CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- themerex luxmed | medicine & healthcare doctor wordpress themeWordPress LuxMed | Medicine & Healthcare Doctor WordPress Theme theme <= 1.2.2 - Local File Inclusion vulnerability8.1 High
- themerex reisenWordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability9.8 Critical
- themerex imbaWordPress Imba theme <= 1.5.0 - Local File Inclusion vulnerability8.1 High
- themegoods avanteWordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- advanced ads gmbh ads – trackingWordPress Advanced Ads – Tracking plugin < 3.0.7 - SQL Injection vulnerability9.3 Critical
- mojoomla school managementWordPress School Management plugin <= 93.1.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- themefusion fusion builderWordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability7.7 High
- hcl software zie, hcltech zie for web +1 moreHCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,4.3 Medium
- simplcommerceStored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface6.2 Medium
- hcl icontrolHCL iControl was affected by Inadequate Session Timeout vulnerability3.1 Low
- rara themes metro magazineWordPress Metro Magazine theme <= 1.3.7 - Broken Access Control on Notice Dismissal vulnerability4.3 Medium
- ali2woo alinextWordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control vulnerability6.5 Medium
- marketing fire widget optionsWordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure Vulnerability6.5 Medium
- andy moyle emergency password resetWordPress Emergency Password Reset plugin <= 8.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- avirtum ipages flipbookWordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerability5.3 Medium
- prince integrate google driveWordPress Integrate Google Drive plugin <= 1.3.8 - Broken Access Control vulnerability8.3 High
- chatbot for wordpress - wpbot conversational forms for chatbotWordPress ChatBot Conversational Forms plugin <= 1.1.8 - Arbitrary File Download vulnerability7.5 High
- quanos solutions gmbh schema st4Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEM8.4 High
- shareaholicWordPress Shareaholic plugin <= 9.7.11 - Broken Access Control vulnerability4.3 Medium
- quanos solutions gmbh schema st4Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalation8.4 High
- themify foloWordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- inisev social media & share iconsWordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.6 - Broken Access Control vulnerability4.3 Medium
- jegstudio startupzyWordPress Startupzy theme <= 1.1.1 - Broken Access Control vulnerability4.3 Medium
- one identity password manager, password manager manager +1 moreOpen redirection vulnerability in Password Manager5.1 Medium
- one identity password manager, password manager manager +1 moreOpen redirection vulnerability in Password Manager5.1 Medium
- one identity password manager, password manager manager +1 moreImproper neutralization of HTTP headers in Password Manager5.1 Medium
- mitsubishi electric corporation adapters for airflow ventilation systems, heat pump chilled/hot water systems, and ventilation/air-conditioning system air resorts (for japan) hm-01a-ex, adapters for airflow ventilation systems, heat pump chilled/hot water systems, and ventilation/air-conditioning system air resorts (for japan) p-01hma, adapters for airflow ventilation systems, heat pump chilled/hot water systems, and ventilation/air-conditioning system air resorts (for japan) p-hm02wa +2,477 more +2,479 moreInformation Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances7.2 High
- extend themes skyline wpWordPress Skyline WP theme <= 1.0.10 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- containerdcontainerd image-triggered runtime DoS via unbounded group parsing5.3 Medium
- vllm-project vllm, red hat ai inference server, enterprise linux ai (rhel ai) 3 +1 more +3 moreVllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations4.8 Medium
- containerdcontainerd CRI checkpoint restore CDI annotation smuggling8.4 High
- containerdcontainerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore8.2 High
- tips and tricks hq wp ememberWordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability9.3 Critical
- themegrill registration form for woocommerceWordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability9.8 Critical
- melapress wp activity logWordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability9.8 Critical
- sbouey falang multilanguageWordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability8.8 High
- melhorenvio melhor envioWordPress Melhor Envio plugin <= 2.16.3 - Broken Authentication vulnerability7.6 High
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability9.8 Critical
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.9.3 - Broken Authentication vulnerability7.5 High
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability6.8 Medium
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- ays pro popup boxWordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability9.3 Critical
- eyecix jobsearchWordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability9.3 Critical
- themeco cornerstoneWordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerability8.5 High
- alberto hornero clean loginWordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerability8.2 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability9.8 Critical
- bdthemes sigmaforms pro – ai generated formsWordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability9.0 Critical
- Show moreLoading…