CVEs published June 23, 2026
255 CVEs were published on June 23, 2026: 22 critical, 101 high. 1 is now in CISA KEV.
- Published
- 255
- Critical
- 22
- High
- 101
- Medium
- 119
- Low
- 13
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 198
Most affected products
- nocodb
- 29
- n8n-io n8n · n8n
- 21
- open-webui
- 15
- Revive Adserver
- 12
- denoland deno · deno
- 10
- langflow-ai langflow · langflow
- 9
- FasterXML jackson-databind · com.fasterxml.jackson.core:… +1
- 7
- Capgo
- 5
- picklescan
- 5
- daytonaio daytona · github.com/daytonaio/daytona
- 4
Critical 22
- CVE-2026-54588Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.poweradmin · poweradmin/poweradmin
- CVE-2026-11807Eda-server: websocket missing authorization allows credential theft via activation_id spoofingRed Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1
- CVE-2026-53753Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker APIunclecode crawl4ai · crawl4ai
- CVE-2026-54157LobeHub: Unauthenticated SSRF in `/webapi/proxy`lobehub · @lobehub/lobehub
- CVE-2026-53662immich: One-click account takeover via XSS in login page continue redirectimmich-app immich
- CVE-2026-54257Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflowelectron
- CVE-2026-48519Langflow: Unauthenticated RCE in Shareable Playgroundslangflow-ai langflow · langflow
- CVE-2026-55447Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploitlangflow-ai langflow · langflow
- CVE-2026-55450Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leaklangflow-ai langflow · langflow
- CVE-2026-44791n8n: XML Node Prototype Pollution Patch Bypassn8n-io n8n · n8n
- CVE-2026-44790n8n: Arbitrary File Read via Git Noden8n-io n8n · n8n
- CVE-2026-44789n8n: HTTP Request Node Pagination Prototype Pollution to RCEn8n-io n8n · n8n
- CVE-2026-27604FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin FunctionsFOSSBilling
- CVE-2026-28496FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCEFOSSBilling
- CVE-2026-35019NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication BypassNetComm Wireless Pty NF20MESH
- CVE-2026-56379ImageMagick - Command Injection via SVG DecoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-56315picklescan - Remote Code Execution via Unblocked Standard Library Modulespicklescan
- CVE-2026-56258Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOUCrawl4AI
- CVE-2026-44089Buffer Overflow in Totolink EX1200L routerTotolink EX1200L
- CVE-2026-11374Account Takeover via Predictable SSO Ticket Generationzohocorp manageengine_adselfservice_plus · zohocorp mana… +2
- CVE-2026-9733Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameterHAYAJO Mojolicious::Plugin::Web::Auth::OAuth2
- CVE-2026-12866All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API.expr-eval · org.webjars.npm:expr-eval
High 101
- CVE-2026-7574Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before UseAnthropic Claude Desktop Cowork
- CVE-2026-5818MCU Firmware Update Authentication Bypass on Caliptra CoreCaliptra Core Runtime Firmware
- CVE-2026-56785FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form FieldsFlatPress
- CVE-2026-11972tarfile opened in streaming mode mishandles EOFPython Software Foundation CPython
- CVE-2026-41862Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts withoSpring Statemachine · org.springframework.statemachine:spri…
- CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationFasterXML jackson-databind · com.fasterxml.jackson.core:… +1
- CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)FasterXML jackson-databind · com.fasterxml.jackson.core:… +1
- CVE-2026-47383NocoDB: Stored Cross-Site Scripting via Row Commentsnocodb
- CVE-2026-23513FOSSBilling: Broken Authorization in Client Transaction and Order ListingsFOSSBilling
- CVE-2026-47387NocoDB: Stored Cross-Site Scripting via Form View Redirect URLnocodb
- CVE-2026-12112Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuseRed Hat Satellite
- CVE-2026-54328Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hostsearendil-works pi · @earendil-works/pi-coding-agent +1
- CVE-2026-53622Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hoststraefik · github.com/traefik/traefik/v3 +2
- CVE-2026-48491Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypasstraefik · github.com/traefik/traefik/v2 +1
