-2026-7515.md): BetterDocs Pro \<= 3.8.0 - Unauthenticated Local File Inclusion via doc\_style (CVSS 9.8, BetterDocs Pro)
- [CVE-2025-7737](https://cve.now/CVE-2025-7737.md): DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform (CVSS 8.6, Hitachi Virtual Storage Platform E990, E1090, E1090H · H… +4)
- [CVE-2026-12644](https://cve.now/CVE-2026-12644.md): Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.proto (CVSS 6.9, ts-deepmerge)
- [CVE-2026-10720](https://cve.now/CVE-2026-10720.md): MicroCeph path traversal issue in the remote-import API (CVSS 5.1, Canonical Microceph · github.com/canonical/microceph/microc…)
- [CVE-2026-12430](https://cve.now/CVE-2026-12430.md): Blocksy Companion \<= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product\_description' Parameter (CVSS 4.4, creativethemeshq Blocksy Companion)
- [CVE-2026-10034](https://cve.now/CVE-2026-10034.md): WP DSGVO Tools (GDPR) \<= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process\_now/is\_ajax Parameters) (CVSS 5.3, legalweb WP DSGVO Tools)
- [CVE-2026-8713](https://cve.now/CVE-2026-8713.md): Avada (Fusion) Builder \<= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value (CVSS 9.1, themefusion Avada (Fusion) Builder)
- [CVE-2026-8118](https://cve.now/CVE-2026-8118.md): Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source (CVSS 6.5, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-11989](https://cve.now/CVE-2026-11989.md): Bit integrations \<= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping (CVSS 6.5, bitpressadmin Bit integrations – Form Integration, Webhook,…)
- [CVE-2026-4328](https://cve.now/CVE-2026-4328.md): Advanced Import: One-Click Demo Import for WordPress \<= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo\_file' Parameter (CVSS 6.4, addonspress Advanced Import)
- [CVE-2026-9013](https://cve.now/CVE-2026-9013.md): Bogo \<= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API (CVSS 4.3, rocklobsterinc Bogo)
- [CVE-2026-12157](https://cve.now/CVE-2026-12157.md): BetterDocs \<= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute (CVSS 6.4, wpdevteam BetterDocs – AI Documentation, Knowledge Base, D…)
- [CVE-2026-7547](https://cve.now/CVE-2026-7547.md): Woosa \<= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read via 'log\_file' Parameter (CVSS 4.9, teamwsa Woosa – Marktplaats for WooCommerce)
- [CVE-2026-1856](https://cve.now/CVE-2026-1856.md): Appointment Booking Calendar \<= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label (CVSS 6.4, Creavi Appointment Booking Calendar)
- [CVE-2026-11752](https://cve.now/CVE-2026-11752.md): A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve cont (CVSS 5.9, LY Armeria · com.linecorp.armeria:armeria-xds)
- [CVE-2026-10779](https://cve.now/CVE-2026-10779.md): Classified Listing \<= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters) (CVSS 4.3, techlabpro1 Classified Listing – AI-Powered Classified ads…)
- [CVE-2026-56132](https://cve.now/CVE-2026-56132.md): In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mis (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-56131](https://cve.now/CVE-2026-56131.md): libexpat before 2.8.2 lacks handler call depth tracking for calls to XML\_ResumeParser from within handlers in cases of a policy violation. (CVSS 4.9, libexpat project libexpat)
- [CVE-2026-8806](https://cve.now/CVE-2026-8806.md): Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module (CVSS 8.7, Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet…)
- [CVE-2026-11775](https://cve.now/CVE-2026-11775.md): User Admin Simplifier \<= 3.0.0 - Cross-Site Request Forgery (CVSS 4.3, adamsilverstein User Admin Simplifier)
- [CVE-2026-8805](https://cve.now/CVE-2026-8805.md): Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series EtherNet/IP module (CVSS 8.7, Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP…)
- [CVE-2025-62821](https://cve.now/CVE-2025-62821.md): Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry\_GetDataSize can return success while leaving t (CVSS 9.1)
- [CVE-2026-51843](https://cve.now/CVE-2026-51843.md): Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the wanMTU parameter. (CVSS 9.8)
- [CVE-2026-51844](https://cve.now/CVE-2026-51844.md): Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the cloneType parameter. (CVSS 9.8)
- [CVE-2026-51845](https://cve.now/CVE-2026-51845.md): Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the mac parameter. (CVSS 9.8)
- [CVE-2026-51846](https://cve.now/CVE-2026-51846.md): In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack buffer overflow vulnerability that can le (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.