Skip to content
OpenAdvisories

Archive

11 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /11 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-42647 Public exploit Scanner template

    WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue affects JoomSport: from n/a through 5.7.7.

    Beardev JoomSport
  • Critical 9.8
    CVE-2026-49060 Public exploit Scanner template

    WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.

    Hippoo Hippoo Mobile App for WooCommerce Web / CMS
  • Critical 9.5
    CVE-2026-47172 Public exploit

    Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflow runs on pull reque…

    duck-organization quest-bot
  • Critical 9.8
    CVE-2026-11561 Public exploit

    SSTI in Soagen Informatics' Apinizer

    Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection. This issue affects Apinizer: f…

    Soagen Informatics Technologies Software and Consulting Apinizer
  • High 8.1
    CVE-2026-10795 Public exploit

    UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

    The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of …

    David Anderson UpdraftPlus: WP Backup & Migration Plugin Web / CMS
  • High 7.1
    CVE-2026-40987 Public exploit

    Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

    A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.…

    Spring Spring Integration org.springframework.integration:spring-integration-file Maven
  • Critical 9.8
    CVE-2026-35273 Exploited · Ransomware Public exploit Scanner template EPSS 97%

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Man…

    Oracle PeopleSoft Enterprise PeopleTools
    KEV Jun 12, 2026