# CVEs published 2026-06-23

255 CVEs were published on June 23, 2026: 22 critical, 101 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-7574](https://cve.now/CVE-2026-7574.md): Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use (CVSS 8.7, Anthropic Claude Desktop Cowork)
- [CVE-2026-5818](https://cve.now/CVE-2026-5818.md): MCU Firmware Update Authentication Bypass on Caliptra Core (CVSS 7.2, Caliptra Core Runtime Firmware)
- [CVE-2026-6458](https://cve.now/CVE-2026-6458.md): AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty (CVSS 5.1, Caliptra Core Runtime Firmware)
- [CVE-2026-12164](https://cve.now/CVE-2026-12164.md): Privilege Escalation in Fortra File Integrity Monitoring (FIM) (CVSS 4.4, Fortra File Integrity Monitoring)
- [CVE-2026-48493](https://cve.now/CVE-2026-48493.md): Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment (CVSS 5.5, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-56785](https://cve.now/CVE-2026-56785.md): FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields (CVSS 8.4, FlatPress)
- [CVE-2026-54588](https://cve.now/CVE-2026-54588.md): Poweradmin has Host Header Injection in OIDC redirect\_uri, SAML ACS/SLO URL, and Logout Redirect Construction. (CVSS 9.6, poweradmin · poweradmin/poweradmin)
- [CVE-2026-47693](https://cve.now/CVE-2026-47693.md): Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications (CVSS 6.9, poweradmin · poweradmin/poweradmin)
- [CVE-2026-12163](https://cve.now/CVE-2026-12163.md): Stored XSS in Fortra File Integrity Monitoring (FIM) (CVSS 5.5, Fortra File Integrity Monitoring)
- [CVE-2026-11972](https://cve.now/CVE-2026-11972.md): tarfile opened in streaming mode mishandles EOF (CVSS 8.2, Python Software Foundation CPython)
- [CVE-2026-54518](https://cve.now/CVE-2026-54518.md): jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind (CVSS 6.5, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-50193](https://cve.now/CVE-2026-50193.md): jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() (CVSS 6.3, FasterXML jackson-databind · com.fasterxml.jackson.core:jac…)
- [CVE-2026-41862](https://cve.now/CVE-2026-41862.md): Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts witho (CVSS 8.8, Spring Statemachine · org.springframework.statemachine:spri…)
- [CVE-2026-54512](https://cve.now/CVE-2026-54512.md): jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation (CVSS 8.1, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54513](https://cve.now/CVE-2026-54513.md): jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) (CVSS 8.1, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54514](https://cve.now/CVE-2026-54514.md): jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) (CVSS 5.3, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54515](https://cve.now/CVE-2026-54515.md): jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties (CVSS 5.3, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54516](https://cve.now/CVE-2026-54516.md): jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields (CVSS 5.3, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-54517](https://cve.now/CVE-2026-54517.md): jackson-databind: @JsonView bypass for setterless creator properties (CVSS 5.3, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-46547](https://cve.now/CVE-2026-46547.md): NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL (CVSS 6.1, nocodb)
- [CVE-2026-46548](https://cve.now/CVE-2026-46548.md): NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) (CVSS 4.3, nocodb)
- [CVE-2026-46549](https://cve.now/CVE-2026-46549.md): NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation (CVSS 2.0, nocodb)
- [CVE-2026-46550](https://cve.now/CVE-2026-46550.md): NocoDB: Refresh Token Cookie Set Without \`Secure\` and \`SameSite\` Flags (CVSS 5.4, nocodb)
- [CVE-2026-46552](https://cve.now/CVE-2026-46552.md): NocoDB: Shared-base link access can invite arbitrary users as persistent base members (CVSS 5.8, nocodb)
- [CVE-2026-46553](https://cve.now/CVE-2026-46553.md): NocoDB: Attachment Size Limit Bypass via Upload-by-URL (CVSS 2.1, nocodb)
- [CVE-2026-47375](https://cve.now/CVE-2026-47375.md): NocoDB: Postgres SQL Injection in Formula \`ARRAYSORT\` (CVSS 6.0, nocodb)
- [CVE-2026-47376](https://cve.now/CVE-2026-47376.md): NocoDB: Reflected Cross-Site Scripting via Password Reset Token (CVSS 5.1, nocodb)
- [CVE-2026-47377](https://cve.now/CVE-2026-47377.md): NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin (CVSS 5.1, nocodb)
- [CVE-2026-47378](https://cve.now/CVE-2026-47378.md): NocoDB: Hidden Column Exposure in Public Shared View Endpoints (CVSS 6.9, nocodb)
- [CVE-2026-47380](https://cve.now/CVE-2026-47380.md): NocoDB: User Enumeration via Sign-In Timing (CVSS 6.3, nocodb)
- [CVE-2026-46551](https://cve.now/CVE-2026-46551.md): NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion (CVSS 6.5, nocodb)
