Skip to content

Daily CVE Report — 2026-06-06 (52 CVEs, 9 critical) #19

Open
Open
Daily CVE Report — 2026-06-06 (52 CVEs, 9 critical)#19

Description

@github-actions
github-actions
bot
opened on Jun 6, 2026

Daily CVE Report — 2026-06-06

52 CVEs published in the last 24 hours with CVSS ≥ 7.0

  • 🔴 Critical (9.0–10.0): 9
  • 🟠 High (7.0–8.9): 43

IOCs listed are potential indicators based on vulnerability class — treat as a starting point for threat hunting, not confirmed detections.

CVE-2026-46389 | CVSS 10.0 🔴 CRITICAL

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-46389
Weakness: CWE-287, CWE-303

Situation

UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the client-kubernetes-secret Keycloak client authenticator (shipped by uds-identity-config and consumed by UDS Core) causes the submitted client_secret to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a client_id using this authenticator can authenticate as that client with any client_secret value and obtain OAuth2 tokens scoped to the client's service account. In the case of the uds-operator client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.

Potential IOCs

  • Authentication bypass attempts in access logs
  • Logins without corresponding credential validation events
  • Sessions created without prior authentication events

Remediation

CVE-2026-45744 | CVSS 9.9 🔴 CRITICAL

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45744
Weakness: CWE-78

Situation

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.

Potential IOCs

  • Unexpected child processes spawned by the web/app server
  • Unusual system command executions in OS audit logs
  • New cron jobs or scheduled tasks

Remediation

CVE-2025-71317 | CVSS 9.8 🔴 CRITICAL

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-71317
Weakness: CWE-798

Situation

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrator privileges, allowing them to alter device configuration, enable the telnet/SSH services, and reset local user credentials.

Potential IOCs

  • Successful logins from unexpected IPs using default credentials
  • Brute-force attempts against known default accounts

Remediation

CVE-2025-71318 | CVSS 9.8 🔴 CRITICAL

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-71318
Weakness: CWE-306

Situation

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — including shutdown, reboot, switch-on-bypass, and battery test — without supplying any credentials.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-45748 | CVSS 9.8 🔴 CRITICAL

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45748
Weakness: CWE-78

Situation

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The POST /ssh/tunnel/connect endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (endpointIP, endpointUsername, password) directly into a shell command without escaping, allowing persistent OS command injection on the source SSH host. Version 2.3.2 patches the issue.

Potential IOCs

  • Unexpected child processes spawned by the web/app server
  • Unusual system command executions in OS audit logs
  • New cron jobs or scheduled tasks

Remediation

CVE-2026-10580 | CVSS 9.8 🔴 CRITICAL

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-10580
Weakness: CWE-285

Situation

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/ with a {"password":"<new_password>"} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-45758 | CVSS 9.6 🔴 CRITICAL

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45758
Weakness: CWE-506

Situation

Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of guardrails-ai (0.10.1) to PyPI. Aany user who installed guardrails-ai==0.10.1 from PyPI on May 11, 2026 may be affected. Security researchers identified the malicious package within approximately 2 hours of publication, and PyPI quarantined the repository. Based on our telemetry, Guardrails AI maintainers have observed no requests to Guardrails AI infrastructure originating from the malicious 0.10.1 version, and a review of system and access logs has produced no evidence of user data exfiltration through their systems. Users should upgrade to version 0.10.2 or downgrade to version 0.10.0, both of which are unaffected. Those who installed version 0.10.1 should rotate any credentials accessible from their machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit their GitHub account for unauthorized workflows or repositories.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-45746 | CVSS 9.0 🔴 CRITICAL

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45746
Weakness: CWE-284, CWE-639

Situation

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-45750 | CVSS 9.0 🔴 CRITICAL

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45750
Weakness: CWE-78, CWE-639

Situation

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell. Version 2.3.2 fixes the issue.

