Published threat advisories for June 9, 2026

A critical vulnerability allows an authenticated domain user to execute arbitrary code on the Backup Server, potentially impacting the confidentiality, integrity, and availability of backup data and services. This issue requires an authenticated domain user to exploit, and infrastructure or security teams are likely re

NVD modified: NVD date unavailable

Adobe Campaign Classic is affected by an incorrect authorization vulnerability enabling arbitrary code execution without user interaction. Attackers can exploit this over the network, potentially leading to a broad compromise of the user's context. This issue is critical as it bypasses security layers and can be trigge

NVD modified: NVD date unavailable

A Server-Side Request Forgery vulnerability in Adobe Campaign Classic could allow unauthorized code execution without user interaction, changing the scope of impact. This issue is reachable externally and could lead to arbitrary code execution. Security-aware leaders should assess their Adobe Campaign Classic instances

NVD modified: NVD date unavailable

Adobe ColdFusion has a Path Traversal vulnerability that could allow a security feature bypass. If reachable, an attacker could trick a user into opening a malicious file to access unauthorized files or directories, changing the scope of what they can reach. This is relevant due to ColdFusion's role as a web applicatio

NVD modified: NVD date unavailable

An Improper Input Validation vulnerability in Adobe ColdFusion allows for arbitrary code execution without user interaction if reachable. This could allow an attacker to run code on the server in the context of the current user.

NVD modified: NVD date unavailable

An Incorrect Authorization vulnerability in Adobe Cold Fusion could permit a high-privileged attacker to execute arbitrary code, potentially gaining elevated access or control over a user's account or session without requiring user interaction. This could lead to system compromise if the vulnerability is reachable.

NVD modified: NVD date unavailable

An Improper Input Validation vulnerability in Adobe ColdFusion allows unauthenticated attackers to execute arbitrary code on the server. This could lead to system compromise and unauthorized access to resources if the vulnerable application is reachable.

NVD modified: NVD date unavailable

An authentication bypass vulnerability in a social sign-in endpoint could allow unauthorized access via a forged token. This critical issue may lead to exposure of system data. Confirmation of the technology's use and exposure within the environment is necessary.

NVD modified: NVD date unavailable

A vulnerability in bookcars' `validateAccessToken` function allows attackers to bypass authentication by submitting a forged JWT token. This could lead to unauthorized access to application functions and potentially sensitive information. Determining if bookcars is used within the environment is the primary concern.

NVD modified: NVD date unavailable

A buffer overflow in the LZW Decode function of the AnimatedGIF software library can be exploited by a remote attacker providing a crafted GIF file. This vulnerability could lead to a denial of service, causing an application crash, or potentially allow for arbitrary code execution. The impact is significant if the aff

NVD modified: NVD date unavailable

A critical vulnerability exists in Shenzhen Kangda Xin Intelligent Network Technology Company routers due to hardcoded credentials and default Telnet access. This allows unauthenticated attackers to read/write memory, modify firmware, and inspect network activity, posing a significant security risk. The vulnerability i

NVD modified: NVD date unavailable

Adobe Experience Manager Forms is affected by a stored Cross-Site Scripting vulnerability that allows attackers to inject malicious scripts into form fields. If a victim views a page with a vulnerable field, these scripts could execute in their browser, potentially leading to unauthorized access or control over their a

NVD modified: NVD date unavailable

A heap overflow vulnerability exists in FreeSWITCH's mod_verto component, allowing unauthenticated network access to exploit an attacker-controlled memory corruption before authentication checks. This could lead to impacts on data integrity and service availability.

NVD modified: NVD date unavailable

A vulnerability in FreeSWITCH's Event Socket Layer could allow an unauthenticated attacker to crash services or corrupt memory by sending a malicious frame with a negative content length. This could impact the availability and integrity of telecom systems before authentication. Understanding FreeSWITCH deployments and

NVD modified: NVD date unavailable

An external control of file name or path vulnerability in Azure Stack Edge could allow an unauthorized attacker to execute code over a network. This issue could impact the confidentiality, integrity, and availability of affected systems. As Azure Stack Edge devices often operate at the network edge and interact with ex

NVD modified: NVD date unavailable

An integer overflow in Windows HTTP.sys, a critical network request handler, allows remote, unauthorized code execution. This vulnerability impacts a core service for internet traffic and could compromise system integrity and confidentiality.

