Archive
June 2026
Vulnerabilities first published in this month (UTC), newest first.
3,083 results · Clear filters · Feed
-
Medium 5.9
WP Magnific Popup <= 1.0 - Author+ Stored XSS via href Attribute
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform S…
-
Medium 5.3CVE-2026-8383 Scanner template
LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, …
-
Medium 4.3
In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic e…
-
Medium 6.8
Netskope Client Service Insufficient Access Controls
Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List (DACLs) on the service o…
-
Medium 4.3
Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-or…
-
Medium 4.7
Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who h…
-
Medium 6.5
Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain po…
-
Medium 4.2
Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacke…
-
Medium 6.1
Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arb…
-
Medium 4.2
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had c…
-
Medium 4.2
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a…
-
Medium 4.2
Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker …
-
Medium 6.5
Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to obtain pote…
-
Medium 4.3
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to leak cr…
-
Medium 5.5
Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain…
-
Medium 6.8
Netskope Client Exposed IOCTL with Insufficient Access Controls
Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploi…
-
Medium 5.8
sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values …
-
Medium 4.7
CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is…
-
Medium 6.8
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form…
-
Medium 6.5
Runtipi: Unauthenticated arbitrary file read through app-store logo symlinks
Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo…
-
Medium 4.8
Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription
Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifyin…
-
Medium 5.6
Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling
A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper valida…
-
Medium 6.5
WordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability
Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.
-
Medium 6.5
WordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Genemy <= 1.6.6 versions.
-
Medium 4.2
LangGraph SDK has unsafe URL path construction
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values us…
-
Medium 6.5
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Integration and…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported ve…
-
Medium 6.5
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is …
-
Medium 6.5
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). Supported versions that are…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported ve…
-
Medium 6.5
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported…
-
Medium 6.1
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
Medium 5.3
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…
-
Medium 4.7
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF…
-
Medium 4.1
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Jav…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported ve…
-
Medium 6.1
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Sec…
-
Medium 6.6
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that …
-
Medium 6.5
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
Medium 6.5
In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. …