# CVEs published 2026-06-22

220 CVEs were published on June 22, 2026: 18 critical, 83 high. Days are UTC.

- [CVE-2026-10658](https://cve.now/CVE-2026-10658.md): Out-of-bounds access in Bluetooth ISO receive (\`bt\_iso\_recv\`) due to missing SDU-header length validation (CVSS 7.1, zephyrproject zephyr)
- [CVE-2026-10651](https://cve.now/CVE-2026-10651.md): Out-of-bounds read in Bluetooth Classic SDP attribute parsing (\`bt\_sdp\_parse\_attribute\`) (CVSS 7.1, zephyrproject zephyr)
- [CVE-2026-10645](https://cve.now/CVE-2026-10645.md): Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image (CVSS 4.9, zephyrproject zephyr)
- [CVE-2026-47155](https://cve.now/CVE-2026-47155.md): vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-41523](https://cve.now/CVE-2026-41523.md): vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2026-54232](https://cve.now/CVE-2026-54232.md): vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile (CVSS 8.8, vllm-project vllm · vllm)
- [CVE-2026-54233](https://cve.now/CVE-2026-54233.md): vLLM: OOM Denial of Service via Audio Decompression Bomb (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-54236](https://cve.now/CVE-2026-54236.md): vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router (CVSS 5.3, vllm-project vllm · vllm)
- [CVE-2026-54235](https://cve.now/CVE-2026-54235.md): vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels (CVSS 6.9, vllm-project vllm · vllm)
- [CVE-2026-48746](https://cve.now/CVE-2026-48746.md): vLLM: OpenAI auth bypass (CVSS 9.1, vllm-project vllm · vllm)
- [CVE-2026-53923](https://cve.now/CVE-2026-53923.md): vLLM GGUF Kernels: int64\_t to int truncation of tensor dimensions causes GPU buffer overflow (CVSS 5.3, vllm-project vllm · vllm)
- [CVE-2026-55409](https://cve.now/CVE-2026-55409.md): Filament: Disabled RichEditor field state can be used for XSS (CVSS 7.6, filamentphp filament · filament/forms)
- [CVE-2026-48067](https://cve.now/CVE-2026-48067.md): Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields (CVSS 6.5, filamentphp filament · filament/tables +1)
- [CVE-2026-48167](https://cve.now/CVE-2026-48167.md): Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS (CVSS 6.4, filamentphp filament · filament/infolists +1)
- [CVE-2026-48500](https://cve.now/CVE-2026-48500.md): Filament: Unauthenticated temporary file upload on auth pages (CVSS 6.5, filamentphp filament · filament/filament)
- [CVE-2026-48166](https://cve.now/CVE-2026-48166.md): Filament: Timing-based user enumeration on login page (CVSS 5.3, filamentphp filament · filament/filament)
- [CVE-2026-48505](https://cve.now/CVE-2026-48505.md): Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission (CVSS 7.4, filamentphp filament · filament/filament)
- [CVE-2026-44889](https://cve.now/CVE-2026-44889.md): WebOb: Location header normalization during redirect leads to open redirect (CVSS 6.1, Pylons webob · webob)
- [CVE-2026-48109](https://cve.now/CVE-2026-48109.md): MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input (CVSS 8.2, MessagePack-CSharp · MessagePack)
- [CVE-2026-48502](https://cve.now/CVE-2026-48502.md): MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows (CVSS 8.2, MessagePack-CSharp · MessagePack)
- [CVE-2026-48506](https://cve.now/CVE-2026-48506.md): MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth (CVSS 7.5, MessagePack-CSharp · MessagePack)
- [CVE-2026-48509](https://cve.now/CVE-2026-48509.md): MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48510](https://cve.now/CVE-2026-48510.md): MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48511](https://cve.now/CVE-2026-48511.md): MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48512](https://cve.now/CVE-2026-48512.md): MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48513](https://cve.now/CVE-2026-48513.md): MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48514](https://cve.now/CVE-2026-48514.md): MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48515](https://cve.now/CVE-2026-48515.md): MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48516](https://cve.now/CVE-2026-48516.md): MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-56698](https://cve.now/CVE-2026-56698.md): Nuxt - Cross-Site Scripting via navigateTo open Option (CVSS 5.3, Nuxt)
