CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- seppmail ag secure email gatewayPath traversal in PDF generation module7.1 High
- rui314 8ccOut‑of‑Bounds Read in 8cc5.1 Medium
- silver leaf technologies, inc. worksnaps.net worksnapsHardcoded cloud credentials in Worksnaps client application binaries expose production cloud resources9.3 Critical
- contrid slideshow gallery liteSlideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute6.4 Medium
- dijitul fancy testimonialsFancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- codepeople appointment booking calendarAppointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter4.3 Medium
- blubrry powerpress podcasting plugin by blubrryPowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field6.4 Medium
- mariovalney cf7 to webhookCF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host7.2 High
- phppoet sysbasics customize my account for woocommerce – dashboard, endpoints, avatar & menu managerSysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter6.1 Medium
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wpUsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter2.7 Low
- phppoet sysbasics customize my account for woocommerce – dashboard, endpoints, avatar & menu managerSysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- cotontiCotonti stored XSS via PFS folder title7.0 High
- google androidIn AndroidManifest.xml, there is a possible persistent denial of service due to a missing...10.0 Critical
- cotontiCotonti CSRF in PFS folder edit allows unauthorized folder modification5.3 Medium
- cotontiCotonti CSRF in PFS allows forced arbitrary file upload8.6 High
- cotontiCotonti CSRF in admin.rights.php allows privilege escalation9.4 Critical
- cotontiCotonti CSRF in admin.config.php allows unauthorized configuration changes8.7 High
- dcooperman magicformMagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE6.5 Medium
- nur-alam39 bus-ticketSQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter9.3 Critical
- bplugins services section block – showcase service details in grid or columnsServices Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute6.4 Medium
- themeisle orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & moreOrbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter4.4 Medium
- wpinsider-1 simple membershipSimple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook5.3 Medium
- optimole – optimize images | convert webp & avif | cdn & lazy load | image optimizationOptimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action4.3 Medium
- algolplus advanced order export for woocommerceAdvanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter4.9 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter4.9 Medium
- pressprimer quiz – ai quiz maker, exam builder & lms assessment pluginPressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' Parameters4.3 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization4.3 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter4.9 Medium
- eventkoi event koi lite – events calendar, event management, rsvp, and ticketsEvent Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints5.3 Medium
- anton vanyukov offload, ai & optimize with cloudflare imagesOffload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action8.8 High
- fireplugins firebox popups – increase sales and grow your email listFireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter5.3 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter4.9 Medium
- equalizedigital equalize digital accessibility checker – wcag, ada, eaa and section 508 complianceEqualize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter4.3 Medium
- oleksandrz e2pdf – export pdf tool for wordpressE2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter8.8 High
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers4.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreCifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall7.8 High
- ptc flexplm, windchill and flexplm, windchill pdmlink +2 moreRemote Code Execution (RCE) vulnerability in Windchill PDMlink9.3 Critical
- util-linuxutil-linux libblkid DOS extended-partition overflow produces invalid partition metadata8.0 High
- util-linuxutil-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass7.0 High
- util-linuxutil-linux mount target TOCTOU allows local privilege escalation7.0 High
- util-linuxutil-linux mount hook_owner TOCTOU allows local privilege escalation7.0 High
- inhandnetworks ir912l-fq58 firmware, ir915l-fq39-s firmware +1 moreInHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...7.5 High
- inhandnetworks ir912l-fq58 firmware, ir915l-fq39-s firmware +1 moreInHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...9.8 Critical
- inhandnetworks ir912l-fq58 firmware, ir915l-fq39-s firmware +1 moreInHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...9.8 Critical
- inhandnetworks ir912l-fq58 firmware, ir915l-fq39-s firmware +1 moreInHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...9.8 Critical
- inhandnetworks ir912l-fq58 firmware, ir915l-fq39-s firmware +1 moreInHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were...9.8 Critical
- baptistearno typebot.ioTypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass8.2 High
- baptistearno typebot.ioTypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName9.3 Critical
- thingsboardThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code...8.6 High
- steeltoeoss steeltoe.configuration.encryptionSteeltoe: OAEP setting silently selects PKCS#1 v1.5 padding1.9 Low
- Show moreLoading…