Potential IOCs

  • Unexpected child processes spawned by the web/app server
  • Unusual system command executions in OS audit logs
  • New cron jobs or scheduled tasks

Remediation

CVE-2026-48095 | CVSS 8.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48095
Weakness: CWE-190, CWE-787

Situation

7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)1 << (BlockSizeLog + CompressionUnit), and a crafted image with ClusterSizeLog >= 28 and CompressionUnit == 4 drives the exponent to 32, which is undefined behavior and collapses on x86/x64 so _inBuf is allocated as 1 byte. ReadStream_FALSE then writes up to 256 MB of attacker-controlled data into that 1-byte buffer in 64 KB iterations, and because the CInStream object sits only 304 bytes after _inBuf, its vtable pointer is overwritten and the next dispatched call achieves a vtable hijack. On 32-bit builds the overflow is unconditionally reached; on 64-bit it requires the parallel 8 GB _outBuf allocation to succeed, otherwise failing closed to denial of service. The NTFS handler is enabled by default in stock 7z.dll and, via signature-based fallback matching "NTFS " at offset 3, will open a crafted image regardless of file extension during extraction or testing. Version 26.01 fixes the issue.

Potential IOCs

  • Integer overflow conditions in application error logs
  • Unexpected large numeric values in request parameters

Remediation

CVE-2026-49492 | CVSS 8.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49492
Weakness: CWE-78

Situation

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use.

Potential IOCs

  • Unexpected child processes spawned by the web/app server
  • Unusual system command executions in OS audit logs
  • New cron jobs or scheduled tasks

Remediation

CVE-2026-49493 | CVSS 8.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49493
Weakness: CWE-94

Situation

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data.

Potential IOCs

  • Unexpected code execution events in app logs
  • New processes spawned by the application runtime

Remediation

CVE-2026-50733 | CVSS 8.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50733
Weakness: CWE-95

Situation

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-5411 | CVSS 8.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-5411
Weakness: CWE-434

Situation

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.

Potential IOCs

  • Unexpected file types uploaded to the server
  • New executable files in upload directories
  • Unexpected outbound connections from upload directories

Remediation

CVE-2026-5415 | CVSS 8.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-5415
Weakness: CWE-288

Situation

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_temporary_links() function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed to all authenticated backend users (including Subscribers) via wp_localize_script() on all non-settings admin pages when the plugin's welcome pointer has not been dismissed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass normal authentication and log in as any user, including Administrators, resulting in complete account takeover.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-7654 | CVSS 8.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-7654
Weakness: CWE-502

Situation

The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of unserialize() without an allowed_classes restriction in the IdsToCollection::get_ids_from_string() function, which processes attacker-controlled post meta values without proper validation. This makes it possible for authenticated attackers with Contributor-level access and above to inject a serialized PHP object into a post's custom meta field and trigger arbitrary code execution by exploiting a bundled POP gadget chain, resulting in remote code execution as the web server user.

Potential IOCs

  • Malformed or unexpected serialized objects in requests
  • Unexpected object instantiation or class-loading in app logs

Remediation

CVE-2026-46392 | CVSS 8.7 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-46392
Weakness: CWE-178, CWE-434

Situation

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML files is case-sensitive. An HTML file uploaded with an uppercase extension (.HTML, .Html, .HTM) is still served as text/html but the forced-download header never applies, so the browser renders it inline and executes any embedded JavaScript in the HAXcms origin. This bypasses the mitigation shipped for CVE-2026-22704. Version 26.0.0 contains a fix.