- [CVE-2026-46554](https://cve.now/CVE-2026-46554.md): NocoDB: Stale Auth Cache After API Token Deletion (CVSS 2.3, nocodb)
- [CVE-2026-47382](https://cve.now/CVE-2026-47382.md): NocoDB: Server-Side Request Forgery via Database Connection Host (CVSS 5.3, nocodb)
- [CVE-2026-47279](https://cve.now/CVE-2026-47279.md): NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints (CVSS 6.9, nocodb)
- [CVE-2026-47379](https://cve.now/CVE-2026-47379.md): NocoDB: Plaintext Password Comparison in Shared Views (CVSS 6.9, nocodb)
- [CVE-2026-47381](https://cve.now/CVE-2026-47381.md): NocoDB: Cross-Workspace Integration Use in Connection Test (CVSS 6.9, nocodb)
- [CVE-2026-47383](https://cve.now/CVE-2026-47383.md): NocoDB: Stored Cross-Site Scripting via Row Comments (CVSS 7.4, nocodb)
- [CVE-2026-47384](https://cve.now/CVE-2026-47384.md): NocoDB: SQL Injection via Column Title in Bulk GroupBy (CVSS 5.3, nocodb)
- [CVE-2026-47385](https://cve.now/CVE-2026-47385.md): NocoDB: Path Traversal via SQLite Source Filename (CVSS 5.3, nocodb)
- [CVE-2026-47386](https://cve.now/CVE-2026-47386.md): NocoDB: OAuth Authorization Code Race Condition (CVSS 6.3, nocodb)
- [CVE-2026-23513](https://cve.now/CVE-2026-23513.md): FOSSBilling: Broken Authorization in Client Transaction and Order Listings (CVSS 7.1, FOSSBilling)
- [CVE-2026-47387](https://cve.now/CVE-2026-47387.md): NocoDB: Stored Cross-Site Scripting via Form View Redirect URL (CVSS 8.4, nocodb)
- [CVE-2026-47388](https://cve.now/CVE-2026-47388.md): NocoDB: Missing Ownership Check in MCP Attachment Read (CVSS 2.3, nocodb)
- [CVE-2026-53926](https://cve.now/CVE-2026-53926.md): NocoDB: OAuth Tokens Persist Through Security Events (CVSS 6.3, nocodb)
- [CVE-2026-53927](https://cve.now/CVE-2026-53927.md): NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL (CVSS 5.1, nocodb)
- [CVE-2026-53928](https://cve.now/CVE-2026-53928.md): NocoDB: Refresh Tokens Persist Through Password Recovery (CVSS 6.3, nocodb)
- [CVE-2026-12892](https://cve.now/CVE-2026-12892.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser (CVSS 4.4, Red Hat Enterprise Linux)
- [CVE-2026-12891](https://cve.now/CVE-2026-12891.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser (CVSS 4.3, Red Hat Enterprise Linux)
- [CVE-2026-11820](https://cve.now/CVE-2026-11820.md): Community.general: community.general nexmo — api credentials exposed in get url query string\[security\] community.general nexmo — api credentials exposed in get url query string (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-11819](https://cve.now/CVE-2026-11819.md): Community.general: community.general keyring\_info — os keyring passphrase returned in plaintext (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-9073](https://cve.now/CVE-2026-9073.md): Foreman-mcp-server: mcp server: insecure sensitive http header sanitization (CVSS 6.2, Red Hat Satellite · foreman-mcp-server)
- [CVE-2025-64105](https://cve.now/CVE-2025-64105.md): FOSSBilling: IDOR Vulnerability in Support Ticket Creation (CVSS 5.1, FOSSBilling)
- [CVE-2026-53929](https://cve.now/CVE-2026-53929.md): NocoDB: Stored Cross-Site Scripting via Secure Attachment (CVSS 5.1, nocodb)
- [CVE-2026-53930](https://cve.now/CVE-2026-53930.md): NocoDB: Server-Side Request Forgery via Base Migration URL (CVSS 5.1, nocodb)
- [CVE-2026-53931](https://cve.now/CVE-2026-53931.md): NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint (CVSS 6.9, nocodb)
- [CVE-2026-12112](https://cve.now/CVE-2026-12112.md): Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse (CVSS 7.8, Red Hat Satellite)
- [CVE-2026-11807](https://cve.now/CVE-2026-11807.md): Eda-server: websocket missing authorization allows credential theft via activation\_id spoofing (CVSS 9.6, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-54327](https://cve.now/CVE-2026-54327.md): Pi: Race condition in auth.json writes could expose stored credentials (CVSS 2.2, earendil-works pi · @mariozechner/pi-coding-agent +1)
- [CVE-2026-54326](https://cve.now/CVE-2026-54326.md): Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass (CVSS 2.5, earendil-works pi · @mariozechner/pi-coding-agent +1)
- [CVE-2026-54328](https://cve.now/CVE-2026-54328.md): Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts (CVSS 7.3, earendil-works pi · @earendil-works/pi-coding-agent +1)
- [CVE-2026-54325](https://cve.now/CVE-2026-54325.md): Pi loads project-local extensions without approval (CVSS 4.4, earendil-works pi · @earendil-works/pi-coding-agent)
- [CVE-2026-54762](https://cve.now/CVE-2026-54762.md): Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails (CVSS 5.9, traefik · github.com/traefik/traefik +2)
