# CVEs published 2026-06-21

72 CVEs were published on June 21, 2026: 2 critical, 21 high. Days are UTC.

- [CVE-2026-12823](https://cve.now/CVE-2026-12823.md): Browserbase Skills Autobrowse Trace Artifact default permission (CVSS 4.8, Browserbase Skills)
- [CVE-2026-12822](https://cve.now/CVE-2026-12822.md): langflow-ai langflow Bundle URL Loader code injection (CVSS 4.8, langflow-ai langflow)
- [CVE-2026-12821](https://cve.now/CVE-2026-12821.md): FlowiseAI Flowise S3 Document Loader S3.ts path traversal (CVSS 5.3, FlowiseAI Flowise)
- [CVE-2026-12815](https://cve.now/CVE-2026-12815.md): coollabsio coolify Image Name os command injection (CVSS 5.3, coollabsio coolify)
- [CVE-2026-12814](https://cve.now/CVE-2026-12814.md): Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection (CVSS 5.3, Comfast CF-WR631AX)
- [CVE-2026-12813](https://cve.now/CVE-2026-12813.md): activepieces File URL file.ts handleUrlFile server-side request forgery (CVSS 5.3, activepieces)
- [CVE-2026-12812](https://cve.now/CVE-2026-12812.md): Radware Cyber Controller HTML Report Generation HTML injection (CVSS 5.1, Radware Cyber Controller)
- [CVE-2026-12811](https://cve.now/CVE-2026-12811.md): kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting (CVSS 5.3, kortix-ai suna)
- [CVE-2026-12810](https://cve.now/CVE-2026-12810.md): Edimax BR-6478AC V2 POST Request mp command injection (CVSS 5.3, Edimax BR-6478AC)
- [CVE-2026-12809](https://cve.now/CVE-2026-12809.md): Edimax BR-6478AC V2 POST Request wiz\_5in1\_redirect command injection (CVSS 5.3, Edimax BR-6478AC)
- [CVE-2026-12808](https://cve.now/CVE-2026-12808.md): Edimax BR-6478AC V2 POST Request stainfo command injection (CVSS 5.3, Edimax BR-6478AC)
- [CVE-2026-12807](https://cve.now/CVE-2026-12807.md): Edimax BR-6478AC V2 POST Request setWAN command injection (CVSS 5.3, Edimax BR-6478AC)
- [CVE-2026-12806](https://cve.now/CVE-2026-12806.md): Edimax BR-6478AC V2 POST Request formWlSiteSurvey buffer overflow (CVSS 8.7, Edimax BR-6478AC)
- [CVE-2026-12805](https://cve.now/CVE-2026-12805.md): OFFIS DCMTK ofxml.cc parseFile heap-based overflow (CVSS 5.3, OFFIS DCMTK)
- [CVE-2026-12804](https://cve.now/CVE-2026-12804.md): lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect (CVSS 5.3, lemonldap-ng)
- [CVE-2026-56412](https://cve.now/CVE-2026-56412.md): libexpat before 2.8.2 does not consider XML\_TOK\_DATA\_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls fr (CVSS 4.9, libexpat project libexpat)
- [CVE-2026-56411](https://cve.now/CVE-2026-56411.md): xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-56410](https://cve.now/CVE-2026-56410.md): xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-56409](https://cve.now/CVE-2026-56409.md): xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. (CVSS 6.5, libexpat project libexpat)
- [CVE-2026-56408](https://cve.now/CVE-2026-56408.md): libexpat before 2.8.2 has an integer overflow in copyString. (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-56407](https://cve.now/CVE-2026-56407.md): libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-56406](https://cve.now/CVE-2026-56406.md): libexpat before 2.8.2 has an integer overflow in XML\_ParseBuffer because it lacked a check that was present in XML\_Parse. (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-56405](https://cve.now/CVE-2026-56405.md): libexpat before 2.8.2 has an integer overflow in getAttributeId. (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-56404](https://cve.now/CVE-2026-56404.md): libexpat before 2.8.2 has an integer overflow in addBinding. (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-56403](https://cve.now/CVE-2026-56403.md): libexpat before 2.8.2 has an integer overflow in storeAtts. (CVSS 6.9, libexpat project libexpat)
