CVEs published June 20, 2026
44 CVEs were published on June 20, 2026: 9 critical, 9 high. 2 are now in CISA KEV.
- Published
- 44
- Critical
- 9
- High
- 9
- Medium
- 23
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 27
Most affected products
- Capgo
- 14
- Flowise
- 4
- eemitch Simple File List
- 3
- AVideo · wwbn/avideo
- 2
- Cap-go capgo
- 2
- AVideo
- 1
- AVideo · WWBN/AVideo
- 1
- capacitor-native-biometric · @capgo/capacitor-native-biomet…
- 1
- crmperks Database for Contact Form 7, WPforms, Elementor fo…
- 1
- GNU Savane
- 1
Critical 9
- CVE-2026-56345AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo EndpointAVideo · WWBN/AVideo
- CVE-2026-5366Git Argument Injection in prefecthq/prefectprefecthq/prefect
- CVE-2024-58351Flowise - Remote Code Execution via overrideConfig ParameterFlowise
- CVE-2022-50972WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.phpWooCommerce
- CVE-2019-25763WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication BypassUltimatebeaver Ultimate Addons for Beaver Builder
- CVE-2026-48908Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2joomshaper.net SP Page Builder extension for Joomla
- CVE-2026-48939Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15icagenda.com iCagenda extension for Joomla
- CVE-2026-48909Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4joomshaper.net SP LMS extension for Joomla
- CVE-2026-9265Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING pathJONASBN Crypt::OpenSSL::PKCS12
High 9
- CVE-2026-56341AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.phpAVideo · wwbn/avideo
- CVE-2026-56340vLLM - Denial of Service via Unvalidated Multimodal EmbeddingsvLLM
- CVE-2020-37255WordPress Time Capsule Plugin 1.21.16 Authentication BypassWptimecapsule Time Capsule Plugin
- CVE-2026-11911Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parametereemitch Simple File List
- CVE-2026-11912Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Actioneemitch Simple File List
- CVE-2026-9843Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Valuecrmperks Database for Contact Form 7, WPforms, Elementor fo…
- CVE-2026-56216Capgo - Scope Escalation via API Key Creation in /functions/v1/apikeyCapgo
- CVE-2026-56215Capgo - Account Merge via Poisoned public.users.email in SSO ProvisioningCapgo
- CVE-2026-56214Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPCCapgo
Medium, low and unrated 26
- CVE-2026-56355GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.GNU Savane
- CVE-2026-56347AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsWWBN AVideo · wwbn/avideo
- CVE-2026-56346AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php EndpointAVideo · wwbn/avideo
- CVE-2026-56342AVideo - Server-Side Request Forgery in Live/test.php via statsURL ParameterAVideo
- CVE-2025-71379vllm - Regular Expression Denial of Service in Multiple Componentsvllm
- CVE-2026-56332Capgo - Open Redirect via confirmation_url ParameterCapgo
- CVE-2026-56330Capgo - Open Redirect via Unvalidated Stripe Billing URLsCapgo
- CVE-2026-56319Capgo - App Existence Oracle via GET /statistics/app/:app_idCapgo
- CVE-2026-56307Cap-go - Broken Cursor Pagination in /private/devices EndpointCap-go capgo
- CVE-2026-56304picklescan - Arbitrary File Creation via logging.FileHandler Deserializationpicklescan
- CVE-2026-56295Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API KeysCapgo
- CVE-2026-56294capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceededcapacitor-native-biometric · @capgo/capacitor-native-biomet…
- CVE-2026-56282Capgo - Information Disclosure via Unauthenticated /replication EndpointCapgo
- CVE-2026-56276Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash OverrideFlowise
- CVE-2026-56267Flowise - PII Disclosure via Unauthenticated Forgot Password EndpointFlowise
- CVE-2026-56235Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC FunctionsCap-go capgo
- CVE-2026-56228Capgo - Denial of Service via Improper Password Policy Length ValidationCapgo
- CVE-2026-56227Capgo - Server-Side Request Forgery via Webhook URL ValidationCapgo
- CVE-2026-56218Capgo - EXIF Metadata Exposure via Image UploadCapgo
- CVE-2025-71331Flowise - Cross-Site Scripting in Chat Messages and Agent WorkflowsFlowise
- CVE-2026-56325Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain LookupCapgo
- CVE-2026-56317Nuxt - Cross-Site Scripting via NoScript Component Slot ContentNuxt
- CVE-2026-12673Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in liquidfiles
- CVE-2026-12119Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attributeeemitch Simple File List
- CVE-2026-56213Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPCCapgo
- CVE-2026-56212Capgo - Improper 2FA Enforcement Logic via Team Security SettingsCapgo