CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU6.4 Medium
- amin a.rezapour product specifications for woocommerceProduct Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps…4.3 Medium
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter4.3 Medium
- unknown shariff for wordpressShariff for WordPress <= 1.0.11 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict contentProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR8.1 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class5.3 Medium
- maxfoundry maxbuttons – create buttonsMaxButtons <= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parameter6.1 Medium
- pravel invoice generatorInvoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter9.8 Critical
- hcl software traveler for microsoft outlookHCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposure5.5 Medium
- harmonic design hd quizHD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers4.3 Medium
- vinod-dalvi ivory search – wordpress search pluginIvory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings4.4 Medium
- codepeople post map for google mapsCodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta6.4 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter6.5 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter6.5 Medium
- hcl software traveler for microsoft outlookHCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service7.7 High
grokOSS-FuzzHeap-buffer-overflow in std::__1::__function::__func<grk::FileFormatJP2Decompress::FileFormatJP2DecompreNo score- pnpmpnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config8.2 High
- pnpmpnpm: patch-remove could delete project-selected files outside the patches directory7.1 High
ogreOSS-FuzzUNKNOWN READ in unsigned long std::__1::__tree<Ogre::VertexDeclaration*, std::__1::less<Ogre::VeNo scorebinutilsOSS-FuzzHeap-buffer-overflow in bfd_getl16No score- pnpmpnpm: hoisted install imports lockfile alias outside node_modules7.1 High
open5gsOSS-FuzzUse-of-uninitialized-value in ogs_cpystrnNo score- kovidgoyal calibrecalibre: Arbitrary Code Execution in Template Formatter via Book Metadata8.5 High
- nezhahq nezhaNezha Monitoring: DDNS and Notification credential exposure via unredacted list API6.9 Medium
- statamic cmsStatamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors3.5 Low
- statamic cmsStatamic: CSV formula injection in form submission exports6.1 Medium
- statamic cmsStatamic: Server-Side Request Forgery via Glide (DNS rebinding)4.9 Medium
- h.view hv-500s6 ip cameraH.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous Type8.6 High
- h.view hv-500s6 ip cameraH.VIEW HV-500S6 IP Camera OS Command Injection8.6 High
- daktronics dmp-5000, dmp-5000 firmware, dmp-8000 +3 more +5 moreDaktronics Controller Firmware Use of Hard-coded Credentials9.3 Critical
- sunnyadn js-tomljs-toml has silent type confusion via falsy-primitive duplicate-key bypass5.3 Medium
- daktronics dmp-5000, dmp-5000 firmware, dmp-8000 +3 more +5 moreDaktronics Controller Firmware Unrestricted Upload of File with Dangerous Type8.4 High
- regclientregclient may leak authentication credentials to external blob stores6.8 Medium
- daktronics dmp-5000, dmp-5000 firmware, dmp-8000 +3 more +5 moreDaktronics Controller Firmware Path Traversal9.3 Critical
- nezhahq nezhaNezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check9.9 Critical
github.com/blnkfinance/blnkGoBlnk has an API key authorization bypass in owner and scope enforcementNo scoresolidinvoice/solidinvoicePackagistSolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings8.9 High- aimeos pagibleAimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy3.0 Low
- juev nebula-meshNebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)8.8 High
@cardano402/mcp-servernpm@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url0.0 NonedosagePyPIDosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers6.1 Medium- scribanScriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service8.7 High
- scribanScriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication8.7 High
github.com/juev/nebula-meshGonebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction2.7 Lowweb-auth/webauthn-symfony-bundlePackagistWebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs6.6 Medium- kestra, kestra oss +1 moreKestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`10.0 Critical
- kestraKestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read7.7 High
better-helperjsnpmbetter-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server7.5 High- kestraKestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)7.7 High
- julianhille muhammarajsMuhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key7.5 High
- Show moreLoading…