Archive
June 2026
Vulnerabilities first published in this month (UTC), newest first.
3,083 results · Clear filters · Feed
-
Medium 5.4
Client4 fails to validate path parameters
The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing pat…
-
Medium 6.7
JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
-
Medium 4.3
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
-
Medium 4.3
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
-
Medium 5.3
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying p…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment t…
-
Medium 6.5
WordPress Exclusive Addons Elementor plugin <= 2.7.9.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8.
-
Medium 6.5
Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures
By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
-
Medium 5.8
A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911…
-
Medium 5.4
Cross-site Scripting (XSS) in jupyter/nbconvert
A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output dire…
-
Medium 6.5
User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks i…
-
Medium 5.3
Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Unauthenticated Folder Content Disclosure via Path Traversal
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path traversal which makes it possible for the attacker to retrieve the directory listing for arbitrary directories on the server.
-
Medium 6.5CVE-2026-8380 Public exploit
Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages…
-
Medium 4.8
Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin
Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers to make arbitrary outbound HTTP requests via unsanitized resource-loading HTML elements (img/src, CS…
-
Medium 6.5
Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack …
-
Medium 5.6
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …
-
Medium 4.3
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…
-
Medium 5.3
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…
-
Medium 4.2
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…
-
Medium 5.9
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…
-
Medium 6.1
A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and e…
-
Medium 4.4
A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Rev…
-
Medium 4.7
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script …
-
Medium 4.3
A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login m…
-
Medium 4.3
A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation …
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 thro…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management Syste…
-
Medium 6.1
A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Ma…
-
Medium 5.5CVE-2026-39031 Public exploit
Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt cred…
-
Medium 4.6
Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands,…
-
Medium 5.5
A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.…
-
Medium 5.5
A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers …
-
Medium 6.5
A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrar…
-
Medium 6.9
Pen-drive: pen-drive: stored xss via unescaped cluster data in html report
A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into clust…
-
Medium 6.4
Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip
A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to …
-
Medium 4.2
Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a …
-
Medium 6.5
Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documen…
-
Medium 6.5
Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID,…
-
Medium 6.9
FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling was accessible without authentication, which allowed unauthenticated remote users to trigger update …
-
Medium 6.5
Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (…