Total
403699 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-25883 | 1 Vexa | 1 Vexa | 2026-06-17 | N/A | 5.8 MEDIUM |
| Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature allows authenticated users to configure an arbitrary URL that receives HTTP POST requests when meetings complete. The application performs no validation on the webhook URL, enabling Server-Side Request Forgery (SSRF). An authenticated attacker can set their webhook URL to target internal services (Redis, databases, admin panels), cloud metadata endpoints (AWS/GCP credential theft), and/or localhost services. Version 0.10.0-260419-1910 patches the issue. | |||||
| CVE-2026-25882 | 1 Gofiber | 1 Fiber | 2026-06-17 | N/A | 7.5 HIGH |
| Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch. | |||||
| CVE-2026-25881 | 1 Nyariv | 1 Sandboxjs | 2026-06-17 | N/A | 9.0 CRITICAL |
| SandboxJS is a JavaScript sandboxing library. Prior to 0.8.31, a sandbox escape vulnerability allows sandboxed code to mutate host built-in prototypes by laundering the isGlobal protection flag through array literal intermediaries. When a global prototype reference (e.g., Map.prototype, Set.prototype) is placed into an array and retrieved, the isGlobal taint is stripped, permitting direct prototype mutation from within the sandbox. This results in persistent host-side prototype pollution and may enable RCE in applications that use polluted properties in sensitive sinks (example gadget: execSync(obj.cmd)). This vulnerability is fixed in 0.8.31. | |||||
| CVE-2026-25880 | 1 Sumatrapdfreader | 1 Sumatrapdf | 2026-06-17 | N/A | 7.8 HIGH |
| SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary (explorer.exe) located in the same directory as the opened PDF when the user clicks File → “Show in folder”. This behavior leads to arbitrary code execution on the victim’s system with the privileges of the current user, without any warning or user interaction beyond the menu click. | |||||
| CVE-2026-25878 | 1 Friendsofshopware | 1 Froshadminer | 2026-06-17 | N/A | 5.3 MEDIUM |
| FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1. | |||||
| CVE-2026-25877 | 1 Depomo | 1 Chartbrew | 2026-06-17 | N/A | 6.5 MEDIUM |
| Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the application performs authorization checks based solely on the project_id parameter when handling chart-related operations (update, delete, etc.). No authorization check is performed against the chart_id itself. This allows an authenticated user who has access to any project to manipulate or access charts belonging to other users/ project. This issue has been patched in version 4.8.1. | |||||
| CVE-2026-25876 | 1 Prasklatechnology | 1 Placipy | 2026-06-17 | N/A | 9.1 CRITICAL |
| PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used to return all results for an assessment. | |||||
| CVE-2026-25875 | 1 Prasklatechnology | 1 Placipy | 2026-06-17 | N/A | 9.8 CRITICAL |
| PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role and scope) without enforcing server-side role verification. | |||||
| CVE-2026-25872 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| JUNG Smart Panel KNX firmware version L1.12.22 and prior contain an unauthenticated path traversal vulnerability in the embedded web interface. The application fails to properly validate file path input, allowing remote, unauthenticated attackers to access arbitrary files on the underlying filesystem within the context of the web server. This may result in disclosure of system configuration files and other sensitive information. | |||||
| CVE-2026-25866 | 1 Mobatek | 1 Mobaxterm | 2026-06-17 | N/A | 7.8 HIGH |
| MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user. | |||||
| CVE-2026-25863 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can supply an arbitrarily large integer value through the REST API endpoint to cause unbounded loop execution with multiple preg_replace() operations, exhausting server memory and crashing the PHP process. | |||||
| CVE-2026-25857 | 1 Tenda | 2 G300-f, G300-f Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality (formSetWanDiag). The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without adequate neutralization. As a result, a remote attacker with access to the affected management interface can inject additional shell syntax and execute arbitrary commands on the device with the privileges of the management process. | |||||
| CVE-2026-25854 | 1 Apache | 1 Tomcat | 2026-06-17 | N/A | 6.1 MEDIUM |
| Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue. | |||||
| CVE-2026-25852 | 2026-06-17 | N/A | 6.7 MEDIUM | ||
| Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212. | |||||
| CVE-2026-25851 | 1 Chargemap | 1 Chargemap.com | 2026-06-17 | N/A | 9.4 CRITICAL |
| WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. | |||||
| CVE-2026-25848 | 1 Jetbrains | 1 Hub | 2026-06-17 | N/A | 9.1 CRITICAL |
| In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible | |||||
| CVE-2026-25847 | 1 Jetbrains | 1 Pycharm | 2026-06-17 | N/A | 8.2 HIGH |
| In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible | |||||
| CVE-2026-25846 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs | |||||
| CVE-2026-25836 | 1 Fortinet | 1 Fortisandbox Cloud | 2026-06-17 | N/A | 7.2 HIGH |
| An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP requests. | |||||
| CVE-2026-25835 | 2 Arm, Trustedfirmware | 3 Mbed Tls, Mbed Tls, Tf-psa-crypto | 2026-06-17 | N/A | 7.7 HIGH |
| Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG). | |||||