- [CVE-2026-56697](https://cve.now/CVE-2026-56697.md): Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp (CVSS 5.3, Nuxt)
- [CVE-2026-56357](https://cve.now/CVE-2026-56357.md): n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger (CVSS 6.3, n8n)
- [CVE-2026-56348](https://cve.now/CVE-2026-56348.md): n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint (CVSS 5.3, n8n)
- [CVE-2026-56326](https://cve.now/CVE-2026-56326.md): Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo (CVSS 5.3, Nuxt)
- [CVE-2026-56324](https://cve.now/CVE-2026-56324.md): Capgo - Rate Limit Bypass via User-Controlled device\_id Parameter (CVSS 8.8, Capgo)
- [CVE-2026-56323](https://cve.now/CVE-2026-56323.md): Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel\_self (CVSS 8.7, Capgo)
- [CVE-2026-56321](https://cve.now/CVE-2026-56321.md): Capgo - Missing Authentication Middleware on GET /private/role\_bindings Endpoint (CVSS 6.9, Capgo)
- [CVE-2026-56314](https://cve.now/CVE-2026-56314.md): Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint (CVSS 7.1, Capgo)
- [CVE-2026-56311](https://cve.now/CVE-2026-56311.md): Capgo - Unauthenticated Cross-Tenant Disclosure via get\_current\_plan\_max\_org RPC (CVSS 6.9, Capgo)
- [CVE-2026-56306](https://cve.now/CVE-2026-56306.md): Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing (CVSS 5.3, Capgo)
- [CVE-2026-56280](https://cve.now/CVE-2026-56280.md): Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect (CVSS 7.1, Cap-go capgo)
- [CVE-2026-56268](https://cve.now/CVE-2026-56268.md): Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint (CVSS 5.3, Flowise)
- [CVE-2026-56266](https://cve.now/CVE-2026-56266.md): Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints (CVSS 9.2, Crawl4AI)
- [CVE-2026-56255](https://cve.now/CVE-2026-56255.md): Capgo - Denial of Service via Unlimited Demo App Creation (CVSS 5.3, Capgo)
- [CVE-2026-56221](https://cve.now/CVE-2026-56221.md): Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts (CVSS 7.1, Cap-go capgo)
- [CVE-2025-71358](https://cve.now/CVE-2025-71358.md): picklescan - Remote Code Execution via idlelib.autocomplete.AutoComplete.get\_entity (CVSS 7.6, picklescan)
- [CVE-2025-71344](https://cve.now/CVE-2025-71344.md): picklescan - Arbitrary Code Execution via Undetected ensurepip.\_run\_pip Function (CVSS 7.6, picklescan)
- [CVE-2025-71339](https://cve.now/CVE-2025-71339.md): Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.\_eval\_length Gadget (CVSS 7.6, Picklescan)
- [CVE-2026-48517](https://cve.now/CVE-2026-48517.md): MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-54911](https://cve.now/CVE-2026-54911.md): UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps() (CVSS 6.5, ultrajson · ujson)
- [CVE-2026-44311](https://cve.now/CVE-2026-44311.md): Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization (CVSS 5.4, fabricjs fabric.js · fabric)
- [CVE-2026-54281](https://cve.now/CVE-2026-54281.md): Nest: Middleware Bypass on Fastify via Trailing Slash (CVSS 8.7, nestjs nest · @nestjs/platform-fastify)
- [CVE-2026-49468](https://cve.now/CVE-2026-49468.md): LiteLLM: Authentication Bypass via Host Header Injection (CVSS 9.5, BerriAI litellm · litellm)
- [CVE-2026-41479](https://cve.now/CVE-2026-41479.md): Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect\_uri on unsupported response\_type (CVSS 5.4, authlib)
- [CVE-2026-45034](https://cve.now/CVE-2026-45034.md): PhpSpreadsheet: File::prohibitWrappers bypass (CVSS 9.2, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-54651](https://cve.now/CVE-2026-54651.md): pypdf: Possible infinite loop when processing threads/articles in writer (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-49460](https://cve.now/CVE-2026-49460.md): pypdf: Inefficient decoding of FlateDecode PNG predictor streams (CVSS 5.1, py-pdf pypdf · pypdf)
