40 vulnerabilities across 15 products scored HIGH or above on June 05, 2026.

  • HIGH: 40

[HIGH] altium/altium_enterprise_server

7 CVEs | CVSS 4.0: 10.0 | AAS 11.9

Altium Enterprise Server is affected by seven path traversal vulnerabilities in the Network Installation Service (maximum CVSS 10.0) that allow unauthenticated network attackers to write arbitrary files to any writable location and read server package archives. Organizations using Altium Enterprise Server should apply available patches immediately, as exploitation can result in arbitrary file writes to web-accessible directories, overwriting of application binaries or configuration files, and potential remote code execution. Consult the vendor security advisory at https://www.altium.com/platform/security-compliance/security-advisories for patch details and remediation guidance.

Vendor Advisory

[HIGH] npm/dbgate-serve

1 CVE | CVSS 3.1: 10.0 | AAS 10.4

The npm package dbgate-serve is affected by a critical remote code execution vulnerability (CVSS 10.0) in the JSON script runner where the functionName parameter is directly interpolated into dynamically generated JavaScript code without sanitization. An attacker can exploit the POST /runners/start endpoint to inject and execute arbitrary code in a Node.js child process running with application privileges. Organizations using dbgate-serve should apply available patches immediately and consult the vendor advisory at https://github.com/advisories/GHSA-8v3q-9vmx-36vc for deployment guidance.

Vendor Advisory

[HIGH] lms_community/lyrion_music_server

1 CVE | CVSS 4.0: 8.7 | AAS 10.3

Lyrion Music Server 9.2.0 contains a path traversal vulnerability (CVSS 8.7) that allows unauthenticated attackers to read arbitrary files by manipulating file path parameters in the web server context. Successful exploitation enables access to sensitive files and configuration data outside the intended directory structure, potentially exposing system credentials and other confidential information. Organizations using Lyrion Music Server should apply available patches immediately and review the vendor advisory at https://www.vulncheck.com/advisories/lyrion-music-server-path-traversal-file-read for mitigation steps.

Vendor Advisory

[HIGH] arista_networks/eos_/cloudvision_exchange(cvx)

1 CVE | CVSS 4.0: 8.7 | AAS 10.3

Arista Networks EOS and CloudVision Exchange (CVX) are affected by an authenticated Redis vulnerability (CVSS 8.7) that allows attackers with network access to the Redis service and knowledge of the Redis password to achieve full root access across the entire CVX cluster. The risk is heightened because Redis communication, including authentication, currently occurs in plaintext without TLS encryption. Organizations deploying CVX should apply vendor patches immediately, implement network access controls to restrict Redis connectivity, and consult https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126 for comprehensive mitigation guidance.

Vendor Advisory

[HIGH] joomlacontenteditor.net/joomla_content_editor_(jce)_extension_for_joomla

1 CVE | CVSS 4.0: 10.0 | AAS 9.9

The Joomla Content Editor (JCE) extension contains a critical remote code execution vulnerability (CVSS 10.0) that allows unauthenticated users to create editor profiles and upload arbitrary PHP code to the server. Attackers can exploit this to execute code with the privileges of the web server, potentially compromising the entire Joomla installation and underlying infrastructure. Joomla administrators should immediately disable the JCE extension or apply available patches and consult https://www.joomlacontenteditor.net/ for remediation guidance.

Vendor Advisory

[HIGH] defenseunicorns/uds-identity-config

1 CVE | CVSS 3.1: 10.0 | AAS 9.9

UDS Identity Config versions 0.11.0 through 0.26.0 contain a critical authentication bypass vulnerability (CVSS 10.0) in the Keycloak client authenticator where the submitted client_secret is overwritten with a mounted Kubernetes secret before validation. An attacker with network access to the Keycloak token endpoint and knowledge of a valid client_secret can bypass authentication and obtain unauthorized access tokens. Organizations using UDS Core with Identity deployment should immediately update to UDS Identity Config v0.26.1 or later and review https://github.com/defenseunicorns/uds-identity-config/releases/tag/v0.26.1 for remediation details.

Vendor Advisory

[HIGH] termix-ssh/termix

5 CVEs | CVSS 3.1: 9.9 | AAS 9.8

Termix prior to version 2.3.2 is affected by multiple security vulnerabilities (CVSS 9.9), including at least one critical OS command injection flaw in the /ssh/file_manager/ssh/resolvePath endpoint that allows authenticated users to execute arbitrary commands on connected remote servers. The vulnerability stems from insufficient shell command escaping where double-quote protection fails to prevent command substitution via $(…) and backtick operators. Organizations using Termix should update to version 2.3.2 or later immediately and consult https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag for patch availability and remediation guidance.

