# CVEs published 2026-06-28 44 CVEs were published on June 28, 2026: 1 critical, 7 high. Days are UTC. - [CVE-2026-13516](https://cve.now/CVE-2026-13516.md): Tenda JD12L WifiGuestSet fromSetWifiGusetBasic stack-based overflow (CVSS 8.7, Tenda JD12L) - [CVE-2026-13515](https://cve.now/CVE-2026-13515.md): Tenda JD12L SetPptpServerCfg formSetPPTPServer stack-based overflow (CVSS 8.7, Tenda JD12L) - [CVE-2026-13514](https://cve.now/CVE-2026-13514.md): Chess Play and Learn App com.chess AndroidManifest.xml backup (CVSS 2.4, Chess Play and Learn App) - [CVE-2026-13513](https://cve.now/CVE-2026-13513.md): MyScale MyScaleDB SegmentId.h getCacheKey data authenticity (CVSS 2.3, MyScaleDB) - [CVE-2026-13512](https://cve.now/CVE-2026-13512.md): Databend Tenant client\_session\_manager.rs state\_key authorization (CVSS 5.3, Databend) - [CVE-2026-13511](https://cve.now/CVE-2026-13511.md): VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization (CVSS 2.3, VoltAgent) - [CVE-2026-13510](https://cve.now/CVE-2026-13510.md): SimStudioAI sim Password Protection deployment.ts weak hash (CVSS 6.3, SimStudioAI sim) - [CVE-2026-13509](https://cve.now/CVE-2026-13509.md): RAGapp Knowledge File files.py FileHandler.remove\_file path traversal (CVSS 5.3, RAGapp) - [CVE-2026-13508](https://cve.now/CVE-2026-13508.md): khoj-ai khoj Conversation Sharing api\_chat.py authorization (CVSS 5.1, khoj-ai khoj) - [CVE-2026-13507](https://cve.now/CVE-2026-13507.md): volcengine OpenViking Local VectorDB Primary-key Label str\_to\_uint64.py str\_to\_uint64 data authenticity (CVSS 2.3, volcengine OpenViking) - [CVE-2026-49048](https://cve.now/CVE-2026-49048.md): Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla \< 6.4.1 (CVSS 8.7, joomcoder.com JoomCCK extension for Joomla) - [CVE-2026-13504](https://cve.now/CVE-2026-13504.md): code-projects Project Management System Mail Compose mail.php cross site scripting (CVSS 5.1, code-projects Project Management System) - [CVE-2026-13503](https://cve.now/CVE-2026-13503.md): antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal (CVSS 6.9, ANTLR4) - [CVE-2026-13502](https://cve.now/CVE-2026-13502.md): antlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctou (CVSS 2.0, ANTLR4) - [CVE-2026-13501](https://cve.now/CVE-2026-13501.md): antlr ANTLR4 gofmt GoTarget.java GoTarget command injection (CVSS 4.8, ANTLR4) - [CVE-2026-13500](https://cve.now/CVE-2026-13500.md): antlr ANTLR4 Grammar Action Block OutputFile.java code injection (CVSS 6.9, ANTLR4) - [CVE-2026-13499](https://cve.now/CVE-2026-13499.md): yashpokharna2555 restaurent-management-system Registration login\_register.php cross site scripting (CVSS 5.3, yashpokharna2555 restaurent-management-system) - [CVE-2026-13498](https://cve.now/CVE-2026-13498.md): yashpokharna2555 restaurent-management-system POST Parameter forgotpassword.php sql injection (CVSS 6.9, yashpokharna2555 restaurent-management-system) - [CVE-2026-13497](https://cve.now/CVE-2026-13497.md): itsourcecode Hospital Management System appointment.php sql injection (CVSS 5.3, itsourcecode Hospital Management System) - [CVE-2026-13496](https://cve.now/CVE-2026-13496.md): itsourcecode Hospital Management System ajaxmedicine.php sql injection (CVSS 5.3, itsourcecode Hospital Management System) - [CVE-2026-13495](https://cve.now/CVE-2026-13495.md): itsourcecode Hospital Management System adminprofile.php sql injection (CVSS 5.1, itsourcecode Hospital Management System) - [CVE-2026-13493](https://cve.now/CVE-2026-13493.md): AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation\_api.py