Vulnerability Intelligence Report — June 9, 2026
Vulnerability Intelligence Report — June 9, 2026 Coverage: June 8–9, 2026 | New CISA KEV additions: 2 | New items: 2 | KEV deadlines today: … Read More
Comodo Internet Security Firewall Driver Integer Underflow (CVE-2026-49494): IPv6 Packet Parser Vulnerability in Kernel-Level Driver
An integer underflow vulnerability in Comodo Internet Security’s firewall driver Inspect.sys, tracked as CVE-2026-49494 (CVSS 7.5), allows crafted IPv6 packets to trigger unexpected behaviour in … Read More
Vulnerability Intelligence Report — June 8, 2026
Vulnerability Intelligence Report — June 8, 2026 Coverage: June 7–8, 2026 | New CISA KEV additions: 0 | New items: 1 | KEV deadline tomorrow … Read More
MDJM Event Management Arbitrary File Upload (CVE-2026-7537): Unrestricted File Upload Enables Server Compromise
An arbitrary file upload vulnerability in the MDJM Event Management WordPress plugin, tracked as CVE-2026-7537 (CVSS 7.2), allows authenticated attackers with administrator access to upload … Read More
Booking Package WordPress Plugin Privilege Escalation (CVE-2026-9851): Account Takeover via Missing Capability Check
A privilege escalation vulnerability in the Booking Package WordPress plugin, tracked as CVE-2026-9851 (CVSS 7.2), allows attackers to take over user accounts — including administrator … Read More
WP User Manager Local File Inclusion (CVE-2026-9290): Unauthenticated PHP File Execution via Profile Template Scope
A local file inclusion vulnerability in the WP User Manager WordPress plugin, tracked as CVE-2026-9290 (CVSS 7.5), allows unauthenticated attackers to include and execute arbitrary … Read More
Everest Forms Pro Remote Code Execution (CVE-2026-3300): Actively Exploited eval() Injection via Complex Calculation Feature
A critical remote code execution vulnerability in the Everest Forms Pro WordPress plugin, tracked as CVE-2026-3300, allows unauthenticated attackers to execute arbitrary PHP code on … Read More
Vulnerability Intelligence Report — June 7, 2026
Vulnerability Intelligence Report — June 7, 2026 Coverage: June 6–7, 2026 | New items: 4 | KEV deadlines June 9 (OpenSSL): 1 | KEV deadlines … Read More
Hippoo Mobile App for WooCommerce Authentication Bypass (CVE-2026-10580): Unauthenticated Administrator Account Takeover
An authentication bypass vulnerability in the Hippoo Mobile App for WooCommerce WordPress plugin, tracked as CVE-2026-10580 (CVSS 9.8), allows unauthenticated attackers to gain administrator-level access … Read More
Ansible Galaxy Role Install Remote Code Execution (CVE-2026-11332): Malicious requirements.yml Enables Git Config Injection
An argument injection vulnerability in ansible-core’s ansible-galaxy role install command, tracked as CVE-2026-11332 (CVSS 7.8), allows a malicious Ansible role to execute arbitrary code on … Read More