Vendor Advisory

[HIGH] npm/nocodb

2 CVEs | CVSS 3.1: 8.0 | AAS 9.7

NocoDB is affected by multiple vulnerabilities (CVSS 8.0), including at least one reflected cross-site scripting flaw in the shared form-view submit handler that allows users with editor role to inject javascript: URLs via the redirect_url parameter. When authenticated users submit a malicious form, the payload executes in the NocoDB origin and can exfiltrate session tokens from browser localStorage. Organizations deploying NocoDB should update to a patched version immediately and review https://github.com/advisories/GHSA-hj85-ph9q-78jg for complete remediation details.

Vendor Advisory

[HIGH] dts_electronics_industry_and_trade_ltd._co./redline_wr3200

1 CVE | CVSS 3.1: 9.8 | AAS 9.7

Redline WR3200 versions 7.1.3 through 7.1.7 contain critical authentication bypass vulnerabilities (CVSS 9.8) that allow unauthenticated attackers to access restricted functionality due to missing or weak authentication controls. The vulnerability enables unauthorized access to sensitive device configuration and administrative functions without valid credentials. Organizations using Redline WR3200 should update to version 7.1.8 or later immediately and review https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0321 for patch availability and remediation steps.

Vendor Advisory

[HIGH] npm/dbgate-api

2 CVEs | CVSS 3.1: 9.5 | AAS 9.4

The npm package dbgate-api contains multiple remote code execution vulnerabilities (CVSS 9.5), including at least one critical flaw where authenticated users can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The vulnerability bypasses mitigation attempts through dynamic import() functions, allowing root-level code execution. Organizations deploying dbgate-api should update to a patched version immediately and review https://github.com/advisories/GHSA-wm5r-5qp3-5vxf for patch availability and remediation guidance.

Vendor Advisory

[HIGH] npm/dbgate

1 CVE | CVSS 3.1: 9.5 | AAS 9.4

The npm package dbgate is vulnerable to arbitrary file write via path traversal (CVSS 9.5) in the unzipDirectory() function, where malicious ZIP archives containing ../ path entries can write files to any location on the filesystem. In default Docker deployments running as root with unauthenticated access enabled, this flaw is exploitable by any network-adjacent attacker who can trigger the ZIP extraction functionality. Organizations deploying dbgate should update to a patched version immediately, disable unauthenticated authentication, and review https://github.com/advisories/GHSA-h535-j5hr-mv56 for complete remediation guidance.

Vendor Advisory

[HIGH] haxtheweb/haxcms-nodejs

6 CVEs | CVSS 4.0: 9.4 | AAS 9.3

HAX CMS prior to version 26.0.0 contains multiple vulnerabilities (CVSS 9.4), including at least one critical authenticated file overwrite flaw that allows users with valid credentials to configure malicious Git filter commands and achieve arbitrary code execution on the server. Successful exploitation requires valid HAX CMS credentials but enables attackers to overwrite configuration files and execute code with the application’s privileges. Organizations using HAX CMS should update to version 26.0.0 or later immediately and review https://github.com/haxtheweb/issues/security/advisories/GHSA-q759-vxg8-vq5j for patch details and mitigation guidance.

Vendor Advisory

[HIGH] mcmilk/7-zip

1 CVE | CVSS 3.1: 8.8 | AAS 9.2

7-Zip version 26.00 and earlier contain a heap buffer overflow vulnerability (CVSS 8.8) in the NTFS compressed stream handler caused by under-allocation of the compression-unit buffer. Attackers can exploit this by crafting a malicious archive with specific compression parameters to trigger the overflow, potentially enabling arbitrary code execution or application crashes. Organizations and users should update 7-Zip to a patched version immediately and review https://securitylab.github.com/advisories/GHSL-2026-140_7-Zip/ for patch availability and remediation steps.

Vendor Advisory

[HIGH] red_hat/red_hat_enterprise_linux_10

7 CVEs | CVSS 3.1: 7.8 | AAS 9.2

Red Hat Enterprise Linux 10 is affected by multiple X.Org X server and Xwayland vulnerabilities (CVSS 7.8), including at least one critical stack-based buffer overflow in _XkbSetMapChecks() where clients can write to a fixed-size stack buffer at a controlled offset. Successful exploitation can crash the X server or enable privilege escalation on systems where the X server runs with root privileges. Organizations deploying RHEL 10 should apply security patches immediately and review https://access.redhat.com/security/cve/CVE-2026-50259 for patch availability and remediation steps.

Vendor Advisory

[HIGH] ubccr/xdmod

3 CVEs | CVSS 4.0: 9.3 | AAS 9.2

OpenXDMoD versions 9.5.0 through 11.0.2 are affected by multiple remote code execution vulnerabilities (CVSS 9.3), including at least one critical flaw allowing attackers to execute arbitrary system commands on the web server with the privileges of the web server process. Exploitation enables attackers to read and modify application data, alter system configuration, and disrupt service availability. Organizations deploying OpenXDMoD should update to version 11.0.3 or later immediately and review https://github.com/ubccr/xdmod/releases/tag/v11.0.3-2 for patch availability and remediation steps.

Vendor Advisory