- [CVE-2026-54761](https://cve.now/CVE-2026-54761.md): Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services (CVSS 6.0, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-53622](https://cve.now/CVE-2026-53622.md): Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts (CVSS 7.8, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-48491](https://cve.now/CVE-2026-48491.md): Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass (CVSS 7.8, traefik · github.com/traefik/traefik/v2 +1)
- [CVE-2026-48020](https://cve.now/CVE-2026-48020.md): Traefik StripPrefix Route-Level Auth Bypass via Path Normalization (CVSS 7.8, traefik · github.com/traefik/traefik/v2 +2)
- [CVE-2026-54555](https://cve.now/CVE-2026-54555.md): rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators (CVSS 7.8, rtk-ai rtk)
- [CVE-2026-45792](https://cve.now/CVE-2026-45792.md): RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM (CVSS 6.9, rtk-ai rtk · rtk)
- [CVE-2026-55249](https://cve.now/CVE-2026-55249.md): @rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String (CVSS 6.3, rtk-ai rtk)
- [CVE-2026-55736](https://cve.now/CVE-2026-55736.md): Private action arguments can be set by user input in Ash (CVSS 5.9, ash-project ash)
- [CVE-2026-53753](https://cve.now/CVE-2026-53753.md): Crawl4AI: AST Sandbox Escape via gi\_frame.f\_back Chain - Pre-Auth RCE in Docker API (CVSS 9.8, unclecode crawl4ai · crawl4ai)
- [CVE-2026-53754](https://cve.now/CVE-2026-53754.md): Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) (CVSS 7.5, unclecode crawl4ai · crawl4ai)
- [CVE-2026-53755](https://cve.now/CVE-2026-53755.md): Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check (CVSS 8.6, unclecode crawl4ai · crawl4ai)
- [CVE-2026-54320](https://cve.now/CVE-2026-54320.md): Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email (CVSS 8.4, daytonaio daytona)
- [CVE-2026-54321](https://cve.now/CVE-2026-54321.md): Daytona: Public sandbox previews remain accessible for up to one hour after being made private (CVSS 7.0, daytonaio daytona · github.com/daytonaio/daytona)
- [CVE-2026-54319](https://cve.now/CVE-2026-54319.md): Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape (CVSS 4.2, daytonaio daytona · github.com/daytonaio/daytona)
- [CVE-2026-54322](https://cve.now/CVE-2026-54322.md): Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles (CVSS 7.7, daytonaio daytona · github.com/daytonaio/daytona)
- [CVE-2026-54324](https://cve.now/CVE-2026-54324.md): Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join (CVSS 6.5, daytonaio daytona · github.com/daytonaio/daytona)
- [CVE-2026-54323](https://cve.now/CVE-2026-54323.md): Daytona: Git credential leak via git clone with TLS verification disabled (CVSS 5.9, daytonaio daytona)
- [CVE-2020-9695](https://cve.now/CVE-2020-9695.md): Acrobat Reader | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-9711](https://cve.now/CVE-2020-9711.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2026-45135](https://cve.now/CVE-2026-45135.md): Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files (CVSS 8.1, caddyserver caddy · github.com/caddyserver/caddy/v2)
- [CVE-2026-45692](https://cve.now/CVE-2026-45692.md): Caddy: Remote Admin Authorization Bypass in \`/config\` API via Array Index Normalization (CVSS 5.4, caddyserver caddy · github.com/caddyserver/caddy/v2)
- [CVE-2026-52845](https://cve.now/CVE-2026-52845.md): Caddy: FastCGI header normalization bypass in \`forward\_auth copy\_headers\` (CVSS 8.1, caddyserver caddy · github.com/caddyserver/caddy/v2 +1)
- [CVE-2026-52844](https://cve.now/CVE-2026-52844.md): Caddy: Windows \`file\_server\` path authorization bypass via encoded backslash (CVSS 7.5, caddyserver caddy · github.com/caddyserver/caddy/v2 +1)
- [CVE-2026-52846](https://cve.now/CVE-2026-52846.md): Caddy: stripHTML template function bypass (CVSS 4.2, caddyserver caddy · github.com/caddyserver/caddy/v2 +1)
- [CVE-2020-9713](https://cve.now/CVE-2020-9713.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2026-54157](https://cve.now/CVE-2026-54157.md): LobeHub: Unauthenticated SSRF in \`/webapi/proxy\` (CVSS 9.0, lobehub · @lobehub/lobehub)
- [CVE-2026-0864](https://cve.now/CVE-2026-0864.md): Configuration Injection via Carriage Return (\\r) in write() method (CVSS 4.1, Python Software Foundation CPython)
- [CVE-2026-54318](https://cve.now/CVE-2026-54318.md): Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location (CVSS 7.1, home-assistant core)
- [CVE-2026-54317](https://cve.now/CVE-2026-54317.md): Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN (CVSS 7.6, home-assistant core · homeassistant)
- [CVE-2026-53662](https://cve.now/CVE-2026-53662.md): immich: One-click account takeover via XSS in login page continue redirect (CVSS 9.6, immich-app immich)
- [CVE-2026-57062](https://cve.now/CVE-2026-57062.md): CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supp (CVSS 2.9, GnuPG)
- [CVE-2026-55517](https://cve.now/CVE-2026-55517.md): Deno: Denial of service via non-ASCII bytes in WebSocket response headers (CVSS 4.3, denoland deno · deno)
