What needs attention now.

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

• Mozilla Firefox
• Mozilla Thunderbird
• Memory corruption

Sandbox escape due to use-after-free in the DOM: Core & HTML component

• Mozilla Firefox
• Mozilla Thunderbird
• Memory corruption

Sandbox escape in the Graphics component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-693

Sandbox escape due to use-after-free in the DOM: Content Processes component

• Mozilla Firefox
• Mozilla Thunderbird
• Memory corruption

Incorrect boundary conditions in the Graphics: WebGPU component

• Mozilla Thunderbird
• Mozilla Firefox
• Memory corruption

Sandbox escape due to use-after-free in the DOM: Content Processes component

• Mozilla Firefox
• Mozilla Thunderbird
• Memory corruption

Sandbox escape in the Security: Process Sandboxing component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-693

Sandbox escape in the DOM: Navigation component

• Mozilla Firefox
• Mozilla Thunderbird
• Broken access control

Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox

• psyb0t docker-mailbox
• Other injection

Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

• Shenzhen Dbit Network Equipment T-CPE301K 4G Mini WiFi Router
• Memory corruption

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

• MyPresta Google Merchant Center Feed
• Path traversal

Out-of-bounds write in Das U-Boot

• DENX Software Engineering Das U-Boot
• Memory corruption
• CWE-459

Path traversal in Hitachi Energy RTU500 series CMU firmware

• Hitachi Energy RTU500 series CMU firmware
• Path traversal

Missing authentication in Hitachi Energy RTU500 series CMU firmware

• Hitachi Energy RTU500 series CMU firmware
• Authentication bypass

Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type

• Flowring Technology Corp Agentflow 4.0
• Unrestricted file upload

Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create

• Apache Software Foundation Apache Karaf
• Broken access control

Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation

• Apache Software Foundation Apache Karaf
• Path traversal

Flowring Agentflow 4.0 - SQL Injection

• Flowring Technology Corp Agentflow 4.0
• SQL injection

Flowring Agentflow 4.0 - SQL Injection

• Flowring Technology Corp Agentflow 4.0
• SQL injection

Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x

• Dassault Systèmes GEOVIA Geospatial Data Manager
• Code injection

Netcore NAP930 Network Tools CGI network_tools eval os command injection

• Netcore NAP930
• Command injection

FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow

• FAST FAC1203R
• Memory corruption

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030.

• Memory corruption

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO branch, routers/mcp-pro…

• Code injection

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch.

• Broken access control

bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component.

• SQL injection

Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to a…

• Code injection

An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php

• Code injection

An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module.

• Code injection

mall4j through 4.0 Missing Authentication in Password Update Endpoint

• gz-yami mall4j
• Authentication bypass

Ziroom ZHOME A0101 set_passwd command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 set_online_client command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 set_online_client command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 firstSetup_wifi command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

• NginxProxyManager nginx-proxy-manager
• Authentication bypass

Ziroom ZHOME A0101 firstLogin command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection

• Ziroom ZHOME A0101
• Other injection
• Command injection

Out-of-bounds write in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Memory corruption

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

• ordasoft.com Book Library (Free) extension for Joomla
• SQL injection

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

• ordasoft.com Real Estate Manager (Free) extension for Joomla
• SQL injection

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

• ordasoft.com Vehicle Manager (Free) extension for Joomla
• SQL injection

Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

• dannymcc bluehood
• Authentication bypass
• Broken access control

WatchGuard AP Command Injection in Internal Management API Allows Command Execution

• WatchGuard AP
• Command injection
• Broken access control

WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

• WatchGuard AP
• Broken access control
• CWE-923

D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow

• D-Link DI-8400
• Memory corruption

Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher

• SUSE Rancher
• Cross-site scripting (XSS)

SailPoint IdentityIQ Improper Form Validation Vulnerability

• SailPoint Technologies IdentityIQ
• CWE-20

Netcore NR289-GE boa_temp process_request missing authentication

• Netcore NR289-GE
• Authentication bypass

Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection

• Netcore NR289-GE
• Command injection

Netcore NR289-GE Location Time location_time.cgi system os command injection

• Netcore NR289-GE
• Command injection

Netcore NR289-GE Authentication boa password-check stack-based overflow

• Netcore NR289-GE
• Memory corruption

Default Admin Credentials in Innotim Software's Logsign SIEM

• Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM
• CWE-1392

Netcore NR289-GE CGI ap_ip.cgi system os command injection

• Netcore NR289-GE
• Command injection

Arbitrary file write on LXD host via symlink in migration stream

• Canonical LXD
• Path traversal

Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

• Canonical LXD
• Path traversal

Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD

• Canonical LXD
• Path traversal

Path Traversal in Dayforce ESS Excelity

• Dayforce ESS Excelity
• Path traversal

Time-based SQL Injection in Dayforce ESS Excelity

• Dayforce ESS Excelity
• SQL injection

Deserialization of Untrusted Data in Application Integration allows Remote Code Execution

• Google Cloud Application Integration
• Insecure deserialization

FAST FAC1900R devdiscover Service copy_msg_element stack-based overflow

• FAST FAC1900R
• Memory corruption