- CVE-2026-48020Traefik StripPrefix Route-Level Auth Bypass via Path Normalizationtraefik · github.com/traefik/traefik/v2 +2
- CVE-2026-54555rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separatorsrtk-ai rtk
- CVE-2026-53754Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)unclecode crawl4ai · crawl4ai
- CVE-2026-53755Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF checkunclecode crawl4ai · crawl4ai
- CVE-2026-54320Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified emaildaytonaio daytona
- CVE-2026-54321Daytona: Public sandbox previews remain accessible for up to one hour after being made privatedaytonaio daytona · github.com/daytonaio/daytona
- CVE-2026-54322Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's rolesdaytonaio daytona · github.com/daytonaio/daytona
- CVE-2020-9695Acrobat Reader | Out-of-bounds Write (CWE-787)Adobe Acrobat Reader
- CVE-2026-45135Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Filescaddyserver caddy · github.com/caddyserver/caddy/v2
- CVE-2026-52845Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`caddyserver caddy · github.com/caddyserver/caddy/v2 +1
- CVE-2026-52844Caddy: Windows `file_server` path authorization bypass via encoded backslashcaddyserver caddy · github.com/caddyserver/caddy/v2 +1
- CVE-2026-54318Home Assistant: Exported BroadcastReceiver allows local apps to spoof device locationhome-assistant core
- CVE-2026-54317Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LANhome-assistant core · homeassistant
- CVE-2026-44726Deno: TLS retry copies stale upgrade hook, risking plaintext trafficdenoland deno · deno
- CVE-2026-49401Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)denoland deno · deno
- CVE-2025-71382MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS RenderingArtifexSoftware mupdf
- CVE-2026-49402Deno: Command Injection via spawnSync & spawn on Windowsdenoland deno · deno
- CVE-2026-49440Deno: Miller-Rabin Primality Test Allows Zero Roundsdenoland deno · deno
- CVE-2026-54007Open WebUI: Cross-origin postMessage confirmation bypass via action:submitopen-webui
- CVE-2026-54008Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`open-webui
- CVE-2026-54010Open WebUI: Forged chat-file link allows cross-user file read and deletionopen-webui
- CVE-2026-54011Open WebUI: Stored XSS in Mermaid Markdown Previewopen-webui
- CVE-2026-54012Open WebUI: Forged model meta.knowledge allows cross-user file read and deletionopen-webui
- CVE-2026-54013Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUIopen-webui
- CVE-2026-54018Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirectsopen-webui
- CVE-2026-33760Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpointslangflow-ai langflow · langflow
- CVE-2026-55255Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flowlangflow-ai langflow · langflow
- CVE-2026-55446Langflow: Unauthenticated DoS through multipart form boundary file uploadlangflow-ai langflow · langflow
- CVE-2026-34916A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user tRevive Adserver
- CVE-2026-34914A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier.Revive Adserver
- CVE-2026-44959A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier.Revive Adserver
- CVE-2026-56116dhcpcd Memory Leak DoS via IPv6 Router Advertisement HandlingNetworkConfiguration dhcpcd
- CVE-2026-50574yt-dlp: Arbitrary code execution via manifest downloads with aria2cyt-dlp
- CVE-2026-56115Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypassgarybowers bootimus
- CVE-2026-50023yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)yt-dlp
- CVE-2026-11940tarfile extraction filter bypass allows escaping the destination directoryPython Software Foundation CPython
- CVE-2026-12958Arbitrary file write in Language Servers for AWSAmazon Web Services Language Servers for AWS · @aws/lsp-cod…
- CVE-2026-12957Arbitrary Code Execution in Language Servers for AWSAmazon Web Services Language Servers for AWS · @aws/lsp-cod…
- CVE-2026-13007Insecure Public Caching on REST API Endpoints in Tenable Identity ExposureTenable Identity Exposure
- CVE-2026-44792n8n: Source Control Pull SQL Injectionn8n-io n8n · n8n
- CVE-2026-45732n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpointsn8n-io n8n · n8n
- CVE-2026-49444n8n: Python sandbox escapen8n-io n8n · n8n
