CVE Vulnerabilities - 6 July 2026

A critical security issue in 9Router's API allows anyone to access sensitive data, including API keys and user conversations. This means that unauthorized users can view and potentially misuse your AP...

An outdated version of 9Router's API is vulnerable to unauthorized access to sensitive data, including API keys and user conversations. This could allow attackers to steal sensitive information and co...

The Crawl4AI web crawler, used for scraping and crawling, had a security issue prior to version 0.9.0. An attacker could exploit this issue to run malicious code on the system, potentially leading to ...

Traefik, a web server helper, had a security weakness that allowed hackers to fake identity information. This could happen if a hacker reached a protected part of a website. The good news is that this...

ColdFusion versions 2025.9 and earlier are affected by a security issue that could allow an attacker to execute code with the privileges of the current user. This means an attacker could potentially a...

Coolify, a server management tool, had a security flaw that allowed users with permission to manage applications to access the server remotely and steal sensitive information. This issue has been fixe...

An attacker with a Plesk account can write files with root access, potentially leading to server compromise. This is a serious issue, as it allows unauthorized access to sensitive server settings. To ...

A security weakness in BeyondTrust Remote Support and Privileged Remote Access could allow authorized users to access data they shouldn't see. This is a concern because it could compromise sensitive i...

The Apache HTTP Server has a hidden login backdoor that allows anyone to gain admin access by entering the correct password. This backdoor is not protected by a username, so any username can be used. ...

ArcGIS Server has a security weakness that lets attackers upload files without permission. This could allow them to do harm to your system. To protect yourself, make sure you keep ArcGIS Server up to ...

An attacker can bypass security checks and gain access to BeyondTrust Remote Support, including accounts with high-level permissions, if a specific configuration is set up. This could lead to unauthor...

An unauthenticated attacker can execute server-side code by visiting a public form with a hidden field that uses a dynamic default value. This could lead to sensitive information disclosure, applicati...

The Apache Camel AWS SNS component has fixed a security weakness that allowed malicious data to be injected into its system. This was not possible in this specific component because it does not receiv...

In the default configuration of Apache Camel Keycloak, access tokens are not verified, allowing any non-null value in the Authorization: Bearer header to pass. This means that even an invalid or forge...

Apache Camel's MongoDB component allows unauthenticated HTTP clients to switch MongoDB operations, including deleting files, without a password. This means that anyone can access and delete files stor...

Apache Camel's SQS component allows malicious users to inject custom headers into messages. This could be exploited by attackers to manipulate the behavior of downstream systems, potentially leading t...

Apache Camel's Keycloak component fails to verify access token expiration dates, allowing expired tokens to be accepted. This issue affects Apache Camel versions 4.18.0 to 4.18.3 and 4.19.0 to 4.21.0....

Apache Camel's CometD component doesn't check incoming messages for security. This allows unauthenticated clients to inject custom headers that can affect how the system behaves, potentially causing i...

Apache Camel's key manager can execute malicious code when it reads key metadata from AWS Secrets Manager. This happens if an attacker has write access to the AWS Secrets Manager secret that holds the...

Apache IoTDB allows an attacker to write files on the system if the internal RPC port is exposed to an untrusted network. This could lead to unauthorized data changes or system compromise. To fix this...

The PROG MIS ERP App stores its login credentials directly in the code, which can be accessed by unauthorized users. This allows them to log in to the app and potentially view sensitive data. To prote...

The Prog Management System allows unauthorized access to sensitive database information, including login credentials. This puts the system and its data at risk of unauthorized access and potential mis...

The Crawl4AI web crawler and scraper saves downloaded files using user-controlled names, potentially allowing attackers to write files anywhere on the system. This could lead to remote code execution ...

Adobe Commerce does not properly check user access to company data, which means an authenticated user could see or change sensitive information from other companies hosted on the same website. This co...

FOSSBilling's payment system has a weakness that allows an attacker to trick the system into paying invoices without actually paying. This can happen if the Custom payment adapter is enabled and an at...