| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-54192 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions. | ||
| CVE-2026-54189 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | ||
| CVE-2026-54188 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | ||
| CVE-2026-54185 | Hig | 0.55 | 8.5 | 0.00 | Jun 17, 2026 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. | ||
| CVE-2026-54184 | Hig | 0.53 | 8.2 | 0.00 | Jun 17, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions. | ||
| CVE-2026-53876 | Hig | 0.47 | 7.2 | 0.02 | Jun 17, 2026 | RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who logs in to the web console as an administrator. | ||
| CVE-2026-52698 | Hig | 0.48 | 7.4 | 0.00 | Jun 17, 2026 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions. | ||
| CVE-2026-52696 | Hig | 0.49 | 7.5 | 0.00 | Jun 17, 2026 | Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions. | ||
| CVE-2026-49778 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. | ||
| CVE-2026-49113 | Hig | 0.55 | 8.5 | 0.00 | Jun 17, 2026 | Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions. | ||
| CVE-2026-49081 | Hig | 0.53 | 8.2 | 0.00 | Jun 17, 2026 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. | ||
| CVE-2026-49074 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions. | ||
| CVE-2026-49073 | Hig | 0.55 | 8.5 | 0.00 | Jun 17, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3. | ||
| CVE-2026-49057 | Hig | 0.49 | 7.5 | 0.00 | Jun 17, 2026 | Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. | ||
| CVE-2026-48967 | Hig | 0.55 | 8.5 | 0.00 | Jun 17, 2026 | Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. | ||
| CVE-2026-48929 | Hig | 0.42 | 7.5 | 0.01 | Jun 17, 2026 | Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an… | ||
| CVE-2026-48869 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions. | ||
| CVE-2026-48788 | Hig | 0.46 | 8.2 | 0.00 | Jun 17, 2026 | Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an… | ||
| CVE-2026-48779 | Hig | 0.42 | 7.5 | 0.01 | Jun 17, 2026 | ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high… | ||
| CVE-2026-42629 | Hig | 0.57 | 8.8 | 0.00 | Jun 17, 2026 | Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions. | ||
| CVE-2026-42385 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions. | ||
| CVE-2026-41557 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions. | ||
| CVE-2026-40768 | Hig | 0.47 | 7.3 | 0.00 | Jun 17, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions. | ||
| CVE-2026-40765 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions. | ||
| CVE-2026-40761 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. | ||
| CVE-2026-40760 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Behold <= 1.5 versions. | ||
| CVE-2026-40759 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Esmée <= 1.4 versions. | ||
| CVE-2026-40758 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions. | ||
| CVE-2026-40755 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. | ||
| CVE-2026-40754 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. | ||
| CVE-2026-40753 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. | ||
| CVE-2026-40751 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. | ||
| CVE-2026-40739 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions. | ||
| CVE-2026-40736 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions. | ||
| CVE-2026-40735 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. | ||
| CVE-2026-40731 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions. | ||
| CVE-2026-40726 | Hig | 0.53 | 8.2 | 0.00 | Jun 17, 2026 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. | ||
| CVE-2026-40721 | Hig | 0.49 | 7.5 | 0.00 | Jun 17, 2026 | Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions. | ||
| CVE-2026-39598 | Hig | 0.52 | 8.0 | 0.00 | Jun 17, 2026 | Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2. | ||
| CVE-2026-39597 | Hig | 0.39 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions. | ||
| CVE-2026-39582 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions. | ||
| CVE-2026-39580 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. | ||
| CVE-2026-39573 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions. | ||
| CVE-2026-39568 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions. | ||
| CVE-2026-39567 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. | ||
| CVE-2026-39558 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Malmö <= 2.2 versions. | ||
| CVE-2026-39557 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. | ||
| CVE-2026-39554 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. | ||
| CVE-2026-39549 | Hig | 0.53 | 8.1 | 0.00 | Jun 17, 2026 | Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions. | ||
| CVE-2026-39548 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions. |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.
- risk 0.55cvss 8.5epss 0.00
Subscriber SQL Injection in Cornerstone < 7.8.8 versions.
- risk 0.53cvss 8.2epss 0.00
Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.
- risk 0.47cvss 7.2epss 0.02
RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who logs in to the web console as an administrator.
- risk 0.48cvss 7.4epss 0.00
Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.
- risk 0.55cvss 8.5epss 0.00
Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.
- risk 0.53cvss 8.2epss 0.00
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.
- risk 0.55cvss 8.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.
- risk 0.55cvss 8.5epss 0.00
Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.
- risk 0.42cvss 7.5epss 0.01
Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.
- risk 0.46cvss 8.2epss 0.00
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an…
- risk 0.42cvss 7.5epss 0.01
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high…
- risk 0.57cvss 8.8epss 0.00
Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.
- risk 0.47cvss 7.3epss 0.00
Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Behold <= 1.5 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Reina <= 2.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.
- risk 0.53cvss 8.2epss 0.00
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.
- risk 0.49cvss 7.5epss 0.00
Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.
- risk 0.52cvss 8.0epss 0.00
Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2.
- risk 0.39cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.
- risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.