CVEs published June 21, 2026

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server.

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript.

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges.

The following vulnerability has been resolved: ksmbd: scope conn->binding slowpath to bound sessions only When the binding SESSION_SETUP sets conn->binding = true, the flag stays set after the call so…

A vulnerability has been found in Edimax BR-6478AC V2 1.23.

A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76.

A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0.

A security flaw has been discovered in EaseUS Partition Master up to 14.5.

A vulnerability was identified in EaseUS Partition Master up to 14.5.

A vulnerability was determined in AOMEI Backupper up to 8.3.0.

A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1.

A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1.

Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing operations without enforcing…

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members.

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API key validity oracle and user…

A vulnerability was determined in BerriAI litellm up to 1.82.2.

A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863.

A weakness has been identified in BerriAI litellm up to 1.59.8.

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the…

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.

libexpat before 2.8.2 has an integer overflow in copyString.

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.

libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.

libexpat before 2.8.2 has an integer overflow in getAttributeId.

libexpat before 2.8.2 has an integer overflow in addBinding.

libexpat before 2.8.2 has an integer overflow in storeAtts.

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks.

Capgo before 12.128.2 contains a broken row level security policy in the org_users table that allows authenticated users to elevate privileges from admin to super_admin.

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by…

A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8.

A vulnerability was detected in activepieces up to 0.83.0.

A security flaw has been discovered in Edimax BR-6478AC V2 1.23.

A vulnerability was identified in Edimax BR-6478AC V2 1.23.

A vulnerability was determined in Edimax BR-6478AC V2 1.23.

A vulnerability was found in Edimax BR-6478AC V2 1.23.

A flaw has been found in OFFIS DCMTK up to 3.7.0.

A weakness has been identified in BerriAI litellm up to 1.82.2.

A security flaw has been discovered in BerriAI litellm up to 1.82.5.

A vulnerability was identified in BerriAI litellm up to 1.82.2.

A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0.

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0.

A flaw has been found in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863.

A security vulnerability has been detected in BerriAI litellm up to 1.82.2.

A security flaw has been discovered in BerriAI litellm up to 1.82.2.

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation.

A vulnerability was determined in BerriAI litellm up to 1.63.1.

Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through…

Capgo before 12.128.2 contains an authentication bypass vulnerability in the /build/upload/:jobId/* endpoint that allows unauthenticated attackers to trigger consistent 500 errors.

A vulnerability was identified in BerriAI litellm up to 1.82.2.

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation.

Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered…

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type.

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping.

A vulnerability was identified in ILIAS Learning Management System 11.0.

Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint.

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint.

A weakness has been identified in kortix-ai suna up to 0.8.38.

A vulnerability was detected in lemonldap-ng up to 2.23.0.

A security vulnerability has been detected in BerriAI litellm up to 1.82.2.

ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop.

ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit…

A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0.