Ivanti MobileIron Sentry is a gateway solution that provides secure access to enterprise email, web resources, and other mobile applications. It enables mobile app management, mobile device management, and mobile content management for mobile devices. Sentry ensures corporate data is protected while allowing employees to use their preferred mobile devices securely.

Ivanti MobileIron Sentry

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access

CVE-2026-10523

Linux

Linux Kernel

Windows

Windows Cumulative Update

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

CVE-2026-10520

SAP NetWeaver Application Server Java is a component of the SAP NetWeaver platform that provides a runtime environment for Java-based applications and services in the SAP system landscape. It is specifically designed to host and execute applications developed using the Java programming language.

SAP NetWeaver Application Server Java

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

CVE-2026-40128

Envoy is an L7 proxy and communication bus designed for large modern service-oriented architectures.

Envoy

A vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service.

CVE-2026-47774

Solr is an enterprise-search platform. Its major features include full-text search, hit highlighting, faceted search, real-time indexing, dynamic clustering, database integration, NoSQL features, and rich document handling.

Apache Solr

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Linux Ubuntu

Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. 

As an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords.
The future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.

Not affected:
  *  Clusters where bin/solr auth enable was not used to bootstrap BasicAuth
  *  Clusters where template users have been assigned strong passwords after bootstrap

CVE-2026-44825

Homebrew

NixOS

Ubuntu

Ubuntu Security Tracker

MariaDB is a relational database based on MySQL and is developed by the original MySQL developers.

MariaDB Client

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Linux openSUSE

Echo is a secure, minimal Linux OS built vulnerability-free. It is fully compatible across environments and continuously patched - making it a clean, dependable base layer for modern applications. Echo is used by organizations focused on security and reliability, including those with compliance or FIPS requirements.

Echo

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.

CVE-2026-49261

Debian

Debian Security Tracker

Python is a high-level, general-purpose programming language. Its key feature is the high readability of the code. It supports multiple programming paradigms, including Object-Oriented Programming (OOP) and Functional Programming.

Python

aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. If an attacker can influence a challenge response, for example through a local network, DNS, or proxy compromise, challenge handling requests could be sent outside the intended Instagram host with the client's existing session headers. Version 0.9.10 validates challenge paths before building URLs, solving captcha challenges, or submitting phone/SMS challenge forms.

CVE-2026-47157

GitHub Advisory Database

PHP is a general-purpose scripting language that is especially suited for web development.

### Impact
The `ext_in` upload validation rule checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named `shell.php` containing GIF-like content could pass validation such as:
```
uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif]|ext_in[avatar,gif]
```
because the detected MIME type maps to `gif`, even though the uploaded filename extension is `php`.
Applications are impacted if they:
- accept user-controlled uploads,
- rely on `ext_in` to validate the uploaded filename extension,
- save uploaded files using the original client filename: `$file->move($path)`,
- store uploads in a web-accessible directory,
- and allow PHP or other executable files to run from that directory.
In those conditions, this may lead to arbitrary code execution. The default application does not expose such an upload endpoint.
### Patches
Upgrade to v4.7.3 or later.
### Workarounds
- Save uploads outside the public web root, preferably under `writable/uploads`
- Use `$file->store()` or `$file->move($path, $file->getRandomName())` instead of preserving the original filename
- Disable script execution in any public upload directory
- Manually verify the client filename extension before moving the file
- Reject files when `$file->getClientExtension()` is not in the allowed list or does not match `$file->guessExtension()`
### Resources
- [CodeIgniter4 uploaded files documentation](https://codeigniter.com/user_guide/libraries/uploaded_files.html#moving-files)
- [CodeIgniter4 file upload validation documentation](https://codeigniter.com/user_guide/libraries/validation.html#rules-for-file-uploads)
- [CWE-434: Unrestricted Upload of File with Dangerous Type](https://cwe.mitre.org/data/definitions/434.html)
- [OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html)

CVE-2026-48062

Composer

JavaScript is a high-level, interpreted programming language essential for creating interactive web applications, running directly in web browsers to enable dynamic content and user interface enhancements. It is integral to the web development stack, working seamlessly with HTML and CSS to build responsive and feature-rich websites.

JavaScript

Wolfi is a community Linux OS designed for the container and cloud-native era; it is a Linux distribution based on Alpine.

Wolfi

Chainguard is a Linux distribution based on Alpine. It's the commercial version of the Wolfi distro.

Chainguard

MinimOS is a minimalist operating system designed for simplicity and efficiency. It aims to provide only essential functionalities, making it lightweight and suitable for resource-constrained environments. MinimOS is often used in embedded systems or as a base for custom operating system development.

MinimOS

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

CVE-2026-44705

Minimus

OpenClaw (also known as Moltbot or Clawdbot) is a self-hosted personal AI assistant that integrates with various messaging platforms and mobile or desktop operating systems to provide voice and text interactions. The architecture separates the control plane from the assistant, allowing users to host the technology on their own devices while utilizing live canvas rendering.

OpenClaw (formerly Moltbot or Clawdbot)

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie. This vulnerability is fixed in 0.32.0 and 1.16.0.

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2026-10523	CRITICAL	9.9	Ivanti MobileIron Sentry	cpe:2.3:a:ivanti:mobileiron_sentry	No	Sì	Jun 09, 2026
CVE-2026-10520	CRITICAL	10	Ivanti MobileIron Sentry	cpe:2.3:a:ivanti:mobileiron_sentry	Sì	Sì	Jun 09, 2026
CVE-2026-40128	CRITICAL	9	SAP NetWeaver Application Server Java	cpe:2.3:a:sap:netweaver_application_server_java	No	Sì	Jun 09, 2026
CVE-2026-47774	HIGH	N/A	Envoy	cpe:2.3:a:envoyproxy:envoy	No	Sì	Jun 03, 2026
CVE-2026-44825	CRITICAL	9.8	Apache Solr	cpe:2.3:a:apache:solr	No	No	Jun 01, 2026

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2026-49261	CRITICAL	10	MariaDB Client	libmariadbd19	No	Sì	Jun 11, 2026
CVE-2026-47157	MEDIUM	6.5	Python	aiograpi	No	Sì	Jun 11, 2026
CVE-2026-48062	CRITICAL	9.8	PHP	codeigniter4/framework	No	Sì	Jun 11, 2026
CVE-2026-44705	HIGH	7.7	JavaScript	wazuh-dashboard	No	Sì	Jun 11, 2026
CVE-2026-44496	HIGH	7.5	JavaScript	openclaw	No	Sì	Jun 11, 2026

Database delle vulnerabilità Wiz

Esplora per tecnologia

Filtri popolari

Alto profilo

Più recenti

I numeri delle vulnerabilità

Il buono, il cattivo e il vulnerabile

Ulteriori risorse Wiz

PEACH

Pronti a vedere Wiz in azione?