Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,928 results · page 27 of 99
Jun 25, 2026NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary CVE-2026-56772 · Other software · samuelclay · reported by VulnCheckMedium 5.3
NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.
- Product
- NewsBlur
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.CVE-2026-57429 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.
- Affected
- up to 4.6.2
- What to do
- Affects up to 4.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.CVE-2026-56023 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.CVE-2026-54844 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.CVE-2026-54830 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
- Affected
- up to 2.7.19
- What to do
- Affects up to 2.7.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.CVE-2026-54828 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.
- Affected
- up to 1.4.109
- What to do
- Affects up to 1.4.109. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.CVE-2026-27366 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFRCVE-2026-40209 · Other software · PowerDNS · reported by security@open-xchange.comMedium 5.3
An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediately, by sending IXFR queries. This could be used to cause a denial of service if there is a limit to the number of concurrent connections to this backend, or if the process runs out of file descriptors.
- Product
- DNSdist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growCVE-2026-13311 · Other software · ljharb · reported by 7ffcee3d-2c14-4c3e-b844-86c6a321a158High 8.7
shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.
- Product
- shell-quote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: backend: fix error pointer dereference The function drm_atomic_get_plane_state(CVE-2026-53066 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: backend: fix error pointer dereference The function drm_atomic_get_plane_state() can return an error pointer and is not checked for it. Add error pointer check. Detected by Smatch: drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error: 'plane_state' dereferencing possible ERR_PTR()
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 24, 2026Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variCVE-2026-56269 · Other software · Flowise · reported by VulnCheckMedium 4.3
Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET environment variable in packages/server/src/enterprise/utils/tempTokenUtils.ts when the variable is not configured. This secret derives the AES-256-CBC key used to encrypt user IDs and workspace IDs in the 'meta' field of JWT tokens. An attacker who knows the default secret can decrypt this metadata to extract internal user and workspace identifiers, and re-encrypt manipulated values such as altered user or workspace IDs. Because the JWT signature is validated separately, decrypting or tampering with this metadata does not by itself grant access, but the disclosure of internal identifiers and possible metadata manipulation could aid privilege escalation or unauthorized data access.
- Product
- Flowise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 24, 2026Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism.CVE-2026-56237 · Other software · Capgo · reported by VulnCheckCritical 9.3
Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key parameter in the generation request and supply arbitrary values, generating custom API keys without proper authorization, which can lead to unauthorized access to protected endpoints.
- Product
- Capgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 24, 2026Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints.CVE-2026-56231 · Other software · Capgo · reported by VulnCheckHigh 7.2
Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder commands with the server-held builder API key. An authenticated user with the app.build_native permission for any app they control can start or cancel arbitrary builder jobs belonging to other tenants by supplying a victim jobId, resulting in cross-tenant build sabotage (denial of service), unauthorized compute actions, and potential billing impact.
- Product
- Capgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 24, 2026Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows remCVE-2026-13163 · Other software · Mailerup · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 5.3
Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct phishing attacks via a crafted u query parameter, because the URL scheme is validated (blocking javascript: and data:) but the destination host is not restricted to an allowlist, and a signing.BadSignature exception is silently caught so a valid signed token is not required.
- Product
- Mailerup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens.CVE-2026-13140 · Other software · Thinkst Applied Research · reported by 0f2be0ad-3469-4e56-b38f-4eb96719b425Low 1.1
Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.
- Product
- Canarytokens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py) in ccyl13 Pentestify 1.0.0 and lower allCVE-2026-13150 · Other software · Pentestify · reported by 4daa8cea-433a-44bd-9456-53b127fc289aMedium 6.9
Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py) in ccyl13 Pentestify 1.0.0 and lower allows remote attackers to make the server issue requests to arbitrary internal or external URLs, including cloud metadata services, and return the rendered content in the resulting PDF via a crafted Host header, because the target URL is built from request.base_url without validation.