- CVE-2026-54304n8n: SecurityScorecard Node Leaks API Token to User-Controlled Hostn8n-io n8n · n8n
- CVE-2026-54307n8n: Credential Exfiltration via Permission Bypassn8n-io n8n · n8n
- CVE-2026-54302n8n: Stored XSS in Chat Trigger Noden8n-io n8n · n8n
- CVE-2026-54305n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpointsn8n-io n8n · n8n
- CVE-2026-54301n8n: Same-Origin XSS in Respond to Webhook Noden8n-io n8n · n8n
- CVE-2026-54309n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessionsn8n-io n8n · n8n
- CVE-2026-56695OpenHarness - Cross-Session Disclosure via /resume and /summary CommandsHKUDS OpenHarness · openharness-ai
- CVE-2026-56402NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handlernanocoai nanoclaw
- CVE-2026-54312n8n: Microsoft SQL Node Prototype Pollutionn8n-io n8n · n8n
- CVE-2025-62180Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.Pegasystems Pega Infinity
- CVE-2026-56815pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Homrasta-mouse pwnlift
- CVE-2026-35018NetComm NF20MESH < R6B032 Authenticated RCE via OS Command InjectionNetComm Wireless Pty NF20MESH
- CVE-2026-54892Plug: quadratic-time decoding of nested query/body parameters enables denial of serviceelixir-plug plug
- CVE-2026-56784OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpointopenremote · io.openremote:openremote-manager
- CVE-2026-56701Grav - XML External Entity Injection via SVG UploadGrav · getgrav/grav
- CVE-2026-56322Capgo - Information Disclosure via Unauthenticated /updates defaultChannel ParameterCapgo
- CVE-2026-56274Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccessFlowise · flowise-components
- CVE-2026-56248Capgo - Unauthenticated Denial-of-Service via audit_logs RLS PolicyCap-go capgo
- CVE-2026-56243Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS PlaneCapgo
- CVE-2026-56225Capgo - Authorization Bypass in API Key Management via App-Limited KeysCapgo
- CVE-2026-56222Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindingsCapgo
- CVE-2025-71376picklescan - Arbitrary Code Execution via Undetected idlelib.autocomplete.AutoComplete.fetch_completionspicklescan
- CVE-2025-71370picklescan - Remote Code Execution via torch.jit.unsupported_tensor_ops.execWrapperpicklescan
- CVE-2025-71365picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection Bypasspicklescan
- CVE-2025-71341picklescan - Remote Code Execution via Undetected profile.Profile.runctxpicklescan
- CVE-2025-71337Flowise - Unverified Email Change via Account Profile EndpointFlowise · flowise-ui
- CVE-2023-54365Traefik - Denial of Service via HTTP/2 Request HandlingTraefik · github.com/traefik/traefik
- CVE-2026-10711RCE in Akınsoft's CafePlusAKIN Software Computer Import Export Industry and Trade Caf…
- CVE-2026-10521Authenticated unintended access to critical program parametersMB connect line mbCONNECT24 · MB connect line mymbCONNECT24
- CVE-2026-8379Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File DownloadFrontend File Manager Plugin
- CVE-2026-8172Simple Basic Contact Form <= 20250114 - Reflected XSSSimple Basic Contact Form
- CVE-2026-8163Infility Global < 2.15.19 - Subscriber+ SQL Injection via order ParameterInfility Global
- CVE-2026-11833Overview: A vulnerability has been found in FAST/TOOLS and CI Server.Yokogawa Electric FAST/TOOLS · Yokogawa Electric CI Server
- CVE-2025-61018An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via
- CVE-2025-61019An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via
- CVE-2025-61020An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via
- CVE-2025-61021An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)
- CVE-2025-61022An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via
- CVE-2025-61023An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted
- CVE-2025-61024An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via c
- CVE-2025-61025An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craft
- CVE-2025-61027An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted
- CVE-2025-61028An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craft
- CVE-2025-61029An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted
- CVE-2026-39253An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Cl
Medium, low and unrated 132
- CVE-2026-6458AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is EmptyCaliptra Core Runtime Firmware