- [CVE-2026-56397](https://cve.now/CVE-2026-56397.md): SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README (CVSS 9.4, SiYuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-56396](https://cve.now/CVE-2026-56396.md): phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights() (CVSS 8.7, phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-56394](https://cve.now/CVE-2026-56394.md): Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter (CVSS 7.1, craftcms cms · craftcms/cms)
- [CVE-2026-56393](https://cve.now/CVE-2026-56393.md): Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options (CVSS 4.6, craftcms cms · craftcms/cms)
- [CVE-2026-56385](https://cve.now/CVE-2026-56385.md): Craft CMS - Authorization Bypass in assets/preview-file Endpoint (CVSS 5.3, craftcms cms · craftcms/cms)
- [CVE-2026-56384](https://cve.now/CVE-2026-56384.md): Craft CMS - Missing Authorization in assets/preview-thumb Endpoint (CVSS 5.3, craftcms cms · craftcms/cms)
- [CVE-2026-56383](https://cve.now/CVE-2026-56383.md): Craft CMS - Stored XSS in Table Field via Row Heading Column Type (CVSS 4.6, craftcms cms · craftcms/cms)
- [CVE-2026-56382](https://cve.now/CVE-2026-56382.md): Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController (CVSS 8.6, craftcms cms · craftcms/cms)
- [CVE-2026-56381](https://cve.now/CVE-2026-56381.md): Craft CMS - Stored XSS via User Group Name in User Permissions Page (CVSS 4.6, craftcms cms · craftcms/cms)
- [CVE-2026-56378](https://cve.now/CVE-2026-56378.md): ImageMagick - Heap Out-of-Bounds Read in PCD Decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56367](https://cve.now/CVE-2026-56367.md): ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56316](https://cve.now/CVE-2026-56316.md): Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/\* (CVSS 6.9, Cap-go capgo)
- [CVE-2026-56299](https://cve.now/CVE-2026-56299.md): Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint (CVSS 6.9, Capgo)
- [CVE-2026-56265](https://cve.now/CVE-2026-56265.md): Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key (CVSS 9.3, Crawl4AI)
- [CVE-2026-56253](https://cve.now/CVE-2026-56253.md): Capgo - Unauthenticated Organization Member Email Disclosure via get\_org\_members RPC (CVSS 8.7, Capgo)
- [CVE-2026-56251](https://cve.now/CVE-2026-56251.md): Capgo - Privilege Escalation via Broken Row Level Security in org\_users (CVSS 7.0, Capgo)
- [CVE-2026-56242](https://cve.now/CVE-2026-56242.md): Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get\_identity\_apikey\_only RPC (CVSS 8.7, Capgo)
- [CVE-2026-56239](https://cve.now/CVE-2026-56239.md): Capgo - Privilege Escalation via SECURITY DEFINER Function apply\_usage\_overage (CVSS 7.2, Capgo)
- [CVE-2026-56236](https://cve.now/CVE-2026-56236.md): Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations (CVSS 6.8, capgo cli · @capgo/cli)
- [CVE-2026-56229](https://cve.now/CVE-2026-56229.md): Capgo - Cross-App Build Job Access via app\_id/job\_id Mismatch in /build/status and /build/logs (CVSS 7.1, Capgo)
- [CVE-2025-71378](https://cve.now/CVE-2025-71378.md): picklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle Files (CVSS 7.6, picklescan)
- [CVE-2025-71357](https://cve.now/CVE-2025-71357.md): picklescan - Arbitrary Code Execution via Undetected idlelib.pyshell.ModifiedInterpreter.runcommand (CVSS 7.6, picklescan)
- [CVE-2025-71351](https://cve.now/CVE-2025-71351.md): picklescan - Remote Code Execution via timeit.timeit() Detection Bypass (CVSS 7.6, picklescan)
- [CVE-2025-71348](https://cve.now/CVE-2025-71348.md): picklescan - Arbitrary Code Execution via torch.utils.\_config\_module.load\_config Bypass (CVSS 7.6, picklescan)
- [CVE-2026-12799](https://cve.now/CVE-2026-12799.md): BerriAI litellm Incomplete Fix CVE-2025-0628 internal\_user\_endpoints.py ui\_view\_users improper authorization (CVSS 5.3, BerriAI litellm · litellm)