- Product
- Pentestify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2026Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a classCVE-2026-41862 · Other software · Spring · reported by security@vmware.comHigh 8.8
Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4
- Product
- Spring Statemachine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2026Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploCVE-2026-56115 · Other software · garybowers · reported by VulnCheckHigh 8.7
Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users path to create new administrator accounts or reset administrator passwords, thereby gaining full control of the server and the ability to modify boot menus and installation scripts served to PXE clients.
- Product
- bootimus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 23, 2026HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.CVE-2025-15619 · Other software · HCLSoftware · reported by psirt@hcl.comLow 3.5
HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.
- Product
- Connections
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jun 23, 2026Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level SecurityCVE-2026-56248 · Other software · Cap-go · reported by VulnCheckHigh 8.7
Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger statement timeouts (PostgREST error 57014). Under concurrency, this exhausts database resources and causes cascading HTTP 500 failures on unrelated endpoints (e.g. /orgs), resulting in an application-layer denial of service.
- Product
- capgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 22, 2026Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, CVE-2026-56321 · Other software · Capgo · reported by VulnCheckMedium 6.9
Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, unlike the POST and DELETE role_bindings routes, so unauthenticated requests reach the handler instead of being rejected at the middleware layer. The handler still performs its own authorization check and returns Unauthorized, so no direct data exposure occurs; the flaw is inconsistent authentication enforcement across HTTP methods that could enable authorization bypass if the handler logic changes.
- Product
- Capgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 22, 2026Jupyter Server is the backend for Jupyter web applications.CVE-2026-44727 · Other software · jupyter-server · reported by GitHubCritical 9.3
Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.
- Product
- jupyter_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checCVE-2026-56424 · Other software · misp · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.1
MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths. In affected subsystems, a lower-privileged authenticated user with the relevant feature permission could cause the application to authorize one object but mutate another, or could modify objects that were merely visible rather than editable by the user’s organization. The affected paths included: * Event Reports tag removal: the route-authorized report could differ from the report ID used for tag detachment, enabling cross-organization tag removal from another event report * Collection Elements bulk deletion: bulk deletion authorized against a collection whose ID matched the collection-element row ID, rather than the element’s actual parent collection, enabling deletion of elements from collections the user did not own. * Analyst Data capture/update: nested analyst data updates could overwrite an existing record without applying the normal canEditAnalystData ownership check, enabling cross-organization overwrite of analyst data records. * Template Elements editing: editing a
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups.CVE-2026-56423 · Other software · misp · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Critical 9.4
MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object. For Event Reports, EventReportsController::deleteSelection relied on the global perm_add capability rather than a per-report ownership/authorization check. As a result, a contributor-level user could submit report IDs or UUIDs for reports belonging to other organisations and hard-delete them instance-wide. The fix changed the callback to call EventReport::fetchIfAuthorized($user, $itemId, 'delete') for each selected report before deletion. For Sharing Groups, SharingGroupsController::deleteSelection relied on the global perm_sharing_group capability rather than verifying ownership of each selected sharing group. This allowed a sharing-group-capable user to hard-delete sharing groups owned by other organisations, bypassing the per-object ownership gate used by the single-object delete action. The fix changed the callback to call SharingGroup::checkIfOwner($user, $itemId) for each selected sharing group. An aut
- Product
- misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuCVE-2026-42129 · Other software · Grafana · reported by security@grafana.comHigh 7.7
A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation iCVE-2026-12888 · Other software · Thinkst Applied Research · reported by 0f2be0ad-3469-4e56-b38f-4eb96719b425Low 2
An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.
- Product
- Canarytokens
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints.CVE-2026-10601 · Other software · Grafana · reported by security@grafana.comMedium 5.4
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the configured backend.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2026Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to supCVE-2026-56251 · Other software · Capgo · reported by VulnCheckHigh 7
Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to super_admin. Attackers can exploit the insufficient RLS enforcement to gain unauthorized super_admin access and compromise system security.