NVD modified: NVD date unavailable

An improper input validation vulnerability in Visual Studio Code could allow an unauthorized attacker to elevate privileges over a network. While the application is typically used locally, its reachability and potential impact on system integrity and availability are key concerns. The primary need is to confirm if this

NVD modified: NVD date unavailable

A use-after-free vulnerability in the Windows Kernel allows an unauthorized attacker to execute code over a network. This critical flaw could lead to remote code execution, potentially impacting system integrity and availability. It is uncertain if the affected technology is present or reachable within our environment.

NVD modified: NVD date unavailable

A network tampering vulnerability in Windows DHCP Server could allow an unauthorized attacker to modify data without authentication. This could impact network stability and traffic redirection, necessitating confirmation of its presence and exposure within the environment.

NVD modified: NVD date unavailable

A vulnerability in OpenSSL related to PKCS#7 signature verification could allow a specially crafted message to trigger a use-after-free, potentially leading to process crashes, memory corruption, or remote code execution. This issue may affect applications processing PKCS#7 or S/MIME signed messages using OpenSSL's PKC

NVD modified: NVD date unavailable

A critical stack-based buffer overflow vulnerability in the Windows DHCP Client enables unauthorized network attackers to execute code. This could compromise affected systems, impacting data confidentiality, integrity, and availability. Understanding this threat is vital for assessing environmental risks.

NVD modified: NVD date unavailable

A critical command execution vulnerability exists in DedeCMS's file management functionality, potentially allowing unauthenticated network access to execute arbitrary commands on affected systems. This could lead to a complete system compromise, impacting data integrity and availability, making it crucial to identify a

NVD modified: NVD date unavailable

A vulnerability in cryptographic message processing may allow attackers to bypass integrity checks or gain key-equivalent functionality. This issue affects how authenticated enveloped data containers are validated, potentially enabling unauthorized access to encryption keys or modification of messages. The FIPS modules

NVD modified: NVD date unavailable

A critical vulnerability in Nuance PowerScribe allows unauthorized remote code execution over a network due to untrusted data deserialization. If reachable, this could compromise system integrity and data. Understanding if your organization uses this technology and its network exposure is crucial.

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in CBS Platform. Attackers can manipulate database commands, potentially leading to unauthorized access or data modification. This issue is particularly concerning as the platform is no longer supported by the vendor, implying a lack of security updates. The primary concern

NVD modified: NVD date unavailable

An authentication bypass vulnerability in Ivanti Sentry could allow an unauthenticated remote attacker to create arbitrary administrative accounts and gain full administrative access. This issue is relevant if Ivanti Sentry is used and accessible.

NVD modified: NVD date unavailable

An SQL injection vulnerability in Netcad E-İmar could allow attackers to manipulate database commands, potentially leading to unauthorized access or modification of data. This issue affects E-İmar software, and given its typical use in public-facing municipal applications, it is important to assess potential exposure a

NVD modified: NVD date unavailable

A vulnerability in the Linux kernel's RDMA subsystem could cause incorrect memory conversions when handling memory regions with non-standard page sizes. This could lead to system instability if reachable. The issue impacts the integrity of system memory mapping during RDMA operations.A vulnerability in the Linux kernel

NVD modified: NVD date unavailable

A PHP code injection vulnerability in a WordPress plugin allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API, potentially leading to unauthorized access or control of web environments.A PHP code injection vulnerability in the WordPress Insert P

NVD modified: NVD date unavailable

A Stored Cross-Site Scripting vulnerability exists in Vinna Process Monitor that allows an authenticated attacker to inject malicious JavaScript. This could potentially lead to the theft of administrative access tokens and session credentials. The relevance and exposure of this vulnerability within the environment need

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in the two-factor authentication code parameter, allowing unauthenticated attackers to execute arbitrary SQL queries. This could lead to database enumeration, unauthorized creation of privileged users, or data modification.