- [CVE-2026-44726](https://cve.now/CVE-2026-44726.md): Deno: TLS retry copies stale upgrade hook, risking plaintext traffic (CVSS 7.4, denoland deno · deno)
- [CVE-2026-49401](https://cve.now/CVE-2026-49401.md): Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) (CVSS 7.3, denoland deno · deno)
- [CVE-2025-71382](https://cve.now/CVE-2025-71382.md): MuPDF \< 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering (CVSS 7.1, ArtifexSoftware mupdf)
- [CVE-2026-49402](https://cve.now/CVE-2026-49402.md): Deno: Command Injection via spawnSync & spawn on Windows (CVSS 8.1, denoland deno · deno)
- [CVE-2026-49406](https://cve.now/CVE-2026-49406.md): Deno: BYONM module resolution allows \`package.json\` main path traversal to bypass \`--allow-read\` restrictions (CVSS 5.5, denoland deno · deno)
- [CVE-2026-49411](https://cve.now/CVE-2026-49411.md): Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks (CVSS 6.5, denoland deno · deno)
- [CVE-2026-49983](https://cve.now/CVE-2026-49983.md): Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access (CVSS 5.2, denoland deno · deno)
- [CVE-2026-49860](https://cve.now/CVE-2026-49860.md): Deno: WebSocket API sandbox bypass via missing post-DNS check (CVSS 5.2, denoland deno · deno)
- [CVE-2026-49859](https://cve.now/CVE-2026-49859.md): Deno: \`fetch()\` API sandbox bypass via missing DNS resolution check (CVSS 5.2, denoland deno · deno)
- [CVE-2026-49440](https://cve.now/CVE-2026-49440.md): Deno: Miller-Rabin Primality Test Allows Zero Rounds (CVSS 7.4, denoland deno · deno)
- [CVE-2026-54257](https://cve.now/CVE-2026-54257.md): Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow (CVSS 9.3, electron)
- [CVE-2026-54316](https://cve.now/CVE-2026-54316.md): Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch (CVSS 6.0, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2026-50221](https://cve.now/CVE-2026-50221.md): In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Hos (CVSS 5.3, OpenStack Swift · swift)
- [CVE-2026-54007](https://cve.now/CVE-2026-54007.md): Open WebUI: Cross-origin postMessage confirmation bypass via action:submit (CVSS 7.1, open-webui)
- [CVE-2026-54006](https://cve.now/CVE-2026-54006.md): Open WebUI: Calendar event re-parenting allows writing events into another user's calendar (CVSS 4.3, open-webui)
- [CVE-2026-54008](https://cve.now/CVE-2026-54008.md): Open WebUI: Redirect-Bypass SSRF in OAuth \`\_process\_picture\_url\` (CVSS 8.5, open-webui)
- [CVE-2026-54009](https://cve.now/CVE-2026-54009.md): Open WebUI: Cross-user file disclosure via /api/chat/completions image\_url field (CVSS 6.5, open-webui)
- [CVE-2026-54010](https://cve.now/CVE-2026-54010.md): Open WebUI: Forged chat-file link allows cross-user file read and deletion (CVSS 8.3, open-webui)
- [CVE-2026-54011](https://cve.now/CVE-2026-54011.md): Open WebUI: Stored XSS in Mermaid Markdown Preview (CVSS 8.7, open-webui)
- [CVE-2026-54012](https://cve.now/CVE-2026-54012.md): Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion (CVSS 7.1, open-webui)
- [CVE-2026-54013](https://cve.now/CVE-2026-54013.md): Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI (CVSS 7.6, open-webui)
- [CVE-2026-54014](https://cve.now/CVE-2026-54014.md): Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui (CVSS 4.3, open-webui)
- [CVE-2026-54015](https://cve.now/CVE-2026-54015.md): Open WebUI: Prompt history IDOR: unbound history\_id allows cross-prompt read and deletion (CVSS 6.4, open-webui)
- [CVE-2026-54016](https://cve.now/CVE-2026-54016.md): Open WebUI: Open WebUI BOLA: \`search\_knowledge\_files\` Allows Unauthorized Knowledge Base File Enumeration (CVSS 4.3, open-webui)
- [CVE-2026-54018](https://cve.now/CVE-2026-54018.md): Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects (CVSS 7.7, open-webui)
- [CVE-2026-54019](https://cve.now/CVE-2026-54019.md): Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode (CVSS 6.5, open-webui)
- [CVE-2026-57053](https://cve.now/CVE-2026-57053.md): GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna\_to\_unico (CVSS 4.0, GNU libidn)
- [CVE-2026-54021](https://cve.now/CVE-2026-54021.md): Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url\_idx path parameter (CVSS 6.3, open-webui)
- [CVE-2026-54022](https://cve.now/CVE-2026-54022.md): Open WebUI: Any authenticated user can read other users' private notes via Socket.IO (CVSS 5.3, open-webui)
- [CVE-2026-48520](https://cve.now/CVE-2026-48520.md): Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read (CVSS 6.1, langflow-ai langflow · langflow)
- [CVE-2026-33760](https://cve.now/CVE-2026-33760.md): Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints (CVSS 8.8, langflow-ai langflow · langflow)
- [CVE-2026-42867](https://cve.now/CVE-2026-42867.md): Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint (CVSS 6.5, langflow-ai langflow · langflow)
- [CVE-2026-55255](https://cve.now/CVE-2026-55255.md): Langflow: IDOR Vulnerability in \`/api/v1/responses\` Endpoint Allows Authenticated Attackers to Access Another User's Flow (CVSS 8.4, KEV, langflow-ai langflow · langflow)