- [CVE-2026-12798](https://cve.now/CVE-2026-12798.md): BerriAI litellm MCP OpenAPI Spec Loader openapi\_to\_mcp\_generator.py load\_openapi\_spec\_async server-side request forgery (CVSS 5.3, BerriAI litellm · litellm)
- [CVE-2026-12797](https://cve.now/CVE-2026-12797.md): BerriAI litellm Completions banned\_keywords.py async\_pre\_call\_hook authorization (CVSS 5.3, BerriAI litellm · litellm)
- [CVE-2026-12796](https://cve.now/CVE-2026-12796.md): BerriAI litellm SSO Authentication Flow ui\_sso.py get\_redirect\_response\_from\_openid session expiration (CVSS 5.3, BerriAI litellm · litellm)
- [CVE-2026-12795](https://cve.now/CVE-2026-12795.md): BerriAI litellm SSO Debug Flow ui\_sso.py json.dumps missing authentication (CVSS 6.9, BerriAI litellm · litellm)
- [CVE-2026-12789](https://cve.now/CVE-2026-12789.md): ILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection (CVSS 5.1, ILIAS Learning Management System)
- [CVE-2026-12788](https://cve.now/CVE-2026-12788.md): zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity reference (CVSS 5.3, zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…)
- [CVE-2026-12787](https://cve.now/CVE-2026-12787.md): zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserialization (CVSS 5.3, zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用…)
- [CVE-2026-12786](https://cve.now/CVE-2026-12786.md): Ezbsystems UltraISO Premium Edition Kernel Driver bootpt64.sys access control (CVSS 8.5, Ezbsystems UltraISO Premium Edition)
- [CVE-2026-12784](https://cve.now/CVE-2026-12784.md): IM-Magic Partition Resizer Kernel Driver MDA\_NTDRV.sys access control (CVSS 8.5, IM-Magic Partition Resizer)
- [CVE-2026-52911](https://cve.now/CVE-2026-52911.md): ksmbd: scope conn-\>binding slowpath to bound sessions only (CVSS 8.8, Linux)
- [CVE-2026-12782](https://cve.now/CVE-2026-12782.md): EaseUS Partition Master Kernel Driver EUEDKEPM.sys access control (CVSS 8.5, EaseUS Partition Master)
- [CVE-2026-12781](https://cve.now/CVE-2026-12781.md): EaseUS Partition Master Kernel Driver epmntdrv.sys access control (CVSS 8.5, EaseUS Partition Master)
- [CVE-2026-12780](https://cve.now/CVE-2026-12780.md): AOMEI Backupper Kernel Driver amwrtdrv.sys access control (CVSS 8.5, AOMEI Backupper)
- [CVE-2026-12779](https://cve.now/CVE-2026-12779.md): AOMEI Dynamic Disk Manager Kernel Driver ddmdrv.sys access control (CVSS 8.5, AOMEI Dynamic Disk Manager)
- [CVE-2026-12778](https://cve.now/CVE-2026-12778.md): AOMEI Partition Assistant Kernel Driver ampa10.sys access control (CVSS 8.5, AOMEI Partition Assistant)
- [CVE-2026-12776](https://cve.now/CVE-2026-12776.md): Montodel House-Rental-Management index.php houses sql injection (CVSS 5.3, Montodel House-Rental-Management)
- [CVE-2026-12775](https://cve.now/CVE-2026-12775.md): Montodel House-Rental-Management login.php sql injection (CVSS 6.9, Montodel House-Rental-Management)
- [CVE-2026-12774](https://cve.now/CVE-2026-12774.md): BerriAI litellm MCP Server Connection Testing rest\_endpoints.py \_execute\_with\_mcp\_client server-side request forgery (CVSS 5.3, BerriAI litellm)
- [CVE-2026-12773](https://cve.now/CVE-2026-12773.md): BerriAI litellm MCP Proxy user\_api\_key\_auth\_mcp.py UserAPIKeyAuth improper authentication (CVSS 6.9, BerriAI litellm · litellm)
- [CVE-2026-12772](https://cve.now/CVE-2026-12772.md): BerriAI litellm PROXY\_ADMIN database API Key Generator login\_utils.py authenticate\_user session expiration (CVSS 5.3, BerriAI litellm · litellm)
- [CVE-2026-12771](https://cve.now/CVE-2026-12771.md): BerriAI litellm M2M JWT user\_api\_key\_auth.py improper authorization (CVSS 2.3, BerriAI litellm · litellm)
- [CVE-2026-12770](https://cve.now/CVE-2026-12770.md): BerriAI litellm Admin Key key\_management\_endpoints.py improper authorization (CVSS 5.3, BerriAI litellm · litellm)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.