CVEs published June 16, 2026

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion.

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server.

Use-after-free in the Graphics: WebGPU component.

This could lead to remote code execution with no additional execution privileges needed.

Sandbox escape due to incorrect boundary conditions in the Networking component.

Sandbox escape in the Security: Process Sandboxing component.

Sandbox escape in the DOM: Navigation component.

Sandbox escape in the DOM: Workers component.

Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection.

1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted d.share.Path…

Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode…

The device has a webserver that exposes a REST API authenticated with a token on the management network.

Mitigation bypass in the DOM: Security component.

Mitigation bypass in the DOM: Security component.

Same-origin policy bypass in the Networking: Cookies component.

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8.

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including,…

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and…

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0.

Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in…

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation.

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

Use-after-free in the Networking: HTTP component.

Privilege escalation in the Graphics: WebRender component.

Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using…

An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote escalation of privilege with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability.

A denial of service security issue exists in the affected product.

A denial-of-service security issue exists within the 1794-AENTR adapter due to improper memory handling of CIP protocol requests.

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved.

The device has a webserver that exposes a REST API authenticated with a constant token.

A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier.

A flaw was found in Pacemaker.

Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables on Linux and macOS systems.

Forem is open source software for building communities.

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8.

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands.

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation.

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name changes.

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters.

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs.

Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151.

Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151.

Memory safety bugs present in Firefox 151 and Thunderbird 151.

Incorrect boundary conditions in the Web Audio component.

Memory safety bug fixed in Firefox 152.

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as &quot;RoguePlanet &quot;.

DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.

the pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the GLOBAL opcode handler.

Versions prior to master-584-0a7ae07 are vulnerable to heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files.

The pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the BINUNICODE opcode handler.

The following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop…

NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data.

NVIDIA NeMo Framework for all platforms contains a code injection vulnerability.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with root privileges needed.

This could lead to local escalation of privilege with System execution privileges needed.

This could lead to local escalation of privilege with System execution privileges needed.

This could lead to local escalation of privilege with System execution privileges needed.

This could lead to remote code execution with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

The private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems.

Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1.

Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.

Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.

A command injection vulnerability was found in galaxy_ng.

Memory safety bug fixed in Firefox 152.

Memory safety bug fixed in Firefox 152.

Memory safety bug fixed in Firefox 152.

Memory safety bug fixed in Firefox 152.

Memory safety bug fixed in Firefox 152.

This could lead to remote denial of service with no additional execution privileges needed.

This could lead to remote denial of service with no additional execution privileges needed.

This could lead to remote denial of service with no additional execution privileges needed.

The ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local…

Incorrect boundary conditions in the Graphics: CanvasWebGL component.

Incorrect boundary conditions in the Libraries component in NSS.

This could lead to local escalation of privilege with no additional execution privileges needed.

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository…

Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.

Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection.

OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs.

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots.

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution.

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects.

Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests.

This could lead to local escalation of privilege with no additional execution privileges needed.

A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port.

A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior.

Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier

The JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads.

OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags.

A flaw was found in GnuTLS.

Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.

Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.

Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site.

OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model or workspace-derived URLs.

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom state across channel boundaries.

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization.

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lacking a capability check to…

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels.

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to,…

Denial-of-service in the Graphics: ImageLib component.

Denial-of-service in the Audio/Video: Playback component.

Memory safety bug fixed in Firefox 152.

Mitigation bypass in the DOM: Security component.

Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.

This could lead to remote information disclosure with no additional execution privileges needed.

This could lead to remote information disclosure with no additional execution privileges needed.

This could lead to remote denial of service causing a communication processor crash with no additional execution privileges needed.

The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all versions up to, and including, 2.1.6 due to…

A sensitive information disclosure security issue exists within the affected CompactLogix controllers.

On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of active memory domains using a list node…

Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS).

Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.

subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try_send_data().

subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt) returned successfully.

A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component.

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component.

A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners).

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor.

OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions.

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks.

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.

Versions prior to master-584-0a7ae07 are vulnerable to an out-of-bounds reads error through PyTorch checkpoint pickle opcode parsing.

A flaw was found in libXpm.

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry…

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope…

OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without…

Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and earlier.

The server create API does not strip certain hint data.

Incorrect boundary conditions in the Internationalization component.

Spoofing issue in the DOM: Core & HTML component.

Clickjacking issue in the Widget: Gtk component.

JIT miscompilation in the JavaScript: WebAssembly component.

JIT miscompilation in the DOM: Core & HTML component.

Memory safety bug fixed in Firefox 152.

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2.

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7.

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications.

Memory safety bug fixed in Thunderbird ESR 140.12.

Memory safety bug fixed in Firefox 152.

Memory safety bug fixed in Firefox 152.

Memory safety bug fixed in Firefox 152.

Memory safety bug fixed in Firefox 152.

Memory safety bug fixed in Firefox 152.

To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically,…

This could lead to remote information disclosure with no additional execution privileges needed.

This could lead to remote information disclosure with no additional execution privileges needed.

A session fixation vulnerability has been identified in osTicket v1.18.2.

A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array before the system call.

Icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and then, on success, calls net_stats_update_icmp_sent(net_pkt_iface(reply)).…

Information disclosure, sandbox escape in the Security: Process Sandboxing component.

Information disclosure, sandbox escape in the Security: Process Sandboxing component.

Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated…

OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent.

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage.

Information disclosure in the Password Manager component.

Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component.

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not…

Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.

The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.

This could lead to remote information disclosure with no additional execution privileges needed.

This could lead to remote information disclosure with no additional execution privileges needed.

This could lead to remote information disclosure with no additional execution privileges needed.

This could lead to remote information disclosure with no additional execution privileges needed.

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes.

OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity.

Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent statistics by calling net_pkt_iface(pkt)…

This could lead to local information disclosure with no additional execution privileges needed.

This could lead to local information disclosure with no additional execution privileges needed.

This could lead to local information disclosure with no additional execution privileges needed.

This could lead to local information disclosure with no additional execution privileges needed.

Igmp_send() in subsys/net/ip/igmp.c read the network interface back out of the packet via net_pkt_iface(pkt) after the packet had been handed to net_send_data().