CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...7.1 High
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...5.7 Medium
helmSUSESecurity update for helmNo score- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Access Control...4.3 Medium
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) a Missing Authentication for Critical...8.8 High
- makeplane planePlane 1.3.1 - Stored XSS in intake issue description_html6.9 Medium
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication...8.1 High
- fgmacedo python statemachine, python-statemachine +1 morePython StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injection9.3 Critical
- openwebui open webui, open-webui +1 moreOpen WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration4.3 Medium
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication...7.4 High
- redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()5.4 Medium
- stylemixthemes motorsWordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability9.3 Critical
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) Version prior to 4.8, contain(s) an Inclusion of Functionality...7.5 High
- cartasi nexi xpay, nexi payments xpay +1 moreWordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability7.5 High
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) 4.6.0.1, contain(s) an Use of a Broken or Risky Cryptographic...4.8 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion6.4 Medium
- open-webui, openwebui open webui +1 moreOpen WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI7.6 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Forged model meta.knowledge allows cross-user file read and deletion7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS in Mermaid Markdown Preview8.7 High
- openstack horizonOpenStack Horizon RC file generation does not escape special characters in project names6.0 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Forged chat-file link allows cross-user file read and deletion8.3 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-user file disclosure via /api/chat/completions image_url field6.5 Medium
- dell powerflex managerDell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation...6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`8.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-origin postMessage confirmation bypass via action:submit7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Calendar event re-parenting allows writing events into another user's calendar4.3 Medium
- tinyhumansai openhumanOpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution9.4 Critical
- nocodbNocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint6.9 Medium
- nocodbNocoDB: Server-Side Request Forgery via Base Migration URL5.1 Medium
- nocodbNocoDB: Stored Cross-Site Scripting via Secure Attachment5.1 Medium
- nocodbNocoDB: Refresh Tokens Persist Through Password Recovery6.3 Medium
- nocodbNocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL5.1 Medium
- vllmvLLM: OOM Denial of Service via Audio Decompression Bomb6.5 Medium
- azuriom cmsBroken Access Control in Azuriom CMS Server Routes Allows Account Takeover8.6 High
- f5 nginx gateway fabricNGINX Gateway Fabric vulnerability8.6 High
- f5 nginx open source, nginx plus, dos +4 more +6 moreNGINX ngx_http_charset_module vulnerability6.3 Medium
- f5 nginx open source, nginx plus, dos +14 more +16 moreNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability9.2 Critical
- vllmvLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router5.3 Medium
- vllmvLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow5.3 Medium
- fduflyer droneaware-node-releasesDroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeover6.8 Medium
- vllmvLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels6.9 Medium
- traefikTraefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services6.0 Medium
- chromedevtools chrome-devtools-mcpchrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory6.1 Medium
- n8nn8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints5.3 Medium
- earendil-works piPi loads project-local extensions without approval4.4 Medium
- earendil-works piPi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts7.3 High
- earendil-works piPi: Race condition in auth.json writes could expose stored credentials2.2 Low
- flarum frameworkCRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay8.9 High
- villatheme gift4uWordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability9.3 Critical
- Show moreLoading…