- [CVE-2026-49461](https://cve.now/CVE-2026-49461.md): pypdf: Possible large memory usage for form XObjects during text extraction (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-54531](https://cve.now/CVE-2026-54531.md): pypdf: Possible infinite loop when processing outlines/bookmarks in writer (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-54530](https://cve.now/CVE-2026-54530.md): pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-47242](https://cve.now/CVE-2026-47242.md): Net::IMAP: Command Injection via ID command argument (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-47240](https://cve.now/CVE-2026-47240.md): Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument (CVSS 5.8, ruby net-imap · net-imap)
- [CVE-2026-39904](https://cve.now/CVE-2026-39904.md): Gophish 0.12.1 Denial of Service via Office Document Upload (CVSS 7.1, gophish · github.com/gophish/gophish)
- [CVE-2026-47241](https://cve.now/CVE-2026-47241.md): Net::IMAP: Denial of Service via incomplete raw argument validation (CVSS 2.1, ruby net-imap · net-imap)
- [CVE-2026-55603](https://cve.now/CVE-2026-55603.md): http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in \`fixRequestBody\` (CVSS 7.5, chimurai http-proxy-middleware · http-proxy-middleware)
- [CVE-2026-55599](https://cve.now/CVE-2026-55599.md): phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access (CVSS 5.8, phpseclib · phpseclib/phpseclib)
- [CVE-2026-44727](https://cve.now/CVE-2026-44727.md): Jupyter Server: Stored XSS in \`NbconvertFileHandler\` / \`NbconvertPostHandler\` via missing \`sandbox\` CSP (CVSS 9.3, jupyter-server jupyter\_server · jupyter-server)
- [CVE-2026-10852](https://cve.now/CVE-2026-10852.md): Websphere Application Server is Affected By a Denial of Service (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2026-44271](https://cve.now/CVE-2026-44271.md): Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command (CVSS 8.1, Dell Wyse Management Suite)
- [CVE-2026-48931](https://cve.now/CVE-2026-48931.md): A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. (CVSS 3.7, nodejs node)
- [CVE-2026-44272](https://cve.now/CVE-2026-44272.md): Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command (CVSS 8.8, Dell Wyse Management Suite)
- [CVE-2026-44273](https://cve.now/CVE-2026-44273.md): Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. (CVSS 6.0, Dell Wyse Management Suite)
- [CVE-2026-44274](https://cve.now/CVE-2026-44274.md): Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. (CVSS 7.8, Dell Wyse Management Suite)
- [CVE-2026-53779](https://cve.now/CVE-2026-53779.md): WebP Server Go \< 0.15.0 Path Traversal via Backslash Encoding on Windows (CVSS 8.7, webp-sh webp\_server\_go)
- [CVE-2026-11834](https://cve.now/CVE-2026-11834.md): Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers (CVSS 8.7, TP-Link Systems Archer MR200 · TP Link Systems Archer MR… +3)
- [CVE-2026-53663](https://cve.now/CVE-2026-53663.md): React Router: \`handleDocumentRequest\` CSRF check covers \`POST\` only; PUT/PATCH/DELETE bypass (CVSS 3.1, remix-run react-router · @remix-run server-runtime +2)
- [CVE-2026-54299](https://cve.now/CVE-2026-54299.md): Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) (CVSS 7.5, withastro astro · astro)
- [CVE-2026-54298](https://cve.now/CVE-2026-54298.md): Astro: XSS via Unescaped Attribute Names in Spread Props (CVSS 4.2, withastro astro · astro)
- [CVE-2026-50146](https://cve.now/CVE-2026-50146.md): Astro: Reflected XSS via unescaped slot name (CVSS 7.1, withastro astro · astro)
- [CVE-2026-54300](https://cve.now/CVE-2026-54300.md): @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config (CVSS 5.3, withastro astro · @astrojs/netlify)
- [CVE-2026-54293](https://cve.now/CVE-2026-54293.md): NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read (CVSS 7.5, nltk)
- [CVE-2026-55443](https://cve.now/CVE-2026-55443.md): LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders (CVSS 5.1, langchain-ai langchain · langchain-ai langchain-anthropic +2)
- [CVE-2026-54288](https://cve.now/CVE-2026-54288.md): Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating \`Content-Length\` (CVSS 6.5, honojs hono · hono)
- [CVE-2026-54289](https://cve.now/CVE-2026-54289.md): Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest (CVSS 4.8, honojs hono · hono)
- [CVE-2026-54290](https://cve.now/CVE-2026-54290.md): Hono: CORS Middleware reflects any Origin with credentials when \`origin\` defaults to the wildcard (CVSS 7.1, honojs hono · hono)
