Skip to content
OpenAdvisories

Archive

3 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /3 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

153 results · Feed

  • High 7.3
    CVE-2026-10694

    SourceCodester Online Food Ordering System index.php include file inclusion

    A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The ex…

    SourceCodester Online Food Ordering System
  • Medium 6.3
    CVE-2026-10693

    SourceCodester Online Boat Reservation System Administrative Endpoint improper authorization

    A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack …

    SourceCodester Online Boat Reservation System
  • Medium 5.0
    CVE-2025-60477

    A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC P…

    gpac gpac Debian Ubuntu
  • Medium 5.5
    CVE-2025-70100

    A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 librar…

  • Medium 6.5
    CVE-2025-70101

    An out-of-bounds read in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.0 library allows at…

  • Medium 6.3
    CVE-2026-39107 Public exploit

    A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fail…

  • Medium 4.3
    CVE-2026-36613

    Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents wh…

  • High 7.3
    CVE-2026-36611

    Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST …

  • High 7.8
    CVE-2026-36574

    A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and …

  • High 7.1
    CVE-2026-36606

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key…

  • Critical 9.8
    CVE-2026-36576

    An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 a…

  • Medium 4.8
    CVE-2026-36460

    Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save…

  • High 7.3
    CVE-2026-36609

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change…

  • Medium 5.9
    CVE-2026-36610

    Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base6…

  • High 8.8
    CVE-2026-36608

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to…

  • Medium 4.3
    CVE-2026-36615

    Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that return…

  • Medium 6.5
    CVE-2026-36605

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low num…

  • Critical 9.0
    CVE-2026-36748

    RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.

  • High 8.8
    CVE-2026-36607

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP…

  • Medium 4.3
    CVE-2026-36602

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusIn…

  • High 8.1
    CVE-2026-36603

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authenticatio…

  • Medium 6.5
    CVE-2026-36604

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS re…

  • Medium 5.9
    CVE-2026-36616

    Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS …

  • Medium 4.3
    CVE-2026-36618

    Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS…

  • Medium 6.4
    CVE-2026-36612

    Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-seco…

  • Medium 5.8
    CVE-2026-46447

    OpenStack Ironic allows Boot Script Injection

    OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.

    OpenStack Ironic ironic ironic Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-37462

    GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

    An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

    gobgp gobgp github.com/osrg/gobgp/v4 Debian Ubuntu Go
  • Medium 4.1
    CVE-2026-37700

    Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via …

  • High 7.5
    CVE-2026-37460

    Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 al…

    frr frr quagga Debian Ubuntu
  • Medium 6.5
    CVE-2026-26824

    libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory a…

    r-cran-readxl r-cran-readxl Debian Ubuntu
  • Medium 5.4
    CVE-2026-26378

    Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file…

  • Medium 5.3
    CVE-2026-26825

    A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reach…

    r-cran-readxl r-cran-readxl Debian Ubuntu
  • Medium 6.5
    CVE-2026-26379

    Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configur…