| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-41280 | Med | 0.25 | 4.9 | 0.01 | Jun 17, 2026 | Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue. | ||
| CVE-2026-40783 | Cri | 0.64 | 9.9 | 0.01 | Jun 17, 2026 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions. | ||
| CVE-2026-40768 | Hig | 0.47 | 7.3 | 0.00 | Jun 17, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions. | ||
| CVE-2026-40765 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions. | ||
| CVE-2026-40761 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. | ||
| CVE-2026-40760 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Behold <= 1.5 versions. | ||
| CVE-2026-40759 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Esmée <= 1.4 versions. | ||
| CVE-2026-40758 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions. | ||
| CVE-2026-40755 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. | ||
| CVE-2026-40754 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. | ||
| CVE-2026-40753 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. | ||
| CVE-2026-40751 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. | ||
| CVE-2026-40749 | Cri | 0.64 | 9.9 | 0.00 | Jun 17, 2026 | Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions. | ||
| CVE-2026-40748 | Cri | 0.64 | 9.9 | 0.00 | Jun 17, 2026 | Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions. | ||
| CVE-2026-40747 | Cri | 0.64 | 9.9 | 0.00 | Jun 17, 2026 | Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions. | ||
| CVE-2026-40746 | Cri | 0.64 | 9.9 | 0.00 | Jun 17, 2026 | Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions. | ||
| CVE-2026-40739 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions. | ||
| CVE-2026-40736 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions. | ||
| CVE-2026-40735 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. | ||
| CVE-2026-40731 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions. | ||
| CVE-2026-40726 | Hig | 0.53 | 8.2 | 0.00 | Jun 17, 2026 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. | ||
| CVE-2026-40725 | Cri | 0.64 | 9.8 | 0.01 | Jun 17, 2026 | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. | ||
| CVE-2026-40724 | Med | 0.42 | 6.5 | 0.00 | Jun 17, 2026 | CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions. | ||
| CVE-2026-40723 | Med | 0.28 | 4.3 | 0.00 | Jun 17, 2026 | Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions. | ||
| CVE-2026-40722 | Med | 0.36 | 5.5 | 0.00 | Jun 17, 2026 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6. | ||
| CVE-2026-40721 | Hig | 0.49 | 7.5 | 0.00 | Jun 17, 2026 | Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions. | ||
| CVE-2026-39598 | Hig | 0.52 | 8.0 | 0.00 | Jun 17, 2026 | Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2. | ||
| CVE-2026-39597 | Hig | 0.39 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions. | ||
| CVE-2026-39596 | Cri | 0.60 | 9.3 | 0.00 | Jun 17, 2026 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. | ||
| CVE-2026-39595 | Med | 0.31 | 4.7 | 0.00 | Jun 17, 2026 | Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. | ||
| CVE-2026-39589 | Cri | 0.64 | 9.9 | 0.00 | Jun 17, 2026 | Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions. | ||
| CVE-2026-39582 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions. | ||
| CVE-2026-39580 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. | ||
| CVE-2026-39578 | Med | 0.36 | 5.5 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Valiance <= 1.2 versions. | ||
| CVE-2026-39577 | Med | 0.36 | 5.5 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions. | ||
| CVE-2026-39573 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions. | ||
| CVE-2026-39568 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions. | ||
| CVE-2026-39567 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. | ||
| CVE-2026-39558 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Malmö <= 2.2 versions. | ||
| CVE-2026-39557 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. | ||
| CVE-2026-39554 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. | ||
| CVE-2026-39549 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions. | ||
| CVE-2026-39548 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions. | ||
| CVE-2026-39547 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Getaway < 1.8 versions. | ||
| CVE-2026-39546 | Hig | 0.49 | 7.6 | 0.00 | Jun 17, 2026 | Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions. | ||
| CVE-2026-39545 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions. | ||
| CVE-2026-39539 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions. | ||
| CVE-2026-39537 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions. | ||
| CVE-2026-39529 | Cri | 0.64 | 9.8 | 0.01 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | ||
| CVE-2026-39522 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Solene <= 3.4 versions. |
- risk 0.25cvss 4.9epss 0.01
Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.
- risk 0.64cvss 9.9epss 0.01
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.
- risk 0.47cvss 7.3epss 0.00
Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Behold <= 1.5 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.
- risk 0.64cvss 9.9epss 0.00
Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.
- risk 0.64cvss 9.9epss 0.00
Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.
- risk 0.64cvss 9.9epss 0.00
Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.
- risk 0.64cvss 9.9epss 0.00
Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Reina <= 2.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.
- risk 0.53cvss 8.2epss 0.00
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.
- risk 0.64cvss 9.8epss 0.01
Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.
- risk 0.42cvss 6.5epss 0.00
CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.
- risk 0.28cvss 4.3epss 0.00
Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.
- risk 0.36cvss 5.5epss 0.00
Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6.
- risk 0.49cvss 7.5epss 0.00
Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.
- risk 0.52cvss 8.0epss 0.00
Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2.
- risk 0.39cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.
- risk 0.60cvss 9.3epss 0.00
Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.
- risk 0.31cvss 4.7epss 0.00
Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.
- risk 0.64cvss 9.9epss 0.00
Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.
- risk 0.36cvss 5.5epss 0.00
Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.
- risk 0.36cvss 5.5epss 0.00
Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Getaway < 1.8 versions.
- risk 0.49cvss 7.6epss 0.00
Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.
- risk 0.64cvss 9.8epss 0.01
Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Solene <= 3.4 versions.