Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,321 results · page 31 of 147
Jun 12, 2026Netty is a network application framework for development of protocol servers and clients.CVE-2026-44894 · Other software · netty · reported by GitHubHigh 7.5
Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from validateToken() is interpreted as 'token is valid, ODCID starts at offset 0', causing the server to call quiche_accept as if the client's address had been validated by a Retry round-trip. Per RFC 9000 §8.1, a validated address lifts the 3× anti-amplification send limit. Thus any attacker who includes ANY non-empty token bytes in an Initial packet — with a spoofed victim source IP — causes the Netty server to treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it without the 3× cap. The correct 'no token handler' semantics would be to return -1 (invalid) so the normal un-validated path and amplification limit apply. Version 4.2.15.Final patches the issue.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026Netty is a network application framework for development of protocol servers and clients.CVE-2026-44893 · Other software · netty · reported by GitHubHigh 7.5
Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters.CVE-2026-50629 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
- Product
- Apache CXF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jun 12, 2026Netty is a network application framework for development of protocol servers and clients.CVE-2026-44892 · Other software · netty · reported by GitHubHigh 7.5
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an `OutOfMemoryError`. Version 4.2.15.Final contains a patch.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Netty is a network application framework for development of protocol servers and clients.CVE-2026-44890 · Other software · netty · reported by GitHubHigh 7.5
Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Netty is a network application framework for development of protocol servers and clients.CVE-2026-44250 · Other software · netty · reported by GitHubHigh 7.5
Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Netty is a network application framework for development of protocol servers and clients.CVE-2026-44249 · Other software · netty · reported by GitHubHigh 8.1
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
- Product
- netty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-44496 · Other software · axios · reported by GitHubHigh 7.5
Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie. This vulnerability is fixed in 0.32.0 and 1.16.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 11, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-44495 · Other software · axios · reported by GitHubHigh 7
Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 11, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-44494 · Other software · axios · reported by GitHubHigh 8.7
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 11, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-44492 · Other software · axios · reported by GitHubHigh 8.6
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 11, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-44490 · Other software · axios · reported by GitHubMedium 4.8
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the merged headers and ride out on the wire. (2) lib/core/mergeConfig.js line 26 builds the hasOwnProperty descriptor as a plain-object literal. Object.defineProperty reads descriptor.get/descriptor.set via the prototype chain, so a polluted Object.prototype.get or Object.prototype.set makes the call throw TypeError synchronously on every axios request. This vulnerability is fixed in 0.32.0 and 1.16.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-44489 · Other software · axios · reported by GitHubLow 3.7
Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-44488 · Other software · axios · reported by GitHubHigh 7.5
Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 11, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-44487 · Other software · axios · reported by GitHubHigh 8.2
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 11, 2026Axios is a promise based HTTP client for the browser and Node.js.CVE-2026-44486 · Other software · axios · reported by GitHubHigh 7.5
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 11, 2026The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names CVE-2026-9648 · Other software · Haskell Programming Language · reported by cret@cert.orgCritical 9.1
The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.
- Product
- crypton-certificate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2026A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attackeCVE-2026-40987 · Other software · Spring · reported by security@vmware.comHigh 7.1
A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.
- Product
- Spring Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Russh is a Rust SSH client & server library.CVE-2026-48110 · Other software · Eugeny · reported by GitHubHigh 7.5
Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt to allocate, or split data before rejecting input that should have been rejected earlier. This issue has been patched in version 0.61.0.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Russh is a Rust SSH client & server library.CVE-2026-48108 · Other software · Eugeny · reported by GitHubMedium 5.3
Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing pre-banner lines from clients, and the reader did not enforce a bounded number of pre-banner lines. For a library server built on russh, this could allow a remote peer to hold connection setup resources in the cleartext pre-authentication phase with malformed identification input that should have been rejected early. This issue has been patched in version 0.61.0.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Russh is a Rust SSH client & server library.CVE-2026-48107 · Other software · Eugeny · reported by GitHubMedium 6.5
Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a malicious SSH server could send a USERAUTH_INFO_REQUEST with an attacker-controlled prompt count, and the client would use that raw count directly in Vec::with_capacity(...) before validating that enough prompt data was actually present in the packet. This issue has been patched in version 0.61.0.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Russh is a Rust SSH client & server library.CVE-2026-46705 · Other software · Eugeny · reported by GitHubMedium 5.3
Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSH_MSG_USERAUTH_REQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user name and service name fields to change between authentication requests. The issue is not that such changes are invalid. The issue is that russh-owned authentication state, such as remaining methods, partial-success state, and in-progress method state, can remain associated with the connection and then influence a later request for a different (user, service). This is an internal library state mismatch. This issue has been patched in version 0.61.0.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Russh is a Rust SSH client & server library.CVE-2026-46702 · Other software · Eugeny · reported by GitHubHigh 7.5
Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In current releases, this is a remote denial-of-service / resource-exhaustion issue in the post-decompression receive path. In older releases before 0.58.0, the same remote decompression path used CryptoVec, which appears to make the historical impact worse. This issue has been patched in version 0.61.1.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Russh is a Rust SSH client & server library.CVE-2026-46673 · Other software · Eugeny · reported by GitHubHigh 7.5
Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.
- Product
- russh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026JavaScript Cookie is a JavaScript API for handling cookies, client-side.CVE-2026-46625 · Other software · js-cookie · reported by GitHubHigh 7.5
JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.
- Product
- js-cookie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execuCVE-2026-8637 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privileges.
- Product
- LanSchool Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieCVE-2026-8335 · Other software · Aix-DB · reported by cvd@cert.plHigh 7.1
A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints. All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.
- Product
- Aix-DB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace sCVE-2026-52756 · Other software · nationalsecurityagency · reported by VulnCheckMedium 6.3
Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.
- Product
- ghidra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 10, 2026Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code exCVE-2026-52751 · Other software · nationalsecurityagency · reported by VulnCheckHigh 8.6
Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes untrusted objects using a Jython 2.7.4 gadget chain to execute arbitrary commands.
- Product
- ghidra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects.CVE-2026-11815 · Other software · Broadcom · reported by secure@symantec.comMedium 5.3
An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution.
- Product
- Layer 7 API Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.CVE-2026-41730 · Other software · Spring · reported by security@vmware.comMedium 5.3
Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
- Product
- Spring Data REST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricCVE-2026-40991 · Other software · Spring · reported by security@vmware.comMedium 5.9
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.
- Product
- Spring REST Docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to seCVE-2026-9742 · Other software · MongoDB · reported by cna@mongodb.comHigh 8.2
When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results iCVE-2026-9741 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability.CVE-2026-40639 · Other software · Dell · reported by security_alert@emc.comMedium 5.7
Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- Product
- Dell Edge Gateway 3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.CVE-2026-50635 · Other software · LimeSurvey · reported by VulnCheckHigh 8.7
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (requiring only the target's username and email) with a spoofed Host header causes LimeSurvey to email that account a reset link whose hostname is attacker-controlled while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlimesurvey.org
Jun 9, 2026Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability.CVE-2026-41116 · Other software · Dell · reported by security_alert@emc.comMedium 6.3
Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write.
- Product
- Inventory Collector Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-48563 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-47654 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-47653 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-47289 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.CVE-2026-45639 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information locally.CVE-2026-45608 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Out-of-bounds read in Windows DHCP Client allows an unauthorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code over a network.CVE-2026-44815 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-44801 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-44799 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-42993 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-42992 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-42985 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute CVE-2026-42913 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.