Protect Web Society

CVE-2026-58167 - Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users

Maloy Roy Orko June 30, 2026

CVE ID : CVE-2026-58167 Published : June 30, 2026, 3:51 p.m. | 1 hour, 50 minutes ago …

CVE-2026-58166 - OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete

Maloy Roy Orko June 30, 2026

CVE ID : CVE-2026-58166 Published : June 30, 2026, 3:51 p.m. | 1 hour, 50 minutes ago …

CVE-2026-10652 - Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)

Maloy Roy Orko June 30, 2026

CVE ID : CVE-2026-10652 Published : June 30, 2026, 3:50 p.m. | 1 hour, 51 minutes ago …

CVE-2026-13581 - Edimax EW-7478APC POST Request formStaDrvSetup os command injection

Maloy Roy Orko June 29, 2026

CVE ID : CVE-2026-13581 Published : June 29, 2026, 3:15 p.m. | 2 hours, 26 minutes ago …

CVE-2026-13580 - Edimax EW-7478APC POST Request formQoS buffer overflow

Maloy Roy Orko June 29, 2026

CVE ID : CVE-2026-13580 Published : June 29, 2026, 3 p.m. | 2 hours, 41 minutes ago D…

CVE-2026-13507 - volcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticity

Maloy Roy Orko June 28, 2026

CVE ID : CVE-2026-13507 Published : June 28, 2026, 9:30 p.m. | 2 hours, 10 minutes ago …

CVE-2026-58049 - FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

Maloy Roy Orko June 27, 2026

CVE ID : CVE-2026-58049 Published : June 28, 2026, 1:32 a.m. | 2 hours, 7 minutes ago …

CVE-2026-8095 - Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion

Maloy Roy Orko June 27, 2026

CVE ID : CVE-2026-8095 Published : June 27, 2026, 11:28 p.m. | 2 hours, 11 minutes ago …

CVE-2026-10643 - Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)

Maloy Roy Orko June 27, 2026

CVE ID : CVE-2026-10643 Published : June 27, 2026, 10:59 p.m. | 41 minutes ago Descri…

CVE-2026-57518 - Pagekit CMS 1.0.18 Privilege Escalation via UserApiController

Maloy Roy Orko June 26, 2026

CVE ID : CVE-2026-57518 Published : June 26, 2026, 3:58 p.m. | 1 hour, 41 minutes ago …

CVE-2023-20572 - ASP Hash MAC Brute-Force Vulnerability

Maloy Roy Orko June 26, 2026

CVE ID : CVE-2023-20572 Published : June 26, 2026, 3:53 p.m. | 1 hour, 46 minutes ago …

CVE-2026-54448 - Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Maloy Roy Orko June 25, 2026

CVE ID : CVE-2026-54448 Published : June 25, 2026, 4:27 p.m. | 1 hour, 11 minutes ago …

CVE-2026-6094 - Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing crafted PKCS7 EnvelopedData

Maloy Roy Orko June 25, 2026

CVE ID : CVE-2026-6094 Published : June 25, 2026, 4:35 p.m. | 1 hour, 3 minutes ago D…

CVE-2026-13351 - net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

Maloy Roy Orko June 25, 2026

CVE ID : CVE-2026-13351 Published : June 25, 2026, 4:27 p.m. | 1 hour, 11 minutes ago …

CVE-2026-55092 - Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts

Maloy Roy Orko June 25, 2026

CVE ID : CVE-2026-55092 Published : June 25, 2026, 4:26 p.m. | 1 hour, 12 minutes ago …

CVE-2026-53108 - powerpc/64s: Fix unmap race with PMD migration entries

Maloy Roy Orko June 24, 2026

CVE ID : CVE-2026-53108 Published : June 24, 2026, 4:30 p.m. | 1 hour, 7 minutes ago …

CVE-2026-53107 - wifi: libertas: don't kill URBs in interrupt context

Maloy Roy Orko June 24, 2026

CVE ID : CVE-2026-53107 Published : June 24, 2026, 4:30 p.m. | 1 hour, 7 minutes ago …

CVE-2026-53106 - bpf: Do not allow deleting local storage in NMI

Maloy Roy Orko June 24, 2026

CVE ID : CVE-2026-53106 Published : June 24, 2026, 4:30 p.m. | 1 hour, 7 minutes ago …

CVE-2026-54013 - Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI

Maloy Roy Orko June 23, 2026

CVE ID : CVE-2026-54013 Published : June 23, 2026, 4:46 p.m. | 51 minutes ago Descrip…

