{"kevs":[{"cve_id":"CVE-2026-39808","title":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through...","vendor":"Fortinet","product":"FortiSandbox, FortiSandbox PaaS","cvss_score":9.8,"cvss_severity":"CRITICAL","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.16682,"epss_percentile":0.95098,"used_in_malware":"unknown","added_date":"2026-06-12T13:59:12.791Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2020-6286","title":"The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30,...","vendor":"SAP SE","product":"SAP NetWeaver AS JAVA (LM Configuration Wizard)","cvss_score":5.3,"cvss_severity":"MEDIUM","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.85681,"epss_percentile":0.99396,"used_in_malware":"unknown","added_date":"2026-06-12T00:32:46.583Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2026-35273","title":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions...","vendor":"Oracle Corporation","product":"PeopleSoft Enterprise PeopleTools","cvss_score":9.8,"cvss_severity":"CRITICAL","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.00024,"epss_percentile":0.07252,"used_in_malware":"yes","added_date":"2026-06-11T20:20:23.651Z","ahead_of_cisa_kev":{"unit":"hour","count":4},"not_yet_in_cisa_kev":false},{"cve_id":"CVE-2026-10795","title":"UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc","vendor":"davidanderson","product":"UpdraftPlus: WP Backup & Migration Plugin","cvss_score":8.1,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":false},"epss_score":0.00035,"epss_percentile":0.10944,"used_in_malware":"unknown","added_date":"2026-06-11T07:20:32.076Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2025-5821","title":"Case Theme User <= 1.0.3 - Authentication Bypass via Social Login","vendor":"Case-Themes","product":"Case Theme User","cvss_score":9.8,"cvss_severity":"CRITICAL","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.00477,"epss_percentile":0.65456,"used_in_malware":"unknown","added_date":"2026-06-11T00:20:49.551Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2026-5027","title":"Langflow - Path Traversal Arbitrary File Write via upload_user_file","vendor":"langflow-ai","product":"langflow","cvss_score":8.8,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.04075,"epss_percentile":0.88844,"used_in_malware":"unknown","added_date":"2026-06-10T16:20:36.494Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2026-10520","title":"An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to...","vendor":"ivanti","product":"Sentry","cvss_score":10.0,"cvss_severity":"CRITICAL","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.4791,"epss_percentile":0.97796,"used_in_malware":"unknown","added_date":"2026-06-10T09:50:00.000Z","ahead_of_cisa_kev":{"unit":"day","count":1},"not_yet_in_cisa_kev":false},{"cve_id":"CVE-2026-11645","title":"Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox...","vendor":"Google","product":"Chrome","cvss_score":8.8,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":false,"low_complexity":true},"epss_score":0.05467,"epss_percentile":0.90435,"used_in_malware":"unknown","added_date":"2026-06-09T13:20:17.736Z","ahead_of_cisa_kev":{"unit":"hour","count":5},"not_yet_in_cisa_kev":false},{"cve_id":"CVE-2026-34910","title":"A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a...","vendor":"Ubiquiti Inc","product":"UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial","cvss_score":10.0,"cvss_severity":"CRITICAL","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.22828,"epss_percentile":0.96024,"used_in_malware":"unknown","added_date":"2026-06-09T08:18:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2026-34909","title":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the...","vendor":"Ubiquiti Inc","product":"UniFi OS Server, Express, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial","cvss_score":10.0,"cvss_severity":"CRITICAL","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.00026,"epss_percentile":0.07893,"used_in_malware":"unknown","added_date":"2026-06-09T07:29:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2026-34908","title":"A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized...","vendor":"Ubiquiti Inc","product":"UniFi OS Server, UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, UDR7, UDR-5G, Express 7, UNVR, UNVR-Pro, UNVR-Instant, UNVR-G2, UNVR-G2-Pro, ENVR, ENVR-Core, UNAS-2, UNAS-4, UNAS-Pro, UNAS-Pro-4, UNAS-Pro-8, UCKP, UCK, UCK-Enterprise, UCG-Ultra, UCG-Max, UCG-Fiber, UCG-Industrial","cvss_score":10.0,"cvss_severity":"CRITICAL","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.00022,"epss_percentile":0.06326,"used_in_malware":"unknown","added_date":"2026-06-09T07:27:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2026-42271","title":"LiteLLM: Authenticated command execution via MCP stdio test endpoints","vendor":"BerriAI","product":"litellm","cvss_score":8.7,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.60784,"epss_percentile":0.98334,"used_in_malware":"unknown","added_date":"2026-06-08T18:00:45.030Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":false},{"cve_id":"CVE-2026-50751","title":"User