CVEs published June 14, 2026

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle.

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5.

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5.

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte…

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle.

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running…

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to…

LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c that allows a remote unauthenticated…

A vulnerability was found in Comma AI Openpilot 0.11.

When applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials).

A vulnerability was detected in Grit42 Grit up to 0.11.0.

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or…

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android.

A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android.

A vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0.