NVD modified: NVD date unavailable

Certain Arm processor designs have a vulnerability allowing unauthorized writes to resources owned by a higher exception level. This could lead to system integrity and confidentiality compromises if reached. It's important to identify if affected Arm technologies are deployed within your environment to understand poten

NVD modified: NVD date unavailable

A session fixation vulnerability exists in a Perl authentication plugin. Attackers could impersonate users by obtaining a session ID before authentication, as the plugin does not change the session ID after a user logs in. This impacts applications handling user sessions.

NVD modified: NVD date unavailable

A buffer overflow vulnerability exists in DBI for Perl, allowing attackers to trigger it by influencing error messages. This could lead to application instability or compromise. Technical readers should confirm relevance and exposure, while leaders should understand the potential impact on application integrity.

NVD modified: NVD date unavailable

A memory corruption flaw exists in Zephyr's HTTP server when handling WebSocket upgrades. A remote, unauthenticated attacker can exploit this by sending a crafted header, potentially causing a denial-of-service or enabling code execution. This is relevant when the WebSocket feature is enabled.

NVD modified: NVD date unavailable

Spring Framework message converters in untrusted JMS environments allow arbitrary class instantiation via deserialization, potentially leading to unauthorized actions. This critical vulnerability impacts widely used versions of the framework.

NVD modified: NVD date unavailable

An authenticated attacker with normal privileges in SAP NetWeaver Application Server ABAP and ABAP Platform can send modified signed XML documents to the verifier, potentially leading to unauthorized access to sensitive user data and system disruption. This vulnerability poses a high risk to confidentiality, integrity,

NVD modified: NVD date unavailable

An unauthenticated attacker can exploit a path traversal vulnerability in SAP NetWeaver Application Server Java's Web Container by crafting a malicious HTTP logon request that manipulates file inclusion parameters. This could allow them to view or modify sensitive information or render parts of the local system unavail

NVD modified: NVD date unavailable

A critical vulnerability in the SAP Kernel's RFC protocol validation allows unauthenticated attackers to corrupt memory via crafted requests, potentially impacting application confidentiality, integrity, and availability. The primary concern is determining the reachability and relevance of these SAP components within t

NVD modified: NVD date unavailable

A Google Chrome vulnerability allows a remote attacker to escape the browser's sandbox via a crafted HTML page. This could lead to unauthorized system access if a user visits a malicious website.

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome's navigation could permit attackers to escape the browser's sandbox via a malicious HTML page, potentially affecting data.

NVD modified: NVD date unavailable

An integer overflow in Google Chrome on Linux allows a remote attacker to potentially escape the browser's sandbox via a crafted HTML page, which could lead to broader system compromise. This vulnerability is reachable through user interaction with malicious websites.

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome on Mac could allow a remote attacker to escape the browser sandbox via a crafted HTML page, potentially leading to broader system access. The primary concern is to confirm if vulnerable Chrome versions are in use within the organization.

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome may allow a remote attacker to execute arbitrary code. Attackers could exploit this by tricking a user into visiting a crafted HTML page, potentially impacting the security of web interactions. Confirmation of affected Chrome installations is the primary action needed.

NVD modified: NVD date unavailable

A use-after-free vulnerability exists in Google Chrome's printing component, potentially allowing a remote attacker to escape the browser's sandbox through a crafted HTML page. This critical flaw requires user interaction to exploit, raising concerns about relevance and exposure.

NVD modified: NVD date unavailable

A use-after-free vulnerability in Google Chrome's Gamepad component allows a remote attacker to potentially escape the browser sandbox via a crafted HTML page. This impacts confidentiality, integrity, and availability by enabling unauthorized system access.

NVD modified: NVD date unavailable