- [CVE-2026-55423](https://cve.now/CVE-2026-55423.md): Langflow: Logout button does not clear session (CVSS 6.1, langflow-ai langflow · langflow)
- [CVE-2026-55446](https://cve.now/CVE-2026-55446.md): Langflow: Unauthenticated DoS through multipart form boundary file upload (CVSS 7.5, langflow-ai langflow · langflow)
- [CVE-2026-48519](https://cve.now/CVE-2026-48519.md): Langflow: Unauthenticated RCE in Shareable Playgrounds (CVSS 9.6, langflow-ai langflow · langflow)
- [CVE-2026-55447](https://cve.now/CVE-2026-55447.md): Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit (CVSS 9.6, langflow-ai langflow · langflow)
- [CVE-2026-56968](https://cve.now/CVE-2026-56968.md): GNU SASL before 2.2.4 lacks sanitization of a short challenge in \_gsasl\_ntlm\_client\_step in the NTLM client, which could result in memory di (CVSS 3.7, GNU SASL)
- [CVE-2026-55450](https://cve.now/CVE-2026-55450.md): Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak (CVSS 9.3, langflow-ai langflow · langflow)
- [CVE-2026-34913](https://cve.now/CVE-2026-34913.md): A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earl (CVSS 4.3, Revive Adserver)
- [CVE-2026-34917](https://cve.now/CVE-2026-34917.md): Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrict (CVSS 4.3, Revive Adserver)
- [CVE-2026-44956](https://cve.now/CVE-2026-44956.md): Low‑privileged users could use their Full Name as a vector for a stored XSS attack. (CVSS 0.0, Revive Adserver)
- [CVE-2026-34916](https://cve.now/CVE-2026-34916.md): A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t (CVSS 8.8, Revive Adserver)
- [CVE-2026-34914](https://cve.now/CVE-2026-34914.md): A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. (CVSS 8.3, Revive Adserver)
- [CVE-2026-44958](https://cve.now/CVE-2026-44958.md): An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when (CVSS 5.4, Revive Adserver)
- [CVE-2026-44961](https://cve.now/CVE-2026-44961.md): The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. (CVSS 0.0, Revive Adserver)
- [CVE-2026-44960](https://cve.now/CVE-2026-44960.md): A stored XSS can be exploited by leveraging the usernames as an attack vector. (CVSS 0.0, Revive Adserver)
- [CVE-2026-44957](https://cve.now/CVE-2026-44957.md): A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. (CVSS 4.3, Revive Adserver)
- [CVE-2026-34912](https://cve.now/CVE-2026-34912.md): A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and (CVSS 4.3, Revive Adserver)
- [CVE-2026-44959](https://cve.now/CVE-2026-44959.md): A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. (CVSS 8.8, Revive Adserver)
- [CVE-2026-34915](https://cve.now/CVE-2026-34915.md): A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t (CVSS 6.1, Revive Adserver)
- [CVE-2026-56117](https://cve.now/CVE-2026-56117.md): dhcpcd Heap Use-After-Free via Control Socket Handling (CVSS 5.7, NetworkConfiguration dhcpcd)
- [CVE-2026-50019](https://cve.now/CVE-2026-50019.md): yt-dlp: File Downloader cookie leak with curl (CVSS 6.1, yt-dlp)
- [CVE-2025-13162](https://cve.now/CVE-2025-13162.md): Advant Master Online Builder DLL vulnerability (CVSS 4.4, ABB Control Builder A · ABB 800xA for Advant Master)
- [CVE-2026-56116](https://cve.now/CVE-2026-56116.md): dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling (CVSS 7.1, NetworkConfiguration dhcpcd)
- [CVE-2026-50574](https://cve.now/CVE-2026-50574.md): yt-dlp: Arbitrary code execution via manifest downloads with aria2c (CVSS 8.3, yt-dlp)
- [CVE-2026-56115](https://cve.now/CVE-2026-56115.md): Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass (CVSS 8.7, garybowers bootimus)
- [CVE-2026-50023](https://cve.now/CVE-2026-50023.md): yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) (CVSS 8.3, yt-dlp)
- [CVE-2026-56114](https://cve.now/CVE-2026-56114.md): dhcpcd Stack Out-of-Bounds Write in dhcp6\_makemessage() (CVSS 6.0, NetworkConfiguration dhcpcd)
- [CVE-2026-56113](https://cve.now/CVE-2026-56113.md): dhcpcd Heap Use-After-Free in dhcp6\_deprecateaddrs via DHCPv6 RENEW (CVSS 6.0, NetworkConfiguration dhcpcd)
- [CVE-2026-11940](https://cve.now/CVE-2026-11940.md): tarfile extraction filter bypass allows escaping the destination directory (CVSS 7.8, Python Software Foundation CPython)
- [CVE-2026-12958](https://cve.now/CVE-2026-12958.md): Arbitrary file write in Language Servers for AWS (CVSS 8.5, Amazon Web Services Language Servers for AWS · @aws/lsp-cod…)
- [CVE-2026-12957](https://cve.now/CVE-2026-12957.md): Arbitrary Code Execution in Language Servers for AWS (CVSS 8.5, Amazon Web Services Language Servers for AWS · @aws/lsp-cod…)
- [CVE-2026-13007](https://cve.now/CVE-2026-13007.md): Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure (CVSS 7.5, Tenable Identity Exposure)
