Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,992 results · page 15 of 100
Jun 19, 2026Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.CVE-2026-48582 · Email & office · Microsoft · reported by secure@microsoft.comCritical 9.6
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Exchange Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with elevCVE-2025-71326 · Other software · Avast · reported by VulnCheckHigh 8.5
AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that execute with high-level system permissions.
- Product
- AVAST Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordavast.comexploit-db.com
Jun 19, 2026Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on WCVE-2026-49357 · Other software · dtwang · reported by GitHubHigh 8.8
Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via MCP. `line-desktop-mcp` supports a `--http-mode` Streamable HTTP transport for use with clients such as n8n. In this mode the server binds to `0.0.0.0` and exposes the MCP `/mcp` endpoint without an MCP-layer authentication check. Prior to version 1.1.2, any network client that can reach the port can initialize a session, list tools, and call tools that read LINE Desktop chat history or send LINE messages through the already logged-in desktop application. Version 1.1.2 fixes the issue.
- Product
- line-desktop-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-54017 · Other software · open-webui · reported by GitHubHigh 7.7
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in `backend/open_webui/routers/terminals.py` does not fully confine the user-controlled `path` segment before forwarding it to an admin-configured terminal server. An authenticated user who has been granted access to a terminal server can craft `path` values containing encoded `../` traversal sequences that escape the intended path (or policy) scope on that server, reaching unintended endpoints and files on the terminal-server host. Where the terminal server fans requests out to internal services, this also gives SSRF-style reach into those services. This is a separate code path from the `/api/v1/retrieval/process/web` SSRF (GHSA-c6xv-rcvw-v685), with its own input. Two distinct vectors are consolidated here: first, raw path forwarding / single-encoded traversal (original report); and second, a bypass of the subsequently-added `_sanitize_proxy_path` mitigation using double-encoded dots (`%252e%252e`). The attacker-controlled input is the request `path`, supplied by the non-admin user, not anything an administrator configures, so this i
- Product
- open-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1_V1.0.6.020CVE-2026-12527 · Other software · Shenzhen Liandian Communication Technology LTD · reported by 1c6b5737-9389-4011-8117-89fa251edfb2Medium 6
A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1_V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced live-view workflow and directly retrieve real-time video stream data.
- Product
- V380 IP Camera / AppFHE1_V1.0.6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 20268cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers.CVE-2026-50643 · Other software · rui314 · reported by cvd@cert.plMedium 5.1
8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-controlled filename and line number metadata and later uses it without validation when accessing source line arrays. By supplying invalid or oversized line numbers, an attacker can trigger out-of-bounds memory access and a crash. Maintainer of this project was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Version corresponding to the commit b480958 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
- Product
- 8cc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-10736 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 3.9.11
- What to do
- Affects up to 3.9.11. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.CVE-2025-69175 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Taskbuilder: Does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodesCVE-2026-9570 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.
- Product
- Taskbuilder
- Fixed in
- 5.0.8
- What to do
- Update Taskbuilder to 5.0.8 or newer.
Jun 17, 2026AliNext: Missing AuthorizationCVE-2024-37210 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AliNext: from n/a through 3.3.5.
- Product
- AliNext
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update AliNext to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Skyline WP: Cross-Site request forgery (CSRF)CVE-2024-34810 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site request forgery (CSRF) vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery. This issue affects Skyline WP: from n/a through 1.0.10.
- Product
- Skyline WP
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Skyline WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved cCVE-2026-53866 · Other software · OpenClaw · reported by VulnCheckHigh 7.6
OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands. A command request using shell inline-command forms could route through a parser case missing the expected allowlist decision, enabling shell content execution without intended approval prompts.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 16, 2026OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags.CVE-2026-53861 · Other software · OpenClaw · reported by VulnCheckMedium 5.3
OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check by using combined flag forms, potentially allowing unauthorized command execution depending on operator configuration.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 16, 2026OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional paCVE-2026-53855 · Other software · OpenClaw · reported by VulnCheckHigh 7.6
OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside intended allowlist rules, enabling execution of unapproved shell-provided content.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 16, 2026OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notiCVE-2026-53851 · Other software · OpenClaw · reported by VulnCheckMedium 6.3
OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 16, 2026update_disk_psu_baseline.sh requires password in plain textCVE-2024-39575 · Other software · Dell · reported by security_alert@emc.comHigh 7.4
update_disk_psu_baseline.sh requires password in plain text
- Product
- Dell EMC VxRail Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026Kids Online Store: Unrestricted Upload of File with Dangerous TypeCVE-2026-40750 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9.
- Product
- Kids Online Store
- Affected
- up to 0.8.9
- What to do
- Affects up to 0.8.9. Update Kids Online Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbCVE-2026-50871 · Other software · reported by MITRECritical 9.8
An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 13, 2026Online Scheduling and Appointment Booking System – Bookly: Stored Cross-Site ScriptingCVE-2026-5513 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires 'Remember personal information in cookies' setting to be enabled (disabled by default).
- Product
- Online Scheduling and Appointment Booking System – Bookly
- Affected
- up to 27.2
- What to do
- Affects up to 27.2. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 12, 2026OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline.CVE-2026-53821 · Other software · OpenClaw · reported by VulnCheckHigh 8.7
OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execute admin-gated Gateway RPCs.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-52860 · Other software · vim · reported by GitHubHigh 7.5
Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-52859 · Other software · vim · reported by GitHubMedium 6.9
Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell's chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-52858 · Other software · vim · reported by GitHubHigh 7.3
Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package's top-level code as the editing user. This issue has been patched in version 9.2.0561.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-47167 · Other software · vim · reported by GitHubMedium 5.1
Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch() in the cucumber filetype plugin (runtime/ftplugin/cucumber.vim) on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's features/*/ or stories/*/ directories are embedded into a Ruby Kernel.eval argument without sufficient escaping, allowing a crafted pattern in an attacker-controlled repository to execute arbitrary Ruby (and through it arbitrary shell commands) when the user invokes a step-jump mapping ([d, ]d). This issue has been patched in version 9.2.0496.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Vim is an open source, command line text editor.CVE-2026-47162 · Other software · vim · reported by GitHubHigh 7.3
Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495.
