Skip to content
OpenAdvisories

Archive

12 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /12 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-53519 Public exploit Scanner template

    Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset re…

    nezhahq nezha github.com/nezhahq/nezha Go
  • Critical 9.9
    CVE-2026-46716 Public exploit

    Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At eve…

    nezhahq nezha github.com/nezhahq/nezha Go
  • Critical 10.0
    CVE-2026-48558 Exploited Public exploit Scanner template EPSS 80%

    SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

    SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying the…

    SimpleHelp SimpleHelp
    KEV Jun 29, 2026
  • Critical 9.4
    CVE-2026-45833 Public exploit

    ChromaDB has a code injection vulnerability

    A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/defa…

    Chroma ChromaDB chromadb PyPI
  • High 7.5
    CVE-2026-50011 Public exploit

    Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-45674 Public exploit

    Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Critical 9.8
    CVE-2026-53787 Public exploit Scanner template

    Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

    Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to…

    Amasty Order Attributes for Magento 2 Web / CMS
  • Medium 5.9
    CVE-2026-9271 Public exploit

    KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS

    Vulnerability Title

  • Critical 9.8
    CVE-2026-48611 Public exploit Scanner template

    Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or…

    phpBB phpBB