- [CVE-2026-44792](https://cve.now/CVE-2026-44792.md): n8n: Source Control Pull SQL Injection (CVSS 8.9, n8n-io n8n · n8n)
- [CVE-2026-44791](https://cve.now/CVE-2026-44791.md): n8n: XML Node Prototype Pollution Patch Bypass (CVSS 9.4, n8n-io n8n · n8n)
- [CVE-2026-44790](https://cve.now/CVE-2026-44790.md): n8n: Arbitrary File Read via Git Node (CVSS 9.4, n8n-io n8n · n8n)
- [CVE-2026-44789](https://cve.now/CVE-2026-44789.md): n8n: HTTP Request Node Pagination Prototype Pollution to RCE (CVSS 9.4, n8n-io n8n · n8n)
- [CVE-2026-45732](https://cve.now/CVE-2026-45732.md): n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints (CVSS 8.3, n8n-io n8n · n8n)
- [CVE-2026-49444](https://cve.now/CVE-2026-49444.md): n8n: Python sandbox escape (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-49465](https://cve.now/CVE-2026-49465.md): n8n: Git Node Clone and Push Operations Bypass File Sandbox (CVSS 6.0, n8n-io n8n · n8n)
- [CVE-2026-54304](https://cve.now/CVE-2026-54304.md): n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-54307](https://cve.now/CVE-2026-54307.md): n8n: Credential Exfiltration via Permission Bypass (CVSS 8.5, n8n-io n8n · n8n)
- [CVE-2026-54302](https://cve.now/CVE-2026-54302.md): n8n: Stored XSS in Chat Trigger Node (CVSS 7.0, n8n-io n8n · n8n)
- [CVE-2026-54305](https://cve.now/CVE-2026-54305.md): n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints (CVSS 8.9, n8n-io n8n · n8n)
- [CVE-2026-54301](https://cve.now/CVE-2026-54301.md): n8n: Same-Origin XSS in Respond to Webhook Node (CVSS 7.0, n8n-io n8n · n8n)
- [CVE-2026-54306](https://cve.now/CVE-2026-54306.md): n8n: Prototype Pollution enables confused-deputy execution via public webhooks (CVSS 6.3, n8n-io n8n · n8n)
- [CVE-2026-54308](https://cve.now/CVE-2026-54308.md): n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node (CVSS 6.3, n8n-io n8n · n8n)
- [CVE-2026-54311](https://cve.now/CVE-2026-54311.md): n8n: Merge Node SQL Mode Prototype Pollution (CVSS 6.0, n8n-io n8n · n8n)
- [CVE-2026-54310](https://cve.now/CVE-2026-54310.md): n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes (CVSS 6.5, n8n-io n8n · n8n)
- [CVE-2026-56696](https://cve.now/CVE-2026-56696.md): OpenHarness - Prompt Injection via /issue and /pr\_comments Slash Commands (CVSS 5.3, HKUDS OpenHarness · openharness-ai)
- [CVE-2026-54309](https://cve.now/CVE-2026-54309.md): n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions (CVSS 8.8, n8n-io n8n · n8n)
- [CVE-2026-56695](https://cve.now/CVE-2026-56695.md): OpenHarness - Cross-Session Disclosure via /resume and /summary Commands (CVSS 7.1, HKUDS OpenHarness · openharness-ai)
- [CVE-2026-56694](https://cve.now/CVE-2026-56694.md): NanoClaw \< 2.1.0 - Privilege Escalation via Forged Channel Approval Callback (CVSS 5.3, nanocoai nanoclaw)
- [CVE-2026-56693](https://cve.now/CVE-2026-56693.md): NanoClaw \< 2.1.17 - Privilege Escalation via Unauthorized create\_agent System Action (CVSS 6.8, nanocoai nanoclaw)
- [CVE-2026-56692](https://cve.now/CVE-2026-56692.md): NanoClaw \< 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles (CVSS 6.8, nanocoai nanoclaw)
- [CVE-2026-56402](https://cve.now/CVE-2026-56402.md): NanoClaw \< 2.1.17 - Privilege Escalation via Unverified Approval Response Handler (CVSS 7.1, nanocoai nanoclaw)
- [CVE-2026-54314](https://cve.now/CVE-2026-54314.md): n8n: Denial of Service via ZIP decompression in webhook workflow (CVSS 6.3, n8n-io n8n · n8n)
- [CVE-2026-54312](https://cve.now/CVE-2026-54312.md): n8n: Microsoft SQL Node Prototype Pollution (CVSS 7.2, n8n-io n8n · n8n)
- [CVE-2026-54303](https://cve.now/CVE-2026-54303.md): n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints (CVSS 6.8, n8n-io n8n · n8n)
- [CVE-2026-54313](https://cve.now/CVE-2026-54313.md): n8n: NoSQL Injection in MongoDB Node Find And Replace Operation (CVSS 6.5, n8n-io n8n · n8n)
- [CVE-2025-15619](https://cve.now/CVE-2025-15619.md): HCL Connections is vulnerable to broken access control (CVSS 3.5, HCLSoftware Connections)
- [CVE-2026-55766](https://cve.now/CVE-2026-55766.md): guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization (CVSS 4.8, guzzle psr7 · guzzlehttp/psr7)
- [CVE-2026-55767](https://cve.now/CVE-2026-55767.md): Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle (CVSS 5.8, guzzle · guzzlehttp/guzzle)
- [CVE-2026-55568](https://cve.now/CVE-2026-55568.md): Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext (CVSS 5.9, guzzle · guzzlehttp/guzzle)
- [CVE-2025-62180](https://cve.now/CVE-2025-62180.md): Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs. (CVSS 7.1, Pegasystems Pega Infinity)
- [CVE-2026-27604](https://cve.now/CVE-2026-27604.md): FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions (CVSS 10.0, FOSSBilling)
- [CVE-2026-28496](https://cve.now/CVE-2026-28496.md): FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE (CVSS 9.4, FOSSBilling)