- CVE-2026-12164Privilege Escalation in Fortra File Integrity Monitoring (FIM)Fortra File Integrity Monitoring
- CVE-2026-48493Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignmentgrokability snipe-it · snipe/snipe-it
- CVE-2026-47693Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applicationspoweradmin · poweradmin/poweradmin
- CVE-2026-12163Stored XSS in Fortra File Integrity Monitoring (FIM)Fortra File Integrity Monitoring
- CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databindFasterXML jackson-databind · com.fasterxml.jackson.core:… +1
- CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()FasterXML jackson-databind · com.fasterxml.jackson.core:jac…
- CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)FasterXML jackson-databind · com.fasterxml.jackson.core:… +1
- CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesFasterXML jackson-databind · com.fasterxml.jackson.core:… +1
- CVE-2026-54516jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fieldsFasterXML jackson-databind · com.fasterxml.jackson.core:… +1
- CVE-2026-54517jackson-databind: @JsonView bypass for setterless creator propertiesFasterXML jackson-databind · com.fasterxml.jackson.core:… +1
- CVE-2026-46547NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URLnocodb
- CVE-2026-46548NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)nocodb
- CVE-2026-46549NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalationnocodb
- CVE-2026-46550NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flagsnocodb
- CVE-2026-46552NocoDB: Shared-base link access can invite arbitrary users as persistent base membersnocodb
- CVE-2026-46553NocoDB: Attachment Size Limit Bypass via Upload-by-URLnocodb
- CVE-2026-47375NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`nocodb
- CVE-2026-47376NocoDB: Reflected Cross-Site Scripting via Password Reset Tokennocodb
- CVE-2026-47377NocoDB: Open Redirect via Hash Fragment in hashRedirect Pluginnocodb
- CVE-2026-47378NocoDB: Hidden Column Exposure in Public Shared View Endpointsnocodb
- CVE-2026-47380NocoDB: User Enumeration via Sign-In Timingnocodb
- CVE-2026-46551NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustionnocodb
- CVE-2026-46554NocoDB: Stale Auth Cache After API Token Deletionnocodb
- CVE-2026-47382NocoDB: Server-Side Request Forgery via Database Connection Hostnocodb
- CVE-2026-47279NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpointsnocodb
- CVE-2026-47379NocoDB: Plaintext Password Comparison in Shared Viewsnocodb
- CVE-2026-47381NocoDB: Cross-Workspace Integration Use in Connection Testnocodb
- CVE-2026-47384NocoDB: SQL Injection via Column Title in Bulk GroupBynocodb
- CVE-2026-47385NocoDB: Path Traversal via SQLite Source Filenamenocodb
- CVE-2026-47386NocoDB: OAuth Authorization Code Race Conditionnocodb
- CVE-2026-47388NocoDB: Missing Ownership Check in MCP Attachment Readnocodb
- CVE-2026-53926NocoDB: OAuth Tokens Persist Through Security Eventsnocodb
- CVE-2026-53927NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URLnocodb
- CVE-2026-53928NocoDB: Refresh Tokens Persist Through Password Recoverynocodb
- CVE-2026-12892Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parserRed Hat Enterprise Linux
- CVE-2026-12891Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parserRed Hat Enterprise Linux
- CVE-2026-11820Community.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query stringRed Hat Enterprise Linux
- CVE-2026-11819Community.general: community.general keyring_info — os keyring passphrase returned in plaintextRed Hat Enterprise Linux
- CVE-2026-9073Foreman-mcp-server: mcp server: insecure sensitive http header sanitizationRed Hat Satellite · foreman-mcp-server
- CVE-2025-64105FOSSBilling: IDOR Vulnerability in Support Ticket CreationFOSSBilling
- CVE-2026-53929NocoDB: Stored Cross-Site Scripting via Secure Attachmentnocodb
- CVE-2026-53930NocoDB: Server-Side Request Forgery via Base Migration URLnocodb
- CVE-2026-53931NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpointnocodb
- CVE-2026-54327Pi: Race condition in auth.json writes could expose stored credentialsearendil-works pi · @mariozechner/pi-coding-agent +1
- CVE-2026-54326Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypassearendil-works pi · @mariozechner/pi-coding-agent +1
