Total
403696 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-25616 | 1 Phillipsdata | 1 Blesta | 2026-06-17 | N/A | 4.7 MEDIUM |
| Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665. | |||||
| CVE-2026-25615 | 1 Phillipsdata | 1 Blesta | 2026-06-17 | N/A | 7.2 HIGH |
| Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668. | |||||
| CVE-2026-25614 | 1 Phillipsdata | 1 Blesta | 2026-06-17 | N/A | 7.5 HIGH |
| Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680. | |||||
| CVE-2026-25613 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.5 MEDIUM |
| An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index. | |||||
| CVE-2026-25612 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks. | |||||
| CVE-2026-25611 | 2026-06-17 | N/A | 7.5 HIGH | ||
| A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server. | |||||
| CVE-2026-25610 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.5 MEDIUM |
| An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints. | |||||
| CVE-2026-25609 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 5.4 MEDIUM |
| Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only. | |||||
| CVE-2026-25605 | 1 Siemens | 1 Sicam Siapp Sdk | 2026-06-17 | N/A | 6.7 MEDIUM |
| A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without properly validating the file path or target. An attacker could delete files or sockets that the affected process has permission to remove, potentially resulting in denial of service or service disruption. | |||||
| CVE-2026-25603 | 1 Linksys | 4 Mr9600, Mr9600 Firmware, Mx4200 and 1 more | 2026-06-17 | N/A | 6.6 MEDIUM |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that contents of a USB drive partition can be mounted in an arbitrary location of the file system. This may result in the execution of shell scripts in the context of a root user.This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200. | |||||
| CVE-2026-25601 | 1 Metronik | 1 Mepis Rm | 2026-06-17 | N/A | 6.4 MEDIUM |
| A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user passwords before storing them in the application’s database. An attacker with sufficient privileges to access the database could extract the encrypted passwords, decrypt them using the embedded key, and gain unauthorized access to the associated ICS/OT environment. | |||||
| CVE-2026-25598 | 1 Stepsecurity | 1 Harden-runner | 2026-06-17 | N/A | 5.3 MEDIUM |
| Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has been identified in the Harden-Runner GitHub Action (Community Tier) that allows outbound network connections to evade audit logging. Specifically, outbound traffic using the sendto, sendmsg, and sendmmsg socket system calls can bypass detection and logging when using egress-policy: audit. This vulnerability is fixed in 2.14.2. | |||||
| CVE-2026-25597 | 1 Prestashop | 1 Prestashop | 2026-06-17 | N/A | 5.3 MEDIUM |
| PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times. This vulnerability is fixed in 8.2.4 and 9.0.3. | |||||
| CVE-2026-25596 | 1 Invoiceplane | 1 Invoiceplane | 2026-06-17 | N/A | 4.8 MEDIUM |
| InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Product Unit Name fields. An authenticated administrator can inject malicious JavaScript that executes when any administrator views an invoice containing a product with the malicious unit. Version 1.7.1 patches the issue. | |||||
| CVE-2026-25595 | 1 Invoiceplane | 1 Invoiceplane | 2026-06-17 | N/A | 4.8 MEDIUM |
| InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject malicious JavaScript that executes when any administrator views the affected invoice or visits the dashboard. Version 1.7.1 patches the issue. | |||||
| CVE-2026-25594 | 1 Invoiceplane | 1 Invoiceplane | 2026-06-17 | N/A | 4.8 MEDIUM |
| InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Family Name field. The `family_name` value is rendered without HTML encoding inside the family dropdown on the product form. When an administrator creates a family with a malicious name, the payload executes in the browser of any administrator who visits the product form. Version 1.7.1 patches the issue. | |||||
| CVE-2026-25593 | 1 Openclaw | 1 Openclaw | 2026-06-17 | N/A | 8.4 HIGH |
| OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20. | |||||
| CVE-2026-25592 | 2026-06-17 | N/A | 9.9 CRITICAL | ||
| Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugin. The problem has been fixed in Microsoft.SemanticKernel.Core version 1.71.0. As a mitigation, users can create a Function Invocation Filter which checks the arguments being passed to any calls to DownloadFileAsync or UploadFileAsync and ensures the provided localFilePath is allow listed. | |||||
| CVE-2026-25591 | 1 Newapi | 1 New Api | 2026-06-17 | N/A | 6.5 MEDIUM |
| New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the `/api/token/search` endpoint allows authenticated users to cause denial of service through resource exhaustion by crafting malicious search patterns. The token search endpoint accepts user-supplied `keyword` and `token` parameters that are directly concatenated into SQL LIKE clauses without escaping wildcard characters (`%`, `_`). This allows attackers to inject patterns that trigger expensive database queries. Version 0.10.8-alpha.10 contains a patch. | |||||
| CVE-2026-25590 | 1 Glpi-project | 1 Glpi Inventory | 2026-06-17 | N/A | 4.5 MEDIUM |
| The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6. | |||||