# CVEs published 2026-06-20

44 CVEs were published on June 20, 2026: 9 critical, 9 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-56355](https://cve.now/CVE-2026-56355.md): GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization. (CVSS 3.7, GNU Savane)
- [CVE-2026-56347](https://cve.now/CVE-2026-56347.md): AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-56346](https://cve.now/CVE-2026-56346.md): AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint (CVSS 6.9, AVideo · wwbn/avideo)
- [CVE-2026-56345](https://cve.now/CVE-2026-56345.md): AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint (CVSS 9.2, AVideo · WWBN/AVideo)
- [CVE-2026-56342](https://cve.now/CVE-2026-56342.md): AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter (CVSS 6.1, AVideo)
- [CVE-2026-56341](https://cve.now/CVE-2026-56341.md): AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php (CVSS 8.7, AVideo · wwbn/avideo)
- [CVE-2026-56340](https://cve.now/CVE-2026-56340.md): vLLM - Denial of Service via Unvalidated Multimodal Embeddings (CVSS 8.7, vLLM)
- [CVE-2025-71379](https://cve.now/CVE-2025-71379.md): vllm - Regular Expression Denial of Service in Multiple Components (CVSS 5.3, vllm)
- [CVE-2026-5366](https://cve.now/CVE-2026-5366.md): Git Argument Injection in prefecthq/prefect (CVSS 9.9, prefecthq/prefect)
- [CVE-2026-56332](https://cve.now/CVE-2026-56332.md): Capgo - Open Redirect via confirmation\_url Parameter (CVSS 5.1, Capgo)
- [CVE-2026-56330](https://cve.now/CVE-2026-56330.md): Capgo - Open Redirect via Unvalidated Stripe Billing URLs (CVSS 4.8, Capgo)
- [CVE-2026-56319](https://cve.now/CVE-2026-56319.md): Capgo - App Existence Oracle via GET /statistics/app/:app\_id (CVSS 5.3, Capgo)
- [CVE-2026-56307](https://cve.now/CVE-2026-56307.md): Cap-go - Broken Cursor Pagination in /private/devices Endpoint (CVSS 5.3, Cap-go capgo)
- [CVE-2026-56304](https://cve.now/CVE-2026-56304.md): picklescan - Arbitrary File Creation via logging.FileHandler Deserialization (CVSS 6.9, picklescan)
- [CVE-2026-56295](https://cve.now/CVE-2026-56295.md): Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys (CVSS 5.3, Capgo)
- [CVE-2026-56294](https://cve.now/CVE-2026-56294.md): capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded (CVSS 4.3, capacitor-native-biometric · @capgo/capacitor-native-biomet…)
- [CVE-2026-56282](https://cve.now/CVE-2026-56282.md): Capgo - Information Disclosure via Unauthenticated /replication Endpoint (CVSS 6.9, Capgo)
- [CVE-2026-56276](https://cve.now/CVE-2026-56276.md): Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override (CVSS 6.0, Flowise)
- [CVE-2026-56267](https://cve.now/CVE-2026-56267.md): Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint (CVSS 6.9, Flowise)
- [CVE-2026-56235](https://cve.now/CVE-2026-56235.md): Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions (CVSS 6.9, Cap-go capgo)
- [CVE-2026-56228](https://cve.now/CVE-2026-56228.md): Capgo - Denial of Service via Improper Password Policy Length Validation (CVSS 6.9, Capgo)
- [CVE-2026-56227](https://cve.now/CVE-2026-56227.md): Capgo - Server-Side Request Forgery via Webhook URL Validation (CVSS 5.3, Capgo)
- [CVE-2026-56218](https://cve.now/CVE-2026-56218.md): Capgo - EXIF Metadata Exposure via Image Upload (CVSS 6.9, Capgo)
- [CVE-2025-71331](https://cve.now/CVE-2025-71331.md): Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows (CVSS 5.1, Flowise)
- [CVE-2026-56325](https://cve.now/CVE-2026-56325.md): Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup (CVSS 2.3, Capgo)
- [CVE-2026-56317](https://cve.now/CVE-2026-56317.md): Nuxt - Cross-Site Scripting via NoScript Component Slot Content (CVSS 2.3, Nuxt)
- [CVE-2024-58351](https://cve.now/CVE-2024-58351.md): Flowise - Remote Code Execution via overrideConfig Parameter (CVSS 9.3, Flowise)
- [CVE-2022-50972](https://cve.now/CVE-2022-50972.md): WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php (CVSS 9.3, WooCommerce)
- [CVE-2020-37255](https://cve.now/CVE-2020-37255.md): WordPress Time Capsule Plugin 1.21.16 Authentication Bypass (CVSS 8.7, Wptimecapsule Time Capsule Plugin)
- [CVE-2019-25763](https://cve.now/CVE-2019-25763.md): WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication Bypass (CVSS 9.3, Ultimatebeaver Ultimate Addons for Beaver Builder)
- [CVE-2026-12673](https://cve.now/CVE-2026-12673.md): Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in (CVSS 5.9, liquidfiles)
- [CVE-2026-48908](https://cve.now/CVE-2026-48908.md): Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla \< 6.6.2 (CVSS 10.0, KEV, joomshaper.net SP Page Builder extension for Joomla)
- [CVE-2026-48939](https://cve.now/CVE-2026-48939.md): Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla \< 4.0.8/3.9.15 (CVSS 10.0, KEV, icagenda.com iCagenda extension for Joomla)
- [CVE-2026-48909](https://cve.now/CVE-2026-48909.md): Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla \< 4.1.4 (CVSS 9.5, joomshaper.net SP LMS extension for Joomla)
- [CVE-2026-12119](https://cve.now/CVE-2026-12119.md): Simple File List \<= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute (CVSS 6.5, eemitch Simple File List)
- [CVE-2026-11911](https://cve.now/CVE-2026-11911.md): Simple File List \<= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter (CVSS 7.5, eemitch Simple File List)
- [CVE-2026-11912](https://cve.now/CVE-2026-11912.md): Simple File List \<= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist\_edit\_job AJAX Action (CVSS 7.5, eemitch Simple File List)
- [CVE-2026-9843](https://cve.now/CVE-2026-9843.md): Database for Contact Form 7, WPforms, Elementor forms \<= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value (CVSS 8.1, crmperks Database for Contact Form 7, WPforms, Elementor fo…)
- [CVE-2026-9265](https://cve.now/CVE-2026-9265.md): Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print\_attribute UTF8STRING path (CVSS 9.1, JONASBN Crypt::OpenSSL::PKCS12)
- [CVE-2026-56216](https://cve.now/CVE-2026-56216.md): Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey (CVSS 8.7, Capgo)
- [CVE-2026-56215](https://cve.now/CVE-2026-56215.md): Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning (CVSS 8.7, Capgo)
- [CVE-2026-56214](https://cve.now/CVE-2026-56214.md): Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC (CVSS 8.7, Capgo)
- [CVE-2026-56213](https://cve.now/CVE-2026-56213.md): Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert\_version\_meta RPC (CVSS 6.9, Capgo)
- [CVE-2026-56212](https://cve.now/CVE-2026-56212.md): Capgo - Improper 2FA Enforcement Logic via Team Security Settings (CVSS 5.1, Capgo)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.