CVE-2026-54015 - Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Maloy Roy Orko June 23, 2026

CVE ID : CVE-2026-54015 Published : June 23, 2026, 4:44 p.m. | 53 minutes ago Descrip…

CVE-2026-50269 - AIOHTTP: CRLF injection in multipart headers

Maloy Roy Orko June 22, 2026

CVE ID : CVE-2026-50269 Published : June 22, 2026, 4:30 p.m. | 1 hour, 6 minutes ago …

CVE-2026-54269 - protobufjs: Schema-derived names can shadow runtime-significant properties

Maloy Roy Orko June 22, 2026

CVE ID : CVE-2026-54269 Published : June 22, 2026, 4:23 p.m. | 1 hour, 13 minutes ago …

CVE-2026-56403 - Expat Integer Overflow

Maloy Roy Orko June 21, 2026

CVE ID : CVE-2026-56403 Published : June 21, 2026, 3:43 p.m. | 1 hour, 52 minutes ago …

CVE-2025-71331 - Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows

Maloy Roy Orko June 20, 2026

CVE ID : CVE-2025-71331 Published : June 20, 2026, 3:24 p.m. | 2 hours, 11 minutes ago …

CVE-2017-20266 - Joomla SP Movie Database 1.3 SQL Injection via searchword

Maloy Roy Orko June 19, 2026

CVE ID : CVE-2017-20266 Published : June 19, 2026, 4:04 p.m. | 1 hour, 30 minutes ago …

CVE-2026-56024 - WordPress WP EasyPay plugin <= 4.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Maloy Roy Orko June 18, 2026

CVE ID : CVE-2026-56024 Published : June 18, 2026, 3:27 p.m. | 2 hours, 5 minutes ago …

CVE-2025-71320 - picklescan - Remote Code Execution via Incomplete Disallowed Inputs

Maloy Roy Orko June 17, 2026

CVE ID : CVE-2025-71320 Published : June 17, 2026, 3:04 p.m. | 2 hours, 25 minutes ago …

CVE-2026-10636 - Use-after-free in Zephyr IPv4 IGMP send path (igmp_send)

Maloy Roy Orko June 16, 2026

CVE ID : CVE-2026-10636 Published : June 16, 2026, 3:16 p.m. | 2 hours, 12 minutes ago …

CVE-2025-15658 - WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability

Maloy Roy Orko June 15, 2026

CVE ID : CVE-2025-15658 Published : June 15, 2026, 4:16 p.m. | 1 hour, 10 minutes ago …

CVE-2026-54410 - nanoMODBUS TCP Server Off-by-One Buffer Overflow

Maloy Roy Orko June 14, 2026

CVE ID : CVE-2026-54410 Published : June 14, 2026, 6:17 p.m. | 1 hour, 7 minutes ago …

CVE-2026-12174 - D-Link DCS-935L HTTP rhea snprintf format string

Maloy Roy Orko June 13, 2026

CVE ID : CVE-2026-12174 Published : June 13, 2026, 8:15 p.m. | 1 hour, 7 minutes ago …

CVE-2026-12183 - Nefteprodukttekhnika BUK TS-G Improper Authentication

Maloy Roy Orko June 13, 2026

CVE ID : CVE-2026-12183 Published : June 13, 2026, 6:16 p.m. | 1 hour, 6 minutes ago …

CVE-2026-6428 - Koha SQL Injection

Maloy Roy Orko June 13, 2026

CVE ID : CVE-2026-6428 Published : June 13, 2026, 4:34 p.m. | 48 minutes ago Descript…

CVE-2026-48748 - Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

Maloy Roy Orko June 12, 2026

CVE ID : CVE-2026-48748 Published : June 12, 2026, 4:16 p.m. | 1 hour, 3 minutes ago …

CVE-2026-44492 - Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Maloy Roy Orko June 11, 2026

CVE ID : CVE-2026-44492 Published : June 11, 2026, 3:29 p.m. | 1 hour, 49 minutes ago …

CVE-2026-20257 - Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise

Maloy Roy Orko June 10, 2026

CVE ID : CVE-2026-20257 Published : June 10, 2026, 6:16 p.m. | 15 minutes ago Descrip…

CVE-2025-54509 - AMD Secure Processor Improper Access Control

Maloy Roy Orko June 09, 2026

CVE ID : CVE-2025-54509 Published : June 9, 2026, 5:22 p.m. | 47 minutes ago Descript…