- Product
- vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLICVE-2026-0272 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 6
A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
- Product
- Cloud NGFW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comcert-portal.siemens.com
Jun 10, 2026OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the valuCVE-2026-11417 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 7
OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application. To remediate this issue, users should upgrade to aws-cdk-lib 2.245.0 (2.246.0 on Windows) or later.
- Product
- AWS Cloud Development Kit library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Jun 10, 2026Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline caCVE-2026-53441 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounCVE-2026-9753 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.2
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delCVE-2026-9749 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines.CVE-2026-9743 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.
- Product
- MongoDB server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin acceCVE-2026-41448 · Other software · AdguardTeam · reported by VulnCheckCritical 9.2
AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in the Admin-Token header to redirect file reads to arbitrary paths.
- Product
- AdGuardHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 8, 2026OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over CVE-2020-37248 · Other software · OfflineIMAP · reported by MITREMedium 6.5
OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over the connection and extracting account credentials in cleartext.
- Product
- OfflineIMAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive Information ExposureCVE-2026-8502 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'return_type' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the plaintext post_password of password-protected courses and the full post_content, post_author, and post_name of unpublished draft, private, and pending courses via the unrestricted SELECT * fallback query. Exploitation requires supplying both c_status=all (to bypass the publish-only post_status WHERE clause) and return_type=json (to prevent the safe DISTINCT(ID) AS ID field override) in a single unauthenticated request to the /wp-json/lp/v1/courses/archive-course endpoint.
- Product
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Affected
- up to 4.3.6
- What to do
- Affects up to 4.3.6. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2026Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers toCVE-2026-11422 · Other software · shd101wyy · reported by VulnCheckHigh 8.4
Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension's message passing and invoke arbitrary file writes on the local filesystem.
- Product
- Markdown Preview Enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation FirewallCVE-2026-25623 · Other software · Arista Networks · reported by psirt@arista.comHigh 7
An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal script code processing execution permissions.
- Product
- Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2026Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd.CVE-2026-6274 · Other software · DTS Electronics Industry and Trade Ltd. Co. · reported by iletisim@usom.gov.trCritical 9.8
Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8.
- Product
- Redline WR3200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trgithub.com
Jun 4, 2026Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.CVE-2026-48579 · Email & office · Microsoft · reported by secure@microsoft.comCritical 9.1
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Exchange Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026A flaw was found in the OpenShift Pipelines operator.CVE-2026-10840 · Other software · Red Hat · reported by Red HatHigh 7.1
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete other tenants' Workload objects, or induce cert-manager to overwrite TLS Secrets including the default ingress controller certificate.
- Product
- Red Hat OpenShift Builds 1.7.3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jun 3, 2026In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: Avoid NULL dereference in linehandle_create() In linehandle_create(), there isCVE-2026-46258 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: Avoid NULL dereference in linehandle_create() In linehandle_create(), there is a statement like this: retain_and_null_ptr(lh); Soon after, there is a debug printout that dereferences "lh", which will crash things. Avoid the crash by using handlereq.lines, which is the same value.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 2, 2026OpenClaude is an open-source coding-agent command line interface for cloud and local model providers.CVE-2026-42074 · Other software · Gitlawb · reported by GitHubCritical 9.3
OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting, a prompt-injected model can escape the sandbox for any arbitrary command, achieving full host-level code execution. This issue has been patched in version 0.5.1.
- Product
- openclaude
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026OpenClaude is an open-source coding-agent command line interface for cloud and local model providers.CVE-2026-42073 · Other software · Gitlawb · reported by GitHubMedium 6.5
OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the state value at all. This issue has been patched in version 0.5.1.
- Product
- openclaude
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Memory Corruption when processing display command line information due to improper initialization of a variable.CVE-2026-24085 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.2
Memory Corruption when processing display command line information due to improper initialization of a variable.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.CVE-2025-59601 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026launch-editor allows users to open files with line numbers in editor from Node.js.CVE-2024-52011 · Other software · vitejs · reported by GitHubHigh 7.5
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. This issue has been fixed in the `launch-editor` version 2.9.0, corresponding to vite version 5.4.9.
- Product
- launch-editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant.CVE-2026-44211 · Other software · cline · reported by GitHubCritical 9.6
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.
- Product
- cline
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A flaw has been found in CodeAstro Online Job Portal 1.0.CVE-2026-10261 · Other software · CodeAstro · reported by VulDBMedium 5.5
A flaw has been found in CodeAstro Online Job Portal 1.0. This affects an unknown function of the file /users/application_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
- Product
- Online Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jun 1, 2026A vulnerability was detected in CodeAstro Online Job Portal 1.0.CVE-2026-10260 · Other software · CodeAstro · reported by VulDBMedium 5.5
A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/delete-jobs.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
- Product
- Online Job Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Jun 1, 2026Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths draCVE-2026-45360 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 30, 2026Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.CVE-2026-8594 · Other software · NEZUMI · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.2
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the break function to the entire string, not just the segment. A side effect of this is that the full input can be duplicated for each segment. Besides being incorrect, this can lead to unexpected resource consumption and possible denial of service. Note that Text::LineFold is part of the Unicode-LineBreak distribution, which may have a higher version number than the module.
- Product
- Text::LineFold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.