Potential IOCs

  • Unexpected file types uploaded to the server
  • New executable files in upload directories
  • Unexpected outbound connections from upload directories

Remediation

CVE-2025-5088 | CVSS 8.3 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-5088
Weakness: CWE-269

Situation

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-45327 | CVSS 8.2 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45327
Weakness: CWE-306

Situation

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a ?password= query parameter, comparing the supplied password against the per-mount source password (or the default_source_password fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in disabled_mounts. The same release also tightens an adjacent endpoint, POST /admin/golive/chunk, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-45743 | CVSS 8.1 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45743
Weakness: CWE-639

Situation

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the requesting user owns the SSH session identified by sessionId. An authenticated attacker who knows or guesses another user's active sessionId can read, write, delete, download, and execute files on the victim's connected SSH host. Version 2.3.2 patches the issue.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-45749 | CVSS 8.1 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45749
Weakness: CWE-308

Situation

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The POST /users/totp/disable and POST /users/totp/backup-codes endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without ever possessing the TOTP device or knowing a valid TOTP code. This renders two-factor authentication ineffective. Version 2.3.2 patches the issue.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-11416 | CVSS 8.1 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11416
Weakness: CWE-22

Situation

MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded content to be written outside the configured download directory, potentially overwriting arbitrary files including configuration or plugin files reachable by the application process.

Potential IOCs

  • Directory traversal sequences (../) in request paths
  • Access to files outside expected document root in logs

Remediation

CVE-2026-45745 | CVSS 8.0 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45745
Weakness: CWE-295

Situation

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop (Electron) disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured Termix server. This can lead to credential theft and JWT/session theft during login and normal use. As of time of publication, no known patched versions are available.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-11400 | CVSS 8.0 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11400
Weakness: CWE-426

Situation

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper.

To remediate this issue, users should upgrade to AWS Advanced JDBC Wrapper version 4.0.1.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-11401 | CVSS 8.0 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11401
Weakness: CWE-426

Situation

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper.

To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-05-26

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-21029 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21029
Affected: samsung android 14.0, samsung android 15.0, samsung android 16.0

Situation

Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-21030 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21030
Affected: samsung android 14.0, samsung android 15.0, samsung android 16.0

Situation

Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-21031 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21031
Affected: samsung android 15.0, samsung android 16.0
Weakness: CWE-863

Situation

Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-50256 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50256
Weakness: CWE-121

Situation

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-50257 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50257
Weakness: CWE-416

Situation

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Potential IOCs

  • Heap corruption indicators in crash/core dumps
  • Unexpected memory access violations in system logs

Remediation

CVE-2026-50258 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50258
Weakness: CWE-121

Situation

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-50259 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50259
Weakness: CWE-121

Situation

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-50260 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50260
Weakness: CWE-416

Situation

A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Potential IOCs

  • Heap corruption indicators in crash/core dumps
  • Unexpected memory access violations in system logs

Remediation

CVE-2026-50261 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50261
Weakness: CWE-416

Situation

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Potential IOCs

  • Heap corruption indicators in crash/core dumps
  • Unexpected memory access violations in system logs

Remediation

CVE-2026-50264 | CVSS 7.8 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50264
Weakness: CWE-787

Situation

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-50234 | CVSS 7.5 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50234
Weakness: CWE-22

Situation

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

Potential IOCs

  • Directory traversal sequences (../) in request paths
  • Access to files outside expected document root in logs

Remediation

CVE-2026-45290 | CVSS 7.5 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45290
Weakness: CWE-770

Situation

Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to 1.0.0.CR3-20260417.085727-30 impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a vulnerability in Network to stall the netty event loop, rendering it inoperable. All consumers of the library should upgrade to at least version 1.0.0.CR3-20260417.085727-30. There are no known workarounds beyond updating the library.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-45291 | CVSS 7.5 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45291
Weakness: CWE-20

Situation

Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to 1.0.0.CR3-20260418.124334-32 impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a bug in Network to close the parent netty channel, rendering it inoperable. All consumers of the library should upgrade to at least version 1.0.0.CR3-20260418.124334-32. There are no known workarounds beyond updating the library.