- [CVE-2026-10789](https://cve.now/CVE-2026-10789.md): MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop (CVSS 9.6, Autodesk Fusion)
- [CVE-2026-54286](https://cve.now/CVE-2026-54286.md): Hono: Path traversal in \`serve-static\` on Windows via encoded backslash (\`%5C\`) (CVSS 5.9, honojs hono · hono)
- [CVE-2026-54287](https://cve.now/CVE-2026-54287.md): Hono: AWS Lambda adapter merges multiple \`Set-Cookie\` headers into one value, dropping cookies on ALB single-header and Lattice (CVSS 5.3, honojs hono · hono)
- [CVE-2026-53540](https://cve.now/CVE-2026-53540.md): Python-Multipart: Negative Content-Length in parse\_form buffers the entire body in memory (CVSS 3.7, Kludex python-multipart · python-multipart)
- [CVE-2026-53537](https://cve.now/CVE-2026-53537.md): Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters (CVSS 3.7, Kludex python-multipart · python-multipart)
- [CVE-2026-53538](https://cve.now/CVE-2026-53538.md): Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling (CVSS 3.7, Kludex python-multipart · python-multipart)
- [CVE-2026-53539](https://cve.now/CVE-2026-53539.md): Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service (CVSS 7.5, Kludex python-multipart · python-multipart)
- [CVE-2026-54285](https://cve.now/CVE-2026-54285.md): opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation (CVSS 5.3, open-telemetry opentelemetry-js · @opentelemetry/core)
- [CVE-2026-55388](https://cve.now/CVE-2026-55388.md): piscina: Prototype Pollution Gadget → RCE via inherited options.filename (CVSS 8.1, piscinajs piscina · piscina)
- [CVE-2026-54283](https://cve.now/CVE-2026-54283.md): Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS (CVSS 7.5, Kludex starlette · starlette)
- [CVE-2026-54282](https://cve.now/CVE-2026-54282.md): Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname (CVSS 3.7, Kludex starlette · starlette)
- [CVE-2026-54273](https://cve.now/CVE-2026-54273.md): AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit (CVSS 6.6, aio-libs aiohttp · aiohttp)
- [CVE-2026-54280](https://cve.now/CVE-2026-54280.md): AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect (CVSS 1.7, aio-libs aiohttp · aiohttp)
- [CVE-2026-54278](https://cve.now/CVE-2026-54278.md): AIOHTTP: Unread Compressed Request Bodies Bypass client\_max\_size During Cleanup (CVSS 6.6, aio-libs aiohttp · aiohttp)
- [CVE-2026-54277](https://cve.now/CVE-2026-54277.md): AIOHTTP: C HTTP Parser Bypasses max\_line\_size for Fragmented Lines (CVSS 6.6, aio-libs aiohttp · aiohttp)
- [CVE-2026-54276](https://cve.now/CVE-2026-54276.md): AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges (CVSS 6.3, aio-libs aiohttp · aiohttp)
- [CVE-2026-54275](https://cve.now/CVE-2026-54275.md): AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections (CVSS 2.7, aio-libs aiohttp · aiohttp)
- [CVE-2026-54274](https://cve.now/CVE-2026-54274.md): AIOHTTP: Incomplete websocket frame payloads bypass memory limits (CVSS 6.6, aio-libs aiohttp · aiohttp)
- [CVE-2026-54279](https://cve.now/CVE-2026-54279.md): AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence (CVSS 1.3, aio-libs aiohttp · aiohttp)
- [CVE-2026-42127](https://cve.now/CVE-2026-42127.md): Pre-authentication denial of service in the public dashboard query endpoint (CVSS 7.5, Grafana Enterprise · Grafana OSS +1)
- [CVE-2026-50269](https://cve.now/CVE-2026-50269.md): AIOHTTP: CRLF injection in multipart headers (CVSS 2.7, aio-libs aiohttp · aiohttp)
- [CVE-2026-54269](https://cve.now/CVE-2026-54269.md): protobufjs: Schema-derived names can shadow runtime-significant properties (CVSS 5.3, protobufjs protobuf.js · protobufjs +1)
- [CVE-2026-48712](https://cve.now/CVE-2026-48712.md): protobufjs: Denial of service through unbounded Any expansion during JSON conversion (CVSS 7.5, protobufjs protobuf.js · protobufjs)
- [CVE-2026-54270](https://cve.now/CVE-2026-54270.md): protobufjs: Memory amplification from preserved unknown fields in binary decode (CVSS 5.3, protobufjs protobuf.js · protobufjs)
- [CVE-2026-54271](https://cve.now/CVE-2026-54271.md): protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names (CVSS 8.2, protobufjs-cli)
- [CVE-2026-53571](https://cve.now/CVE-2026-53571.md): Vite: \`server.fs.deny\` bypass on Windows alternate paths (CVSS 8.2, vitejs vite · vite +1)
- [CVE-2026-49356](https://cve.now/CVE-2026-49356.md): Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core (CVSS 3.2, babel · @babel/core)
- [CVE-2026-56109](https://cve.now/CVE-2026-56109.md): ALSA Library \< 1.2.16.1 Double-Free via parse\_def() in conf.c (CVSS 7.0, alsa-project alsa-lib)
- [CVE-2026-55602](https://cve.now/CVE-2026-55602.md): http-proxy-middleware \`router\` host+path substring matching allows Host-header-driven backend routing bypass (CVSS 6.9, chimurai http-proxy-middleware · http-proxy-middleware)
- [CVE-2026-53632](https://cve.now/CVE-2026-53632.md): NTLMv2 hash disclosure via UNC path handling on Windows (CVSS 5.5, vitejs launch-editor · vitejs vite +4)
- [CVE-2026-50171](https://cve.now/CVE-2026-50171.md): Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) (CVSS 8.2, angular · @angular/common)
- [CVE-2026-12249](https://cve.now/CVE-2026-12249.md): Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment (CVSS 8.3, adsys · Canonical Ubuntu 20.04 LTS +4)
- [CVE-2026-50184](https://cve.now/CVE-2026-50184.md): Angular: Request Credential & Cache Policy Stripping in Angular Service Worker (CVSS 5.7, angular · @angular/service-worker)
- [CVE-2026-50169](https://cve.now/CVE-2026-50169.md): Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities (CVSS 5.7, angular · @angular/service-worker)
- [CVE-2026-46417](https://cve.now/CVE-2026-46417.md): Angular: SSRF via Hostname Hijacking in @angular/platform-server (CVSS 8.8, angular · @angular/platform-server)
- [CVE-2026-50168](https://cve.now/CVE-2026-50168.md): Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass (CVSS 8.8, angular · @angular/platform-server)
- [CVE-2026-50170](https://cve.now/CVE-2026-50170.md): Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache (CVSS 8.2, angular · @angular/common)
- [CVE-2026-50556](https://cve.now/CVE-2026-50556.md): Angular: Missing \`\<noscript\>\` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR (CVSS 8.6, angular · @angular/platform-server)
- [CVE-2026-11994](https://cve.now/CVE-2026-11994.md): Akaunting 3.1.21 - Authenticated stored XSS in report description rendering (CVSS 4.8, Akaunting)
- [CVE-2026-50555](https://cve.now/CVE-2026-50555.md): Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server (CVSS 8.6, angular · @angular/platform-server)
- [CVE-2026-41049](https://cve.now/CVE-2026-41049.md): Caching of Authentication allows Authentication Bypass between users in qSnapper (CVSS 8.4, presire qSnapper)
- [CVE-2026-54264](https://cve.now/CVE-2026-54264.md): Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker (CVSS 8.3, angular · @angular/service-worker)
- [CVE-2026-54268](https://cve.now/CVE-2026-54268.md): Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate) (CVSS 8.2, angular · @angular/common)
- [CVE-2026-41048](https://cve.now/CVE-2026-41048.md): Caching of Authentication allows Authentication Bypass in qSnapper (CVSS 8.4, presire qSnapper)
- [CVE-2026-54267](https://cve.now/CVE-2026-54267.md): Angular Client Hydration DOM Clobbering & Response-Cache Poisoning (CVSS 8.6, angular · @angular/core)
- [CVE-2026-11943](https://cve.now/CVE-2026-11943.md): Akaunting 3.1.21 - Authenticated stored XSS in document timeline (CVSS 4.8, Akaunting)
- [CVE-2026-54266](https://cve.now/CVE-2026-54266.md): Angular: Weak 32-Bit Cache Key Hashing in \`HttpTransferCache\` Leading to Cross-Request Data Leakage and State Poisoning (CVSS 8.8, angular · @angular/common)
- [CVE-2026-54265](https://cve.now/CVE-2026-54265.md): Angular: Two-Way Property Binding Sanitization Bypass (XSS) (CVSS 5.3, angular · @angular/compiler)
- [CVE-2026-41047](https://cve.now/CVE-2026-41047.md): Information leak via “diff” methods in qSnapper (CVSS 6.9, presire qSnapper)
- [CVE-2026-7253](https://cve.now/CVE-2026-7253.md): IBM Sterling File Gateway SQL Injection (CVSS 6.0, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-12479](https://cve.now/CVE-2026-12479.md): Path Traversal in keras-team/keras (CVSS 6.1, keras-team/keras · keras)
- [CVE-2026-50178](https://cve.now/CVE-2026-50178.md): Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension (CVSS 8.7, angular · Angular.ng-template)