- [CVE-2026-56815](https://cve.now/CVE-2026-56815.md): pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Hom (CVSS 7.4, rasta-mouse pwnlift)
- [CVE-2026-35019](https://cve.now/CVE-2026-35019.md): NetComm NF20MESH \< R6B032 Hardcoded AES Key Authentication Bypass (CVSS 9.2, NetComm Wireless Pty NF20MESH)
- [CVE-2026-35018](https://cve.now/CVE-2026-35018.md): NetComm NF20MESH \< R6B032 Authenticated RCE via OS Command Injection (CVSS 8.7, NetComm Wireless Pty NF20MESH)
- [CVE-2026-11772](https://cve.now/CVE-2026-11772.md): Reflected XSS in DRIMO CMS (CVSS 5.1, DRIMO CMS)
- [CVE-2026-12969](https://cve.now/CVE-2026-12969.md): Dnsmasq: dnsmasq: out-of-bounds read in find\_soa() due to missing extrabytes validation (CVSS 5.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-10609](https://cve.now/CVE-2026-10609.md): Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization (CVSS 6.8, Logging Subsystem for Red Hat OpenShift · github.com/opensh…)
- [CVE-2026-4610](https://cve.now/CVE-2026-4610.md): ProfileGrid \<= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content (CVSS 6.4, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2026-54892](https://cve.now/CVE-2026-54892.md): Plug: quadratic-time decoding of nested query/body parameters enables denial of service (CVSS 8.7, elixir-plug plug)
- [CVE-2026-10857](https://cve.now/CVE-2026-10857.md): Reflected XSS in Akinsoft's e-Commerce (CVSS 6.1, AKIN Software Computer Import Export Industry and Trade e-C…)
- [CVE-2026-56784](https://cve.now/CVE-2026-56784.md): OpenRemote \< 1.25.0 IDOR via Bulk Alarm Deletion Endpoint (CVSS 8.6, openremote · io.openremote:openremote-manager)
- [CVE-2026-56762](https://cve.now/CVE-2026-56762.md): Hono - Missing Cookie Name Validation in setCookie() (CVSS 6.9, Hono)
- [CVE-2026-56701](https://cve.now/CVE-2026-56701.md): Grav - XML External Entity Injection via SVG Upload (CVSS 7.1, Grav · getgrav/grav)
- [CVE-2026-56379](https://cve.now/CVE-2026-56379.md): ImageMagick - Command Injection via SVG Decoder (CVSS 9.2, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56376](https://cve.now/CVE-2026-56376.md): ImageMagick - Heap Use-After-Free in Meta Coder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56371](https://cve.now/CVE-2026-56371.md): ImageMagick - Memory Leak in TXT File Processing via Texture Attribute (CVSS 6.9, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56322](https://cve.now/CVE-2026-56322.md): Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter (CVSS 8.7, Capgo)
- [CVE-2026-56315](https://cve.now/CVE-2026-56315.md): picklescan - Remote Code Execution via Unblocked Standard Library Modules (CVSS 9.3, picklescan)
- [CVE-2026-56301](https://cve.now/CVE-2026-56301.md): Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux (CVSS 6.8, Nuxt)
- [CVE-2026-56275](https://cve.now/CVE-2026-56275.md): Flowise - Server-Side Request Forgery via Execute Flow Base URL (CVSS 6.0, Flowise · flowise-components)
- [CVE-2026-56274](https://cve.now/CVE-2026-56274.md): Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess (CVSS 8.7, Flowise · flowise-components)
- [CVE-2026-56263](https://cve.now/CVE-2026-56263.md): Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard (CVSS 5.3, Crawl4AI)
- [CVE-2026-56258](https://cve.now/CVE-2026-56258.md): Crawl4AI - Arbitrary File Write via output\_path Symlink and TOCTOU (CVSS 9.2, Crawl4AI)
- [CVE-2026-56248](https://cve.now/CVE-2026-56248.md): Capgo - Unauthenticated Denial-of-Service via audit\_logs RLS Policy (CVSS 8.7, Cap-go capgo)
- [CVE-2026-56243](https://cve.now/CVE-2026-56243.md): Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane (CVSS 8.6, Capgo)
- [CVE-2026-56234](https://cve.now/CVE-2026-56234.md): Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint (CVSS 6.9, Capgo)
- [CVE-2026-56225](https://cve.now/CVE-2026-56225.md): Capgo - Authorization Bypass in API Key Management via App-Limited Keys (CVSS 8.7, Capgo)
- [CVE-2026-56222](https://cve.now/CVE-2026-56222.md): Capgo - Cross-Organization App Takeover via Mismatched org\_id and app\_id in /private/role\_bindings (CVSS 8.6, Capgo)
- [CVE-2025-71376](https://cve.now/CVE-2025-71376.md): picklescan - Arbitrary Code Execution via Undetected idlelib.autocomplete.AutoComplete.fetch\_completions (CVSS 7.6, picklescan)
- [CVE-2025-71370](https://cve.now/CVE-2025-71370.md): picklescan - Remote Code Execution via torch.jit.unsupported\_tensor\_ops.execWrapper (CVSS 7.6, picklescan)
- [CVE-2025-71365](https://cve.now/CVE-2025-71365.md): picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection Bypass (CVSS 7.6, picklescan)
- [CVE-2025-71341](https://cve.now/CVE-2025-71341.md): picklescan - Remote Code Execution via Undetected profile.Profile.runctx (CVSS 7.6, picklescan)
- [CVE-2025-71337](https://cve.now/CVE-2025-71337.md): Flowise - Unverified Email Change via Account Profile Endpoint (CVSS 8.7, Flowise · flowise-ui)