Potential IOCs

  • Malformed or oversized input in application logs
  • Validation error spikes in application metrics

Remediation

CVE-2026-46493 | CVSS 7.5 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-46493
Weakness: CWE-338

Situation

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use uniqid for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-9290 | CVSS 7.5 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9290
Weakness: CWE-22

Situation

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Potential IOCs

  • Directory traversal sequences (../) in request paths
  • Access to files outside expected document root in logs

Remediation

CVE-2026-45300 | CVSS 7.4 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45300
Weakness: CWE-200

Situation

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak Cookie headers to cross-origin redirect targets. When following a redirect to a different origin, the propagatedHeaders() method in Redirect30xInterceptor.java strips Authorization and Proxy-Authorization headers but does not strip the Cookie header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-11334 | CVSS 7.3 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11334
Weakness: CWE-74, CWE-89

Situation

A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This affects an unknown function of the file dashboard_page/forms/fetch.php. Performing a manipulation of the argument department_code results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Potential IOCs

  • SQL syntax strings in HTTP parameters or logs
  • Excessive database error responses (500s)
  • Unusual database query volumes or timings

Remediation

CVE-2026-11342 | CVSS 7.3 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11342
Weakness: CWE-74, CWE-89

Situation

A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manipulation of the argument room leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Potential IOCs

  • SQL syntax strings in HTTP parameters or logs
  • Excessive database error responses (500s)
  • Unusual database query volumes or timings

Remediation

CVE-2026-11344 | CVSS 7.3 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11344
Weakness: CWE-284, CWE-434

Situation

A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the component New Driver Registration Form. Performing a manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used.

Potential IOCs

  • Unexpected file types uploaded to the server
  • New executable files in upload directories
  • Unexpected outbound connections from upload directories

Remediation

CVE-2026-50231 | CVSS 7.2 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50231
Weakness: CWE-79

Situation

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that get logged such as URLs, User-Agent headers, stream titles, or player names to execute arbitrary scripts in users' browsers.

Potential IOCs

  • Script tags or encoded JS in user-supplied input
  • Unexpected outbound requests from client browsers
  • CSP violation reports

Remediation

CVE-2026-50232 | CVSS 7.2 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50232
Weakness: CWE-79

Situation

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure.

Potential IOCs

  • Script tags or encoded JS in user-supplied input
  • Unexpected outbound requests from client browsers
  • CSP violation reports

Remediation

CVE-2026-8438 | CVSS 7.2 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8438
Weakness: CWE-79

Situation

The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator's browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page, enabling nonce theft, privileged AJAX/REST actions, and potential full site compromise.

Potential IOCs

  • Script tags or encoded JS in user-supplied input
  • Unexpected outbound requests from client browsers
  • CSP violation reports

Remediation

CVE-2026-8901 | CVSS 7.2 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8901
Weakness: CWE-79

Situation

The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Submission Data in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes when a CRM API call fails for the submitted form and an administrator subsequently views the error log details modal in the WordPress admin panel.

Potential IOCs

  • Script tags or encoded JS in user-supplied input
  • Unexpected outbound requests from client browsers
  • CSP violation reports

Remediation

CVE-2026-7537 | CVSS 7.2 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-7537
Weakness: CWE-434

Situation

The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.

Potential IOCs

  • Unexpected file types uploaded to the server
  • New executable files in upload directories
  • Unexpected outbound connections from upload directories

Remediation

CVE-2026-9851 | CVSS 7.2 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9851
Weakness: CWE-639

Situation

The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-11422 | CVSS 7.1 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-11422
Weakness: CWE-95

Situation

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension's message passing and invoke arbitrary file writes on the local filesystem.

Potential IOCs

  • Unexpected outbound network connections from the affected service
  • Unusual process creation or privilege escalation events
  • New or modified files in application directories
  • Spike in error rates or application crashes around the affected component

Remediation

CVE-2026-50265 | CVSS 7.0 🟠 HIGH

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-50265
Weakness: CWE-78

Situation

A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVE_CMD properties that are executed when a device is removed. This vulnerability allows an attacker to gain elevated privileges on the system.

Potential IOCs

  • Unexpected child processes spawned by the web/app server
  • Unusual system command executions in OS audit logs
  • New cron jobs or scheduled tasks

Remediation

Generated by daily-cves · Source: NVD

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions