CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- steeltoeoss steeltoe.configuration.abstractionsSteeltoe: TLS private keys written to /tmp with default permissions, never deleted4.7 Medium
- baptistearno typebot.ioTypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)7.1 High
- black lantern security bbotArbitrary File Write in postman_download module6.5 Medium
- steeltoeoss steeltoe.security.authentication.cloudfoundrybase, steeltoe.security.authentication.jwtbearer, steeltoe.security.authentication.openidconnect +2 moreSteeltoe's static JWKS cache shared across schemes and never invalidated5.9 Medium
- black lantern security bbotSymlink-following arbitrary write via github_workflows module2.2 Low
- black lantern security bbotSSRF via unvalidated WWW-Authenticate realm in docker_pull module3.1 Low
- steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointbase +1 moreSteeltoe's sensitive actuators (heapdump/env) only require Restricted permission6.5 Medium
- black lantern security bbotPath Traversal (Zip-Slip) in unarchive module5.3 Medium
- steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointcore +1 moreSteeltoe's env sanitizer misses connection strings — leaks embedded DB passwords7.5 High
- e107inc e107e107: Command Injection via shell expansion in ImageMagick resize destination path7.1 High
- marimo-team marimomarimo < 0.23.9 XSS via file Query Parameter in assets.py5.1 Medium
- xianyulauncherXianYuLauncher: Legacy Microsoft account OAuth sign-in flow lacks PKCE and state validation5.5 Medium
- cakephpCakePHP: View::element() is missing a path containment check6.3 Medium
- steeltoeoss steeltoe.discovery.eurekaSteeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch7.5 High
- authlib joserfcjoserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization5.3 Medium
- signalrgb kernel driverCVE-2026-80507.5 High
- signalrgb kernel driverCVE-2026-80495.3 Medium
- aws bedrock-agentcoreImproper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()8.4 High
- steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointcore +1 moreSteeltoe vulnerable to management-port isolation bypass via spoofed Host header8.2 High
- php-standard-library, php-standard-library php-standard-library/h2 +1 morePHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling7.5 High
- typemillTypemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()7.1 High
- shaarliShaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail Synchronizer5.8 Medium
- pimcore gmbh cms/dxpPimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed8.6 High
- shaarliShaarli has Stored Cross-Site Scripting (XSS) via Tags Search4.8 Medium
- f5 nginx gateway fabricNGINX Gateway Fabric vulnerability7.1 High
- f5 nginx gateway fabricNGINX Gateway Fabