Vulnerability Intelligence Report — June 8, 2026
Vulnerability Intelligence Report — June 8, 2026 Coverage: June 7–8, 2026 | New CISA KEV additions: 0 | New items: 1 | KEV deadline tomorrow … Read More
MDJM Event Management Arbitrary File Upload (CVE-2026-7537): Unrestricted File Upload Enables Server Compromise
An arbitrary file upload vulnerability in the MDJM Event Management WordPress plugin, tracked as CVE-2026-7537 (CVSS 7.2), allows authenticated attackers with administrator access to upload … Read More
Booking Package WordPress Plugin Privilege Escalation (CVE-2026-9851): Account Takeover via Missing Capability Check
A privilege escalation vulnerability in the Booking Package WordPress plugin, tracked as CVE-2026-9851 (CVSS 7.2), allows attackers to take over user accounts — including administrator … Read More
WP User Manager Local File Inclusion (CVE-2026-9290): Unauthenticated PHP File Execution via Profile Template Scope
A local file inclusion vulnerability in the WP User Manager WordPress plugin, tracked as CVE-2026-9290 (CVSS 7.5), allows unauthenticated attackers to include and execute arbitrary … Read More
Everest Forms Pro Remote Code Execution (CVE-2026-3300): Actively Exploited eval() Injection via Complex Calculation Feature
A critical remote code execution vulnerability in the Everest Forms Pro WordPress plugin, tracked as CVE-2026-3300, allows unauthenticated attackers to execute arbitrary PHP code on … Read More
Vulnerability Intelligence Report — June 7, 2026
Vulnerability Intelligence Report — June 7, 2026 Coverage: June 6–7, 2026 | New items: 4 | KEV deadlines June 9 (OpenSSL): 1 | KEV deadlines … Read More
Hippoo Mobile App for WooCommerce Authentication Bypass (CVE-2026-10580): Unauthenticated Administrator Account Takeover
An authentication bypass vulnerability in the Hippoo Mobile App for WooCommerce WordPress plugin, tracked as CVE-2026-10580 (CVSS 9.8), allows unauthenticated attackers to gain administrator-level access … Read More
Ansible Galaxy Role Install Remote Code Execution (CVE-2026-11332): Malicious requirements.yml Enables Git Config Injection
An argument injection vulnerability in ansible-core’s ansible-galaxy role install command, tracked as CVE-2026-11332 (CVSS 7.8), allows a malicious Ansible role to execute arbitrary code on … Read More
X.Org X Server and Xwayland Privilege Escalation Vulnerabilities (CVE-2026-50256 through CVE-2026-50264): Root Access via Display Server Exploits
Six privilege escalation vulnerabilities have been disclosed in the X.Org X server and Xwayland, the display server infrastructure present on virtually every Linux and Unix … Read More
Hugging Face Transformers Remote Code Execution (CVE-2026-4372): Malicious Model Config Enables Arbitrary Code Execution
A critical remote code execution vulnerability in the Hugging Face Transformers library, tracked as CVE-2026-4372, allows an attacker to execute arbitrary code by crafting a … Read More