CVE-2026-9213 - Insufficient input validation in certain NETGEAR routers

Maloy Roy Orko June 09, 2026

CVE ID : CVE-2026-9213 Published : June 9, 2026, 5:17 p.m. | 51 minutes ago Descripti…

CVE-2026-46291 - crypto: caam - guard HMAC key hex dumps in hash_digest_key

Maloy Roy Orko June 08, 2026

CVE ID : CVE-2026-46291 Published : June 8, 2026, 5:16 p.m. | 41 minutes ago Descript…

CVE-2026-11461 - NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization

Maloy Roy Orko June 07, 2026

CVE ID : CVE-2026-11461 Published : June 7, 2026, 10:16 p.m. | 1 hour, 41 minutes ago …

CVE-2026-11460 - Boost Serialization improper validation of specified type of input

Maloy Roy Orko June 07, 2026

CVE ID : CVE-2026-11460 Published : June 7, 2026, 8:16 p.m. | 1 hour, 41 minutes ago …

CVE-2026-11438 - theonedev projects improper authorization

Maloy Roy Orko June 06, 2026

CVE ID : CVE-2026-11438 Published : June 6, 2026, 5:16 p.m. | 40 minutes ago Descript…

CVE-2026-11437 - perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery

Maloy Roy Orko June 06, 2026

CVE ID : CVE-2026-11437 Published : June 6, 2026, 5:16 p.m. | 40 minutes ago Descript…

CVE-2026-11439 - theonedev Parent Project projects improper authorization

Maloy Roy Orko June 06, 2026

CVE ID : CVE-2026-11439 Published : June 6, 2026, 5:15 p.m. | 42 minutes ago Descript…

CVE-2026-11436 - Mage AI Sign-in Flow index.tsx useMutation cross site scripting

Maloy Roy Orko June 06, 2026

CVE ID : CVE-2026-11436 Published : June 6, 2026, 4:16 p.m. | 1 hour, 40 minutes ago …

CVE-2026-50733 - Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

Maloy Roy Orko June 05, 2026

CVE ID : CVE-2026-50733 Published : June 5, 2026, 6:17 p.m. | 1 hour, 39 minutes ago …

CVE-2026-38570 - bacnet_stack Out-of-bounds Read

Maloy Roy Orko June 04, 2026

CVE ID : CVE-2026-38570 Published : June 4, 2026, 4:16 p.m. | 1 hour, 39 minutes ago …

CVE-2026-46266 - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Maloy Roy Orko June 03, 2026

CVE ID : CVE-2026-46266 Published : June 3, 2026, 3:50 p.m. | 2 hours, 5 minutes ago …

CVE-2026-49753 - HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

Maloy Roy Orko June 02, 2026

CVE ID : CVE-2026-49753 Published : June 2, 2026, 4:16 p.m. | 1 hour, 38 minutes ago …

CVE-2026-48862 - Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

Maloy Roy Orko June 02, 2026

CVE ID : CVE-2026-48862 Published : June 2, 2026, 4:16 p.m. | 1 hour, 38 minutes ago …

CVE-2026-48861 - CRLF injection in HTTP/1 request line via unvalidated method in Mint

Maloy Roy Orko June 02, 2026

CVE ID : CVE-2026-48861 Published : June 2, 2026, 4:16 p.m. | 1 hour, 38 minutes ago …

CVE-2026-47117 - OpenMed < 1.5.2 Remote Code Execution via PII Model Loading

Maloy Roy Orko June 02, 2026

CVE ID : CVE-2026-47117 Published : June 2, 2026, 4:16 p.m. | 1 hour, 38 minutes ago …

CVE-2026-42675 - WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability

Maloy Roy Orko June 01, 2026

CVE ID : CVE-2026-42675 Published : June 1, 2026, 5:17 p.m. | 37 minutes ago Descript…

CVE-2026-42674 - WordPress Advanced Access Manager plugin <= 7.1.0 - Bypass Vulnerability vulnerability

Maloy Roy Orko June 01, 2026

CVE ID : CVE-2026-42674 Published : June 1, 2026, 5:16 p.m. | 37 minutes ago Descript…

CVE-2026-42673 - WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

Maloy Roy Orko June 01, 2026

CVE ID : CVE-2026-42673 Published : June 1, 2026, 5:16 p.m. | 37 minutes ago Descript…

CVE-2026-42672 - WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability

Maloy Roy Orko June 01, 2026

CVE ID : CVE-2026-42672 Published : June 1, 2026, 5:16 p.m. | 37 minutes ago Descript…