- [CVE-2023-54365](https://cve.now/CVE-2023-54365.md): Traefik - Denial of Service via HTTP/2 Request Handling (CVSS 8.7, Traefik · github.com/traefik/traefik)
- [CVE-2026-10711](https://cve.now/CVE-2026-10711.md): RCE in Akınsoft's CafePlus (CVSS 8.8, AKIN Software Computer Import Export Industry and Trade Caf…)
- [CVE-2026-44089](https://cve.now/CVE-2026-44089.md): Buffer Overflow in Totolink EX1200L router (CVSS 9.4, Totolink EX1200L)
- [CVE-2026-4983](https://cve.now/CVE-2026-4983.md): Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml (CVSS 4.1, Eclipse Foundation Eclipse Open VSX)
- [CVE-2026-11374](https://cve.now/CVE-2026-11374.md): Account Takeover via Predictable SSO Ticket Generation (CVSS 9.0, zohocorp manageengine\_adselfservice\_plus · zohocorp mana… +2)
- [CVE-2026-10521](https://cve.now/CVE-2026-10521.md): Authenticated unintended access to critical program parameters (CVSS 8.6, MB connect line mbCONNECT24 · MB connect line mymbCONNECT24)
- [CVE-2026-9733](https://cve.now/CVE-2026-9733.md): Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter (CVSS 9.1, HAYAJO Mojolicious::Plugin::Web::Auth::OAuth2)
- [CVE-2026-8379](https://cve.now/CVE-2026-8379.md): Frontend File Manager Plugin \<= 23.6 - Unauthenticated Arbitrary File Download (CVSS 7.5, Frontend File Manager Plugin)
- [CVE-2026-8378](https://cve.now/CVE-2026-8378.md): Frontend File Manager Plugin \<= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename (CVSS 5.4, Frontend File Manager Plugin)
- [CVE-2026-8172](https://cve.now/CVE-2026-8172.md): Simple Basic Contact Form \<= 20250114 - Reflected XSS (CVSS 7.1, Simple Basic Contact Form)
- [CVE-2026-8163](https://cve.now/CVE-2026-8163.md): Infility Global \< 2.15.19 - Subscriber+ SQL Injection via order Parameter (CVSS 8.8, Infility Global)
- [CVE-2026-7842](https://cve.now/CVE-2026-7842.md): Infility Global \< 2.15.20 - Editor+ SQL Injection via orderby Parameter (CVSS 6.8, Infility Global)
- [CVE-2026-12866](https://cve.now/CVE-2026-12866.md): All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. (CVSS 9.2, expr-eval · org.webjars.npm:expr-eval)
- [CVE-2026-55654](https://cve.now/CVE-2026-55654.md): Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination (CVSS 3.7, Red Hat Enterprise Linux · Red Hat Hardened Images +2)
- [CVE-2026-55655](https://cve.now/CVE-2026-55655.md): Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions (CVSS 5.0, Red Hat Enterprise Linux · Red Hat Hardened Images +3)
- [CVE-2026-55653](https://cve.now/CVE-2026-55653.md): Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to… (CVSS 4.3, Red Hat Enterprise Linux · Red Hat Hardened Images +3)
- [CVE-2026-11833](https://cve.now/CVE-2026-11833.md): Overview: A vulnerability has been found in FAST/TOOLS and CI Server. (CVSS 8.2, Yokogawa Electric FAST/TOOLS · Yokogawa Electric CI Server)
- [CVE-2025-55639](https://cve.now/CVE-2025-55639.md): GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf\_isom\_add\_track\_kind() function at isomedia/isom\_write.c. (CVSS 6.5)
- [CVE-2025-61018](https://cve.now/CVE-2025-61018.md): An issue in the sqlo\_place\_dt\_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2025-61019](https://cve.now/CVE-2025-61019.md): An issue in the sqlo\_key\_part\_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2025-61020](https://cve.now/CVE-2025-61020.md): An issue in the sqlo\_strip\_in\_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2025-61021](https://cve.now/CVE-2025-61021.md): An issue in the sqlo\_natural\_join\_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) (CVSS 7.5)
- [CVE-2025-61022](https://cve.now/CVE-2025-61022.md): An issue in the sqlo\_tb\_col\_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via (CVSS 7.5)
- [CVE-2025-61023](https://cve.now/CVE-2025-61023.md): An issue in the st\_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted (CVSS 7.5)
- [CVE-2025-61024](https://cve.now/CVE-2025-61024.md): An issue in the sqlo\_try\_in\_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via c (CVSS 7.5)
- [CVE-2025-61025](https://cve.now/CVE-2025-61025.md): An issue in the sslr\_qst\_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craft (CVSS 7.5)
- [CVE-2025-61027](https://cve.now/CVE-2025-61027.md): An issue in the t\_set\_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted (CVSS 7.5)
- [CVE-2025-61028](https://cve.now/CVE-2025-61028.md): An issue in the time\_t\_to\_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via craft (CVSS 7.5)
- [CVE-2025-61029](https://cve.now/CVE-2025-61029.md): An issue in the sqlo\_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted (CVSS 7.5)
- [CVE-2026-39253](https://cve.now/CVE-2026-39253.md): An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Cl (CVSS 8.1)
- [CVE-2026-52673](https://cve.now/CVE-2026-52673.md): SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues comp (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.