CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-06-19 (9)

2026-06-19 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-06-19

9 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-49257 — 10.0 — mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authenticatio…
  • CVE-2026-47846 — 9.8 — Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRA_USER environment variable, the container initialization s…
  • CVE-2026-7515 — 9.8 — The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the doc_style parameter. This makes it possible for unauthenticated attackers to include and exe…
  • CVE-2026-12048 — 9.3 — Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist er…
  • CVE-2026-49871 — 9.3 — Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim…
  • CVE-2026-8713 — 9.1 — The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This make…
  • CVE-2026-39999 — 9.1 — Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of jwt-auth plugin. This issue affects Apache APISIX: from v2.2 t…
  • CVE-2026-44087 — 9.1 — Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface that allows the attacker to spoof identity headers allowing the a…
  • CVE-2026-49230 — 9.1 — Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass. This issue affects Apache APISIX: from 3.8.0 through…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.