- CVE-2026-54325Pi loads project-local extensions without approvalearendil-works pi · @earendil-works/pi-coding-agent
- CVE-2026-54762Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution failstraefik · github.com/traefik/traefik +2
- CVE-2026-54761Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik servicestraefik · github.com/traefik/traefik/v3 +2
- CVE-2026-45792RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLMrtk-ai rtk · rtk
- CVE-2026-55249@rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template Stringrtk-ai rtk
- CVE-2026-55736Private action arguments can be set by user input in Ashash-project ash
- CVE-2026-54319Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escapedaytonaio daytona · github.com/daytonaio/daytona
- CVE-2026-54324Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId joindaytonaio daytona · github.com/daytonaio/daytona
- CVE-2026-54323Daytona: Git credential leak via git clone with TLS verification disableddaytonaio daytona
- CVE-2020-9711Acrobat Reader | Out-of-bounds Read (CWE-125)Adobe Acrobat Reader
- CVE-2026-45692Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalizationcaddyserver caddy · github.com/caddyserver/caddy/v2
- CVE-2026-52846Caddy: stripHTML template function bypasscaddyserver caddy · github.com/caddyserver/caddy/v2 +1
- CVE-2020-9713Acrobat Reader | Out-of-bounds Read (CWE-125)Adobe Acrobat Reader
- CVE-2026-0864Configuration Injection via Carriage Return (\r) in write() methodPython Software Foundation CPython
- CVE-2026-57062CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is suppGnuPG
- CVE-2026-55517Deno: Denial of service via non-ASCII bytes in WebSocket response headersdenoland deno · deno
- CVE-2026-49406Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictionsdenoland deno · deno
- CVE-2026-49411Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checksdenoland deno · deno
- CVE-2026-49983Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read accessdenoland deno · deno
- CVE-2026-49860Deno: WebSocket API sandbox bypass via missing post-DNS checkdenoland deno · deno
- CVE-2026-49859Deno: `fetch()` API sandbox bypass via missing DNS resolution checkdenoland deno · deno
- CVE-2026-54316Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetchanthropics claude-code · @anthropic-ai/claude-code
- CVE-2026-50221In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-HosOpenStack Swift · swift
- CVE-2026-54006Open WebUI: Calendar event re-parenting allows writing events into another user's calendaropen-webui
- CVE-2026-54009Open WebUI: Cross-user file disclosure via /api/chat/completions image_url fieldopen-webui
- CVE-2026-54014Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webuiopen-webui
- CVE-2026-54015Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletionopen-webui
- CVE-2026-54016Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumerationopen-webui
- CVE-2026-54019Open WebUI: RAG ACL Bypass in Milvus Multitenancy Modeopen-webui
- CVE-2026-57053GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicoGNU libidn
- CVE-2026-54021Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameteropen-webui
- CVE-2026-54022Open WebUI: Any authenticated user can read other users' private notes via Socket.IOopen-webui
- CVE-2026-48520Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file readlangflow-ai langflow · langflow
- CVE-2026-42867Langflow: Path Traversal in Knowledge Bases API via Creation Endpointlangflow-ai langflow · langflow
- CVE-2026-55423Langflow: Logout button does not clear sessionlangflow-ai langflow · langflow
- CVE-2026-56968GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory diGNU SASL
- CVE-2026-34913A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlRevive Adserver
- CVE-2026-34917Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrictRevive Adserver
- CVE-2026-44956Low‑privileged users could use their Full Name as a vector for a stored XSS attack.Revive Adserver
- CVE-2026-44958An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when Revive Adserver
- CVE-2026-44961The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129.Revive Adserver
- CVE-2026-44960A stored XSS can be exploited by leveraging the usernames as an attack vector.Revive Adserver
- CVE-2026-44957A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier.Revive Adserver
