CVEs published June 27, 2026
33 CVEs were published on June 27, 2026: 1 critical, 10 high.
- Published
- 33
- Critical
- 1
- High
- 10
- Medium
- 22
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- FreeBSD
- 7
- dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…
- 2
- HCLSoftware Traveler for Microsoft Outlook
- 2
- trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- 2
- CodePeople Post Map for Google Maps
- 1
- dornaweb Product Specifications for Woocommerce
- 1
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- 1
- gpriday Page Builder by SiteOrigin
- 1
- harmonic_design HD Quiz
- 1
- jegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…
- 1
Critical 1
High 10
- CVE-2026-8095Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletionnmedia Frontend File Manager Plugin
- CVE-2026-10643Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)zephyrproject zephyr
- CVE-2026-49416Integer overflow in vt(4) CONS_HISTORY ioctlFreeBSD
- CVE-2026-49414ASLR bypass for setuid executables via procctl(2)FreeBSD
- CVE-2026-49413Flaw in Linuxulator execution of setugid binariesFreeBSD
- CVE-2026-49412Use-after-free bug in the IPV6_MSFILTER socket option handlerFreeBSD
- CVE-2026-45258Multiple vulnerabilities in the sound(4) mmap pathFreeBSD
- CVE-2026-49417Multiple vulnerabilities in the sound(4) mmap pathFreeBSD
- CVE-2026-10820ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDORPaid Membership Plugin, Ecommerce, User Registration Form,…
- CVE-2023-37524HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of serviceHCLSoftware Traveler for Microsoft Outlook
Medium, low and unrated 22
- CVE-2026-45259sigqueue(2) missing capability mode restrictionFreeBSD
- CVE-2026-12399Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameterjegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…
- CVE-2026-3462Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modificationreepaydenmark Frisbii Pay
- CVE-2026-12432Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameterthemeisle Stripe Payment Forms by WP Full Pay – Accept Cred…
- CVE-2026-11597Surbma | Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesSurbma | Infusionsoft Shortcode
- CVE-2026-13295Page Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parametergpriday Page Builder by SiteOrigin
- CVE-2026-12471Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activationtemplatescoderthemes Spexo
- CVE-2026-11773Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement ModificationMasteriyo LMS – LMS Course Builder, Quizzes & Certificates
- CVE-2026-9233Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Actionexpresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- CVE-2026-11364Product Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actionsdornaweb Product Specifications for Woocommerce
- CVE-2026-11783Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKUdokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…
- CVE-2026-9242RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Requestmetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2026-11987Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameterdokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…
- CVE-2026-9677Shariff for WordPress <= 1.0.11 - Admin+ Stored Cross-Site ScriptingShariff for WordPress
- CVE-2026-12404NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Classwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-13245MaxButtons <= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parametermaxfoundry MaxButtons – Create buttons
- CVE-2025-59868HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposureHCLSoftware Traveler for Microsoft Outlook
- CVE-2026-13422HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlersharmonic_design HD Quiz
- CVE-2026-11356Ivory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settingsvinod-dalvi Ivory Search – WordPress Search Plugin
- CVE-2026-13333Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parametertrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2026-13335CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post MetaCodePeople Post Map for Google Maps
- CVE-2026-13331Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parametertrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…