Authentication Bypass in VPN Remote Access and Mobile Access","vendor":"checkpoint","product":"Quantum Security Gateway, Spark Firewalls","cvss_score":9.3,"cvss_severity":"CRITICAL","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.11841,"epss_percentile":0.93905,"used_in_malware":"yes","added_date":"2026-06-08T14:20:34.968Z","ahead_of_cisa_kev":{"unit":"hour","count":6},"not_yet_in_cisa_kev":false},{"cve_id":"CVE-2021-33544","title":"UDP Technology/Geutebrück camera devices: command injection leading to RCE","vendor":"Geutebrück","product":"E2 Series, Encoder G-Code","cvss_score":7.2,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.94247,"epss_percentile":0.99933,"used_in_malware":"unknown","added_date":"2026-06-08T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2025-8085","title":"Ditty < 3.1.58 - Unauthenticated SSRF","vendor":"Unknown","product":"Ditty","cvss_score":8.6,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.10923,"epss_percentile":0.93586,"used_in_malware":"unknown","added_date":"2026-06-08T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2025-61666","title":"Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File","vendor":"traccar","product":"traccar","cvss_score":8.7,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.01364,"epss_percentile":0.80654,"used_in_malware":"unknown","added_date":"2026-06-08T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2017-10974","title":"Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of...","vendor":"Yaws","product":"Yaws","cvss_score":7.5,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.91277,"epss_percentile":0.99673,"used_in_malware":"unknown","added_date":"2026-06-07T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2021-24227","title":"Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure","vendor":"Unknown","product":"Patreon WordPress","cvss_score":7.5,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.38694,"epss_percentile":0.97359,"used_in_malware":"unknown","added_date":"2026-06-07T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2022-34121","title":"Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.","vendor":"Cuppa CMS","product":"Cuppa CMS","cvss_score":7.5,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.2541,"epss_percentile":0.96349,"used_in_malware":"unknown","added_date":"2026-06-07T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2021-3577","title":"An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker...","vendor":"Motorola","product":"Binatone Hubble Cameras","cvss_score":8.8,"cvss_severity":"HIGH","cvss_highlights":{"network":false,"no_user_interaction":true,"low_complexity":true},"epss_score":0.78899,"epss_percentile":0.99082,"used_in_malware":"unknown","added_date":"2026-06-07T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2024-39713","title":"A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.","vendor":"Rocket.Chat","product":"Rocket.Chat","cvss_score":8.6,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.90057,"epss_percentile":0.99603,"used_in_malware":"unknown","added_date":"2026-06-07T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2024-55457","title":"MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. An attacker can exploit this vulnerability by...","vendor":"MasterSAM","product":"Star Gate 11","cvss_score":6.5,"cvss_severity":"MEDIUM","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.75254,"epss_percentile":0.98906,"used_in_malware":"unknown","added_date":"2026-06-07T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2021-41569","title":"SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows...","vendor":"SAS Institute Inc.","product":"SAS/Intrnet","cvss_score":7.5,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.7377,"epss_percentile":0.98841,"used_in_malware":"unknown","added_date":"2026-06-07T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2021-27358","title":"The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API...","vendor":"Grafana Labs","product":"Grafana","cvss_score":7.5,"cvss_severity":"HIGH","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.92396,"epss_percentile":0.99745,"used_in_malware":"unknown","added_date":"2026-06-07T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true},{"cve_id":"CVE-2023-4490","title":"WP Job Portal < 2.0.6 - Unauthenticated SQLi","vendor":"Unknown","product":"WP Job Portal","cvss_score":9.8,"cvss_severity":"CRITICAL","cvss_highlights":{"network":true,"no_user_interaction":true,"low_complexity":true},"epss_score":0.51967,"epss_percentile":0.97977,"used_in_malware":"unknown","added_date":"2026-06-07T00:00:00.000Z","ahead_of_cisa_kev":null,"not_yet_in_cisa_kev":true}],"pagination":{"current_page":1,"total_pages":103,"total_count":2558,"per_page":25,"next_page":2,"prev_page":null,"first_page":1,"last_page":103}}