- CVE-2026-34912A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and Revive Adserver
- CVE-2026-34915A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user tRevive Adserver
- CVE-2026-56117dhcpcd Heap Use-After-Free via Control Socket HandlingNetworkConfiguration dhcpcd
- CVE-2026-50019yt-dlp: File Downloader cookie leak with curlyt-dlp
- CVE-2025-13162Advant Master Online Builder DLL vulnerabilityABB Control Builder A · ABB 800xA for Advant Master
- CVE-2026-56114dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()NetworkConfiguration dhcpcd
- CVE-2026-56113dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEWNetworkConfiguration dhcpcd
- CVE-2026-49465n8n: Git Node Clone and Push Operations Bypass File Sandboxn8n-io n8n · n8n
- CVE-2026-54306n8n: Prototype Pollution enables confused-deputy execution via public webhooksn8n-io n8n · n8n
- CVE-2026-54308n8n: Missing Token Validation on Microsoft Agent 365 Trigger Noden8n-io n8n · n8n
- CVE-2026-54311n8n: Merge Node SQL Mode Prototype Pollutionn8n-io n8n · n8n
- CVE-2026-54310n8n: SQL Injection in Postgres v1/TimesclaeDB Nodesn8n-io n8n · n8n
- CVE-2026-56696OpenHarness - Prompt Injection via /issue and /pr_comments Slash CommandsHKUDS OpenHarness · openharness-ai
- CVE-2026-56694NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callbacknanocoai nanoclaw
- CVE-2026-56693NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Actionnanocoai nanoclaw
- CVE-2026-56692NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFilesnanocoai nanoclaw
- CVE-2026-54314n8n: Denial of Service via ZIP decompression in webhook workflown8n-io n8n · n8n
- CVE-2026-54303n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpointsn8n-io n8n · n8n
- CVE-2026-54313n8n: NoSQL Injection in MongoDB Node Find And Replace Operationn8n-io n8n · n8n
- CVE-2025-15619HCL Connections is vulnerable to broken access controlHCLSoftware Connections
- CVE-2026-55766guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serializationguzzle psr7 · guzzlehttp/psr7
- CVE-2026-55767Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzleguzzle · guzzlehttp/guzzle
- CVE-2026-55568Guzzle: Silent HTTPS-Proxy Downgrade to Cleartextguzzle · guzzlehttp/guzzle
- CVE-2026-11772Reflected XSS in DRIMO CMSDRIMO CMS
- CVE-2026-12969Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validationRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-10609Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorizationLogging Subsystem for Red Hat OpenShift · github.com/opensh…
- CVE-2026-4610ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Contentmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2026-10857Reflected XSS in Akinsoft's e-CommerceAKIN Software Computer Import Export Industry and Trade e-C…
- CVE-2026-56762Hono - Missing Cookie Name Validation in setCookie()Hono
- CVE-2026-56376ImageMagick - Heap Use-After-Free in Meta CoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-56371ImageMagick - Memory Leak in TXT File Processing via Texture AttributeImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-56301Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on LinuxNuxt
- CVE-2026-56275Flowise - Server-Side Request Forgery via Execute Flow Base URLFlowise · flowise-components
- CVE-2026-56263Crawl4AI - Stored Cross-Site Scripting in Monitor DashboardCrawl4AI
- CVE-2026-56234Capgo - Password Spraying via Public-Key Accessible Credential Validation EndpointCapgo
- CVE-2026-4983Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xmlEclipse Foundation Eclipse Open VSX
- CVE-2026-8378Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File RenameFrontend File Manager Plugin
- CVE-2026-7842Infility Global < 2.15.20 - Editor+ SQL Injection via orderby ParameterInfility Global
- CVE-2026-55654Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel terminationRed Hat Enterprise Linux · Red Hat Hardened Images +2
- CVE-2026-55655Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versionsRed Hat Enterprise Linux · Red Hat Hardened Images +3
- CVE-2026-55653Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to…Red Hat Enterprise Linux · Red Hat Hardened Images +3
- CVE-2025-55639GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c.
- CVE-2026-52673SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues comp