Skip to content
OpenAdvisories

Archive

16 June 2026

Vulnerabilities first published on this day (UTC), newest first.

← May 2026 2026 / June /16 July 2026 →
  1. 1379
  2. 2224
  3. 3153
  4. 4641
  5. 5169
  6. 639
  7. 724
  8. 8286
  9. 9721
  10. 10252
  11. 11194
  12. 12291
  13. 1322
  14. 1418
  15. 15401
  16. 16549
  17. 17397
  18. 18158
  19. 19206
  20. 2046
  21. 2172
  22. 22223
  23. 23258
  24. 24522
  25. 25472
  26. 26374
  27. 2733
  28. 2845
  29. 29246
  30. 30651
All Critical High Medium Low Exploited only Public exploit

275 results · Clear filters · Feed

  • High 7.5
    CVE-2026-48929

    Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthen…

    RocketChat Rocket.Chat
  • High 8.2
    CVE-2026-48788

    Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

    Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image pro…

    umputun remark42 github.com/umputun/remark42 Go
  • High 7.5
    GHSA-69qj-pvh9-c5wg

    yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

    ### Summary yt-dlp's `--exec` option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting (e.g. `%(title)s`) or other unsafe conversions. An attacker could achieve remote code execution …

    yt-dlp PyPI
  • High 7.5
    CVE-2026-48779

    ws: Memory exhaustion DoS from tiny fragments and data chunks

    ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer c…

    websockets ws langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi npm
  • High 8.0
    CVE-2026-39598

    WordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2.

    kodezen Academy LMS Pro
  • High 8.5
    CVE-2026-49073

    WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3.

    wpWax Directorist Booking
  • High 8.5
    CVE-2026-11409

    OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N

    An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands w…

    TP-Link Systems TL-WR940N v6 Network devices
  • High 8.5
    CVE-2026-11410

    OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N

    An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary syste…

    TP-Link Systems TL-WR940N v6 Network devices
  • High 8.5
    CVE-2026-49113

    WordPress Cornerstone plugin < 7.8.8 - Arbitrary Code Execution vulnerability

    Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

    THEMECO Cornerstone
  • High 7.5
    CVE-2026-49057

    WordPress JobSearch plugin <= 3.2.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.

    EyeCix Technologies JobSearch
  • High 7.1
    CVE-2026-48869

    WordPress Enfold theme <= 7.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.

    Kriesi Enfold
  • High 8.1
    CVE-2026-40761

    WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

    Edge-Themes Valeska
  • High 8.1
    CVE-2026-40760

    WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

    Edge-Themes Behold
  • High 8.1
    CVE-2026-40759

    WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

    Mikado-Themes Esmée
  • High 8.1
    CVE-2026-40758

    WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

    Elated-Themes Léonie
  • High 8.1
    CVE-2026-40755

    WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

    Mikado-Themes TechLink
  • High 8.1
    CVE-2026-40754

    WordPress Roisin theme <= 1.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

    Elated-Themes Roisin
  • High 8.1
    CVE-2026-40751

    WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

    Mikado-Themes Ashtanga
  • High 8.1
    CVE-2026-40736

    WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

    Edge-Themes Laurits
  • High 8.1
    CVE-2026-40739

    WordPress LuxeDrive theme <= 1.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

    Mikado-Themes LuxeDrive
  • High 8.1
    CVE-2026-39580

    WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

    Select-Themes Micdrop
  • High 8.1
    CVE-2026-39577

    WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

    Elated-Themes Playroom
  • High 8.1
    CVE-2026-39578

    WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

    Elated-Themes Valiance
  • High 8.1
    CVE-2026-39568

    WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.

    Elated-Themes Mr. SEO
  • High 8.1
    CVE-2026-39557

    WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

    Elated-Themes NeoBeat
  • High 8.1
    CVE-2026-39567

    WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

    Select-Themes Santé
  • High 8.1
    CVE-2026-39554

    WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

    Elated-Themes Fidalgo
  • High 8.1
    CVE-2026-39549

    WordPress Aperitif theme <= 1.5 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.

    Elated-Themes Aperitif
  • High 7.1
    CVE-2026-39548

    WordPress MagOne theme <= 9.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.

    Sneeit MagOne
  • High 8.1
    CVE-2026-39547

    WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

    Select-Themes Getaway
  • High 8.1
    CVE-2026-39539

    WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

    Edge-Themes Alloggio - Hotel Booking
  • High 8.1
    CVE-2026-39522

    WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Solene <= 3.4 versions.

    Elated-Themes Solene
  • High 8.1
    CVE-2026-39443

    WordPress EmallShop theme <= 2.4.21 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

    PressLayouts EmallShop
  • High 8.1
    CVE-2026-39446

    WordPress Kapee theme < 1.7.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

    PressLayouts Kapee
  • High 8.1
    CVE-2026-34895

    WordPress Softlab Core plugin < 1.2.11 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.

    WebGeniusLab Softlab Core
  • High 8.1
    CVE-2026-34893

    WordPress Thegov Core plugin < 2.0.23 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.

    WebGeniusLab Thegov Core
  • High 8.1
    CVE-2026-34894

    WordPress Integrio Core plugin < 1.2.8 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.

    WebGeniusLab Integrio Core
  • High 8.8
    CVE-2026-12256

    WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.

    ThemeFusion Fusion Builder
  • High 8.1
    CVE-2025-69178

    WordPress Truemag theme <= 4.3.14.2 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.

    CactusThemes Truemag
  • High 8.1
    CVE-2025-69177

    WordPress Roneous theme <= 2.1.5 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.

    THEMELOGI Roneous