- [CVE-2026-41046](https://cve.now/CVE-2026-41046.md): path traversal via \`config\` parameter in qSnapper (CVSS 7.3, presire qSnapper)
- [CVE-2026-8934](https://cve.now/CVE-2026-8934.md): Cross-Project Information Leakage in Google App Engine UI (CVSS 6.9, Google Cloud Cloud Console UIs)
- [CVE-2026-52725](https://cve.now/CVE-2026-52725.md): Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS) (CVSS 5.3, angular · @angular/core)
- [CVE-2026-11942](https://cve.now/CVE-2026-11942.md): Akaunting 3.1.21 - Stored XSS in delete confirmation modal (CVSS 4.8, Akaunting)
- [CVE-2026-41045](https://cve.now/CVE-2026-41045.md): Weak polkit authentication check in qSnapper (CVSS 8.1, presire qSnapper)
- [CVE-2026-49241](https://cve.now/CVE-2026-49241.md): Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension (CVSS 8.7, angular)
- [CVE-2026-50557](https://cve.now/CVE-2026-50557.md): Angular: Template and Attribute Namespace Sanitization Bypass (XSS) (CVSS 5.3, angular · @angular/core +1)
- [CVE-2026-53550](https://cve.now/CVE-2026-53550.md): js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases (CVSS 5.3, nodeca js-yaml · js-yaml)
- [CVE-2026-53655](https://cve.now/CVE-2026-53655.md): node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) (CVSS 6.9, isaacs node-tar · tar)
- [CVE-2026-9320](https://cve.now/CVE-2026-9320.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2026-9071](https://cve.now/CVE-2026-9071.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2026-9006](https://cve.now/CVE-2026-9006.md): IBM WebSphere Application Server is affected by server-side request forgery (CVSS 7.4, IBM WebSphere Application Server)
- [CVE-2026-8646](https://cve.now/CVE-2026-8646.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVSS 7.4, IBM WebSphere Application Server)
- [CVE-2026-10845](https://cve.now/CVE-2026-10845.md): IBM WebSphere Application Server is affected by an authentication bypass vulnerability (CVSS 7.3, IBM WebSphere Application Server)
- [CVE-2024-51454](https://cve.now/CVE-2024-51454.md): IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed (CVSS 6.5, IBM Engineering Workflow Management)
- [CVE-2023-33854](https://cve.now/CVE-2023-33854.md): Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data. (CVSS 5.3, IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pa…)
- [CVE-2026-9610](https://cve.now/CVE-2026-9610.md): Multiple Vulnerabilities in IBM Datacap (CVSS 2.3, IBM Datacap)
- [CVE-2026-9072](https://cve.now/CVE-2026-9072.md): WebSphere Application Server Remote Code Execution (CVSS 8.1, IBM WebSphere Application Server)
- [CVE-2026-56104](https://cve.now/CVE-2026-56104.md): Chainlit \< 2.10.1 Session Hijacking via WebSocket Session Restoration (CVSS 8.8, chainlit)
- [CVE-2026-8858](https://cve.now/CVE-2026-8858.md): WebSphere Application Server Remote Code Execution (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2026-8636](https://cve.now/CVE-2026-8636.md): Multiple Vulnerabilities in IBM Datacap (CVSS 5.5, IBM Datacap)
- [CVE-2026-8059](https://cve.now/CVE-2026-8059.md): Multiple Vulnerabilities in IBM Datacap (CVSS 6.1, IBM Datacap)
- [CVE-2026-7664](https://cve.now/CVE-2026-7664.md): Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-11372](https://cve.now/CVE-2026-11372.md): IBM TRIRIGA Cross-Site Scripting Vulnerability (CVSS 5.4, IBM TRIRIGA Application Platform)
- [CVE-2026-12549](https://cve.now/CVE-2026-12549.md): Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver (CVSS 4.8, Red Hat Enterprise Linux)
- [CVE-2026-12725](https://cve.now/CVE-2026-12725.md): Dnsmasq: dnsmasq: heap buffer overflow in log\_query() when logging unsupported ds/dnskey replies (CVSS 5.9, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-12628](https://cve.now/CVE-2026-12628.md): Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system (CVSS 9.1, IBM Storage Protect Client · IBM Storage Protect Snapshot F…)