- Product
- Capgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 20, 2026AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, ACVE-2026-56341 · Other software · AVideo · reported by VulnCheckHigh 8.7
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 20, 2026Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticaCVE-2026-56307 · Other software · Cap-go · reported by VulnCheckMedium 5.3
Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to cause duplicate-page loops and make later rows unreachable. Attackers with app.read_devices access can exploit non-advancing cursor filters to trigger infinite pagination loops, prevent dataset traversal, and cause repeated processing in device-management workflows.
- Product
- capgo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 20, 2026Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in a secondary domain tCVE-2026-12673 · Other software · liquidfiles · reported by ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4aMedium 5.9
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary (non-default) group.
- Product
- liquidfiles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.liquidfiles.comprojectblack.io
Jun 19, 2026The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints.CVE-2026-12620 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5Medium 4.6
The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
- Product
- GridTime 3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parCVE-2026-44939 · Other software · SUSE · reported by meissner@suse.deCritical 9.4
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale.CVE-2026-49252 · Other software · deepstreamIO · reported by GitHubCritical 9.9
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation from any authenticated user with write permission to any record. This issue has been fixed in version 10.0.5.
- Product
- deepstream.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1_V1.0.6.020CVE-2026-12527 · Other software · Shenzhen Liandian Communication Technology LTD · reported by 1c6b5737-9389-4011-8117-89fa251edfb2Medium 6
A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1_V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced live-view workflow and directly retrieve real-time video stream data.
- Product
- V380 IP Camera / AppFHE1_V1.0.6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.CVE-2026-11718 · Computers, phones & browsers · Google · reported by cve-coordination@google.comCritical 9.3
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), it decodes the response into an introspectResp struct. However, the subsequent claim-checking logic (validateClaims) evaluates the issuer condition as if a.issuer != "" && iss != "". If the external OAuth provider's introspection response omits the optional iss (issuer) field completely, the variable iss defaults to an empty string. This causes the conditional block to evaluate to false and be skipped silently. Consequently, the application accepts tokens issued by unauthorized or unintended third-party identity providers.
- Product
- MCP Toolbox for Databases (googleapis/mcp-toolbox)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.CVE-2026-11717 · Computers, phones & browsers · Google · reported by cve-coordination@google.comCritical 9.3
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), the toolbox decodes the response into an introspectResp struct where the Active field is declared as a pointer to a boolean (*bool). The code only explicitly rejects a token if the response contains a populated active field set to false (if introspectResp.Active != nil && !*introspectResp.Active). If an introspection endpoint responds with a payload that completely omits the mandatory active key, the internal variable remains nil, causing the conditional check to short-circuit. As a result, Toolbox accepts authorization tokens missing the "active" field, granting access to protected tools and underlying data sources.
- Product
- MCP Toolbox for Databases (googleapis/mcp-toolbox)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contribuCVE-2026-10696 · Other software · Devolutions · reported by security@devolutions.netHigh 7.5
Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update.
- Product
- UniGetUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profiCVE-2026-55197 · Other software · nesquena · reported by VulnCheckHigh 7.1
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET /api/session?session_id=<foreign_id>&messages=1 to retrieve unauthorized conversation transcripts and metadata.
- Product
- hermes-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Use of a Broken or Risky Cryptographic Algorithm vulnerability.CVE-2026-40641 · Other software · Dell · reported by security_alert@emc.comMedium 4.8
Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.
- Product
- PowerFlex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.CVE-2026-54804 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.
- Affected
- up to 2.16.3
- What to do
- Affects up to 2.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.CVE-2026-54802 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.
- Affected
- up to 3.9.3
- What to do
- Affects up to 3.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.CVE-2026-49767 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.CVE-2026-49081 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.CVE-2026-49072 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.
- Affected
- up to 7.2.6
- What to do
- Affects up to 7.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.CVE-2026-49071 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.
- Affected
- up to 5.2.4
- What to do
- Affects up to 5.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.CVE-2026-49057 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.CVE-2026-45436 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.
- Affected
- up to 8.7.2
- What to do
- Affects up to 8.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.CVE-2026-42629 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.CVE-2026-40726 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.
- Affected
- up to 1.3.14
- What to do
- Affects up to 1.3.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.