Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,539 results · page 140 of 771
Jun 15, 2026Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.CVE-2026-39519 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.CVE-2026-39512 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.
- Affected
- up to 2.8.152
- What to do
- Affects up to 2.8.152. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.CVE-2026-39511 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.
- Affected
- up to 9.1.08.001
- What to do
- Affects up to 9.1.08.001. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.CVE-2026-39502 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.
- Affected
- up to 1.15.38
- What to do
- Affects up to 1.15.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.CVE-2026-39493 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.
- Affected
- up to 1.6.9.27
- What to do
- Affects up to 1.6.9.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.CVE-2026-39492 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.CVE-2026-39465 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.
- Affected
- up to 3.106.0
- What to do
- Affects up to 3.106.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.CVE-2026-39441 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.CVE-2026-34901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.CVE-2026-27053 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings.CVE-2026-50890 · Other software · reported by MITRECritical 9.8
Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via suppCVE-2026-50887 · Other software · reported by MITRECritical 9.1
A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST requesCVE-2026-50886 · Other software · reported by MITRECritical 9.1
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts via a crafted payload.CVE-2026-50883 · Other software · reported by MITRECritical 9.6
An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts via a crafted payload.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.CVE-2026-50880 · Other software · reported by MITRECritical 9.8
An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code via uploading a craftCVE-2026-50873 · Other software · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code via uploading a crafted HTML or SVG file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive informaCVE-2026-50872 · Other software · reported by MITRECritical 9.8
An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbCVE-2026-50871 · Other software · reported by MITRECritical 9.8
An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.CVE-2026-50869 · Other software · reported by MITRECritical 9.8
An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorizeCVE-2026-49952 · Other software · Discuz! · reported by VulnCheckCritical 9.3
Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.
- Product
- Discuz! X5.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitee.comkarmainsecurity.com
Jun 15, 2026Metacat is data repository software that helps researchers preserve, share, and discover data.CVE-2026-48114 · Other software · NCEAS · reported by GitHubCritical 9.8
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.
- Product
- metacat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory.CVE-2026-45390 · Other software · reported by MITRECritical 9.1
In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar(1) rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file writes outside of the desired extraction directory (to an attacker that can reach a tar decompression endpoint).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certifiCVE-2026-45388 · Other software · reported by MITRECritical 9.1
In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certificates that are not meant for server authentication (because of KeyUsage and ExtendedKeyUsage).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function.CVE-2026-39196 · Other software · reported by MITRECritical 9.8
Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive database information via crafted SQL statements.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.CVE-2026-39006 · Other software · reported by MITRECritical 9.8
An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint.CVE-2026-38812 · Other software · reported by MITRECritical 9.8
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin.CVE-2026-38329 · Other software · reported by MITRECritical 9.8
Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.CVE-2026-38065 · Other software · reported by MITRECritical 9.8
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.CVE-2026-38064 · Other software · reported by MITRECritical 9.8
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.CVE-2026-38063 · Other software · reported by MITRECritical 9.8
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.CVE-2026-38062 · Other software · reported by MITRECritical 9.8
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.CVE-2026-38061 · Other software · reported by MITRECritical 9.8
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.CVE-2026-38060 · Other software · reported by MITRECritical 9.8
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange.CVE-2026-36537 · Other software · reported by MITRECritical 9.8
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote attacker can bypass authentication and gain full access to any existing user account on the platform without possessing the target user's credentials. This results in a complete account takeover.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2026remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.CVE-2026-30121 · Other software · Remotion · reported by MITRECritical 9.1
remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.
- Product
- Remotion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.CVE-2026-30120 · Other software · Remotion · reported by MITRECritical 9.8
remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.
- Product
- Remotion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service.CVE-2026-9862 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffCritical 9.8
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
- Product
- Core Privileged Access Manager (BoKS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026WooCommerce PDF Invoice Builder: Improper Control of Generation of Code ('Code Injection')CVE-2026-52704 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbCVE-2018-25436 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code execution.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to CVE-2026-5482 · Other software · Tecrail · reported by cvd@cert.plCritical 9.3
Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution. This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0
- Product
- Responsive FileManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in.CVE-2026-49757 · Other software · team-alembic · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbCritical 9.2
Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the email field, or a user-defined sign-in filter) rather than by the OpenID Connect iss/sub claim combination. Per OpenID Connect Core §5.7, only iss/sub uniquely and stably identifies an end-user; other claims, including email, MUST NOT be used as unique identifiers. A provider login presenting a victim's email, including an unverified email, a reused email, or an account with email_verified: false, resolved to and signed in as the victim's existing local account. An unauthenticated attacker who can register an account on any accepted OAuth provider with the victim's email (or who benefits from provider-side email reuse or reclamation) obtains the victim's full local privileges. The fix resolves users by the (strategy, sub) identity stored in a user identity resource, and only links a new sub to an existing local account by email when the provider's email_verified claim is trusted (trust_email_verified?). This issue affects as
- Product
- ash_authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Jun 15, 2026WP MAPS PRO: Registers an unauthenticated AJAX action whichCVE-2026-8935 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
- Product
- WP MAPS PRO
- Fixed in
- 6.1.1
- What to do
- Update WP MAPS PRO to 6.1.1 or newer.
Jun 14, 2026GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle.CVE-2026-11526 · Other software · RURBAN · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. _make_filehandle is the single open path behind every filename-accepting constructor (new, newFromPng, newFromJpeg, and the rest); the in-memory *Data variants do not open a path and are unaffected. Any caller that forwards untrusted input to one of these constructors as a pathname can run an arbitrary command or truncate a file under the process UID.
- Product
- GD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Jun 13, 2026Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the sysCVE-2026-12183 · Other software · Nefteprodukttekhnika LLC · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.3
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module.
- Product
- BUK TS-G Gas Station Automation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2026The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks.CVE-2026-11624 · Computers, phones & browsers · Google · reported by cve-coordination@google.comCritical 9.4
The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabling users to specify permitted hosts at server startup. Both flags default to "*", allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to "*", the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.
- Product
- MCP Toolbox for Databases
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system.CVE-2026-53609 · Other software · apostrophecms · reported by GitHubCritical 9.1
ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available.
- Product
- apostrophe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.CVE-2026-53519 · Other software · nezhahq · reported by GitHubCritical 9.1
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix leaves ../data/config.yaml; and path.Join("admin-dist", "../data/config.yaml") normalizes to data/config.yaml — which os.Stat finds and http.ServeFile returns. No authentication required. This issue has been patched in version 2.0.13.
- Product
- nezha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.CVE-2026-46716 · Other software · nezhahq · reported by GitHubCritical 9.9
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.
- Product
- nezha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leadCVE-2026-41157 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceCritical 9.8
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.CVE-2026-44990 · Other software · apostrophecms · reported by GitHubCritical 9.3
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
- Product
- sanitize-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.