- [CVE-2026-8823](https://cve.now/CVE-2026-8823.md): User Manager can demote bot accounts to guest without bot-management permission (CVSS 3.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2026-6062](https://cve.now/CVE-2026-6062.md): IDOR in Jira plugin subscription edit endpoint (CVSS 6.4, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-6673](https://cve.now/CVE-2026-6673.md): Mattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install (CVSS 6.4, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-8074](https://cve.now/CVE-2026-8074.md): Improper Permission Check Allows User Manager to Deactivate Bot Accounts (CVSS 3.8, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-9162](https://cve.now/CVE-2026-9162.md): Global session revocation does not invalidate active WebSocket connections (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-5139](https://cve.now/CVE-2026-5139.md): GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration (CVSS 5.4, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2026-10561](https://cve.now/CVE-2026-10561.md): Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection (CVSS 10.0, IBM Langflow OSS · langflow)
- [CVE-2026-28381](https://cve.now/CVE-2026-28381.md): Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT (CVSS 9.6, Grafana Snowflake Datasource)
- [CVE-2025-33128](https://cve.now/CVE-2025-33128.md): IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed (CVSS 5.4, IBM Engineering Workflow Management)
- [CVE-2025-2669](https://cve.now/CVE-2025-2669.md): Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data. (CVSS 6.0, IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pa…)
- [CVE-2026-9029](https://cve.now/CVE-2026-9029.md): Stored XSS in the Geomap panel tile-layer attribution (CVSS 7.3, Grafana OSS · github.com/grafana/grafana)
- [CVE-2026-10601](https://cve.now/CVE-2026-10601.md): Path traversal in the Tempo and Loki data source plugins (CVSS 5.4, Grafana OSS · github.com/grafana/grafana)
- [CVE-2026-42129](https://cve.now/CVE-2026-42129.md): Path traversal in the Loki data source plugin (CVSS 7.7, Grafana OSS · github.com/grafana/grafana)
- [CVE-2024-54178](https://cve.now/CVE-2024-54178.md): Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data. (CVSS 6.5, IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pa…)
- [CVE-2026-12888](https://cve.now/CVE-2026-12888.md): HTML injection in the Canarytoken Google Chat notification (CVSS 2.0, Thinkst Applied Research Canarytokens)
- [CVE-2026-56450](https://cve.now/CVE-2026-56450.md): AIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes (CVSS 5.1, ail project ail framework)
- [CVE-2026-56448](https://cve.now/CVE-2026-56448.md): Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read (CVSS 8.3, ail project ail framework)
- [CVE-2026-7167](https://cve.now/CVE-2026-7167.md): Multiple vulnerabilities in the Assassin game by Gaudire (CVSS 6.9, Gaudire Assassin game)
- [CVE-2026-7166](https://cve.now/CVE-2026-7166.md): Multiple vulnerabilities in the Assassin game by Gaudire (CVSS 9.2, Gaudire Assassin game)
- [CVE-2026-7165](https://cve.now/CVE-2026-7165.md): Multiple vulnerabilities in the Assassin game by Gaudire (CVSS 9.4, Gaudire Assassin game)
- [CVE-2026-54100](https://cve.now/CVE-2026-54100.md): Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft (CVSS 8.3, Red Hat OpenShift for Windows Containers · Red Hat OpenShif…)
- [CVE-2026-54099](https://cve.now/CVE-2026-54099.md): Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters (CVSS 8.8, Red Hat OpenShift for Windows Containers · Red Hat OpenShif…)
- [CVE-2026-6653](https://cve.now/CVE-2026-6653.md): libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling (CVSS 7.0, GNOME libxml2)
- [CVE-2026-56447](https://cve.now/CVE-2026-56447.md): MISP remote code execution via arbitrary rdkafka configuration path (CVSS 9.3, misp)
- [CVE-2026-12602](https://cve.now/CVE-2026-12602.md): Incorrect permissions in ArubaSign by Aruba (CVSS 8.8, ArubaSign)
- [CVE-2026-56446](https://cve.now/CVE-2026-56446.md): Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP (CVSS 8.7, misp)
- [CVE-2026-56425](https://cve.now/CVE-2026-56425.md): MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection (CVSS 9.3, misp)
- [CVE-2026-56424](https://cve.now/CVE-2026-56424.md): Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models (CVSS 7.1, misp)
- [CVE-2026-56423](https://cve.now/CVE-2026-56423.md): MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints (CVSS 9.4, misp)