resource injection (CVSS 2.3, AIDC-AI ComfyUI-Copilot) - [CVE-2026-13491](https://cve.now/CVE-2026-13491.md): 78 xiaozhi-esp32 MQTT Goodbye mqtt\_protocol.cc GetInstance denial of service (CVSS 6.3, 78 xiaozhi-esp32) - [CVE-2026-13490](https://cve.now/CVE-2026-13490.md): glpi-project glpi Document document.send.php canViewFile authorization (CVSS 6.3, glpi-project glpi) - [CVE-2026-13489](https://cve.now/CVE-2026-13489.md): 78 xiaozhi-esp32 MCP Response mcp\_server.cc ParseMessage improper synchronization (CVSS 2.3, 78 xiaozhi-esp32) - [CVE-2026-13488](https://cve.now/CVE-2026-13488.md): SourceCodester Class and Exam Timetabling System preview7.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System) - [CVE-2026-13487](https://cve.now/CVE-2026-13487.md): SourceCodester Class and Exam Timetabling System archive.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System) - [CVE-2026-13486](https://cve.now/CVE-2026-13486.md): SourceCodester Class and Exam Timetabling System preview6.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System) - [CVE-2026-13485](https://cve.now/CVE-2026-13485.md): SourceCodester Class and Exam Timetabling System preview.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System) - [CVE-2026-13484](https://cve.now/CVE-2026-13484.md): MLflow Experiment-scoped Label Schema CRUD API authorization (CVSS 2.3, MLflow) - [CVE-2026-13483](https://cve.now/CVE-2026-13483.md): arc53 DocsGPT Credential Storage encryption.py encrypt\_credentials data authenticity (CVSS 2.3, arc53 DocsGPT) - [CVE-2026-13482](https://cve.now/CVE-2026-13482.md): skypilot-org skypilot User ID server.py username.encode weak hash (CVSS 6.3, skypilot-org skypilot) - [CVE-2026-10593](https://cve.now/CVE-2026-10593.md): Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling (CVSS 6.5, zephyrproject zephyr) - [CVE-2026-10646](https://cve.now/CVE-2026-10646.md): Use-after-return in \`zsock\_getaddrinfo()\` when a timed-out DNS query is retried without cancellation (CVSS 7.4, zephyrproject zephyr) - [CVE-2026-10644](https://cve.now/CVE-2026-10644.md): Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer (CVSS 4.2, zephyrproject zephyr) - [CVE-2026-58058](https://cve.now/CVE-2026-58058.md): Nmap - Integer Underflow in IPv6 Extension Header Parsing (CVSS 6.5, Nmap) - [CVE-2026-58057](https://cve.now/CVE-2026-58057.md): Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity (CVSS 5.0, Flowise) - [CVE-2026-58056](https://cve.now/CVE-2026-58056.md): RustDesk - FileTransfer Session Authorization Scope Bypass (CVSS 7.6, RustDesk) - [CVE-2026-58055](https://cve.now/CVE-2026-58055.md): nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length (CVSS 5.4, nghttp2) - [CVE-2026-58053](https://cve.now/CVE-2026-58053.md): Gitea act\_runner - Container Hardening Bypass via Workflow Container Options (CVSS 9.9, Gitea act\_runner) - [CVE-2026-58052](https://cve.now/CVE-2026-58052.md): 7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision (CVSS 3.3, 7-Zip) - [CVE-2026-58051](https://cve.now/CVE-2026-58051.md): libssh2 - Free of Uninitialized Pointer in publickey List Cleanup (CVSS 6.5, libssh2) - [CVE-2026-58050](https://cve.now/CVE-2026-58050.md): libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation (CVSS 7.0, libssh2) - [CVE-2026-58049](https://cve.now/CVE-2026-58049.md): FFmpeg - Out-of-Bounds Write in RASC Decoder decode\_dlta() (CVSS 8.6, FFmpeg) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2026-06-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.