- [CVE-2026-56422](https://cve.now/CVE-2026-56422.md): MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields (CVSS 9.4, misp)
- [CVE-2026-11373](https://cve.now/CVE-2026-11373.md): Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections (CVSS 9.1, JASEI Net::Statsite::Client)
- [CVE-2026-12581](https://cve.now/CVE-2026-12581.md): Digiwin｜EasyFlow .NET - Session Fixation (CVSS 7.7, Digiwin EasyFlow .NET)
- [CVE-2026-12580](https://cve.now/CVE-2026-12580.md): Digiwin｜EasyFlow .NET - Stored Cross-Site Scripting (CVSS 5.1, Digiwin EasyFlow .NET)
- [CVE-2023-45795](https://cve.now/CVE-2023-45795.md): Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx (CVSS 7.8, Pilz PMI v8xx · Pilz PASvisu)
- [CVE-2023-45796](https://cve.now/CVE-2023-45796.md): XSS vulnerability in Pilz PASvisu and PMI v8xx (CVSS 8.1, Pilz PMI v8xx · Pilz PASvisu)
- [CVE-2026-12863](https://cve.now/CVE-2026-12863.md): Open redirect (CVSS 5.1, pretix Venueless)
- [CVE-2026-12862](https://cve.now/CVE-2026-12862.md): XLSX formula injection in exports (CVSS 5.1, pretix Venueless)
- [CVE-2025-4994](https://cve.now/CVE-2025-4994.md): Authentication Bypass for SafeLine SL6 and SL6+ (CVSS 8.7, SafeLine SL6/SL6+)
- [CVE-2025-62198](https://cve.now/CVE-2025-62198.md): Apache Atlas: Stored XSS in Create Entity page (CVSS 5.4, Apache Software Foundation Apache Atlas · org.apache.atlas:…)
- [CVE-2026-44914](https://cve.now/CVE-2026-44914.md): Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents (CVSS 7.5, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2026-44911](https://cve.now/CVE-2026-44911.md): Apache NiFi: Incorrect Authorization for Configuration Verification Requests (CVSS 2.3, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2026-44913](https://cve.now/CVE-2026-44913.md): Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL (CVSS 5.2, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2026-54665](https://cve.now/CVE-2026-54665.md): Apache NiFi: Missing Validation for Proxy Host Headers (CVSS 6.3, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2025-66336](https://cve.now/CVE-2025-66336.md): Apache Doris MCP Server: SQL injection leading the authentication bypass (CVSS 8.1, Apache Software Foundation Apache Doris MCP Server · doris-…)
- [CVE-2026-8157](https://cve.now/CVE-2026-8157.md): Vitepos \< 3.4.2 - Outlet Manager+ Privilege Escalation (CVSS 8.8, Vitepos)
- [CVE-2026-7859](https://cve.now/CVE-2026-7859.md): Motors Car Dealership & Classified Listings \< 1.4.110 - Unauthenticated Post-Meta Write via stm\_ajax\_add\_a\_car\_media (CVSS 5.3, Motors)
- [CVE-2026-6858](https://cve.now/CVE-2026-6858.md): Transbank Webpay \< 1.14.0 - Unauthenticated Stored XSS (CVSS 7.1, Transbank Webpay)
- [CVE-2026-4259](https://cve.now/CVE-2026-4259.md): Ultimate WooCommerce Auction Pro \<= 2.4.5 - Reflected XSS via uwa\_manage\_auctions (CVSS 7.1, ultimate-woocommerce-auction-pro)
- [CVE-2026-4110](https://cve.now/CVE-2026-4110.md): Ultimate WooCommerce Auction Pro \<= 2.4.5 - Reflected XSS via uwa\_auctions\_bids\_list (CVSS 6.1, ultimate-woocommerce-auction-pro)
- [CVE-2026-10530](https://cve.now/CVE-2026-10530.md): Pie Register \< 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable Token (CVSS 5.3, Pie Register)
- [CVE-2026-6645](https://cve.now/CVE-2026-6645.md): Insecure Search Path Vulnerability in PaperCut Print Deploy Client for Windows (CVSS 7.3, PaperCut Print Deploy)
- [CVE-2026-11748](https://cve.now/CVE-2026-11748.md): A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm su (CVSS 6.9, LY Central Dogma · com.linecorp.centraldogma:centraldogma-s…)
- [CVE-2026-11746](https://cve.now/CVE-2026-11746.md): A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting re (CVSS 9.4, LY Central Dogma · com.linecorp.centraldogma:centraldogma-s…)
- [CVE-2026-11745](https://cve.now/CVE-2026-11745.md): A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not ver (CVSS 8.8, LY Central Dogma · com.linecorp.centraldogma:centraldogma-s…)
- [CVE-2026-8918](https://cve.now/CVE-2026-8918.md): A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or (CVSS 7.1, ASUS Armoury Crate)
- [CVE-2025-66389](https://cve.now/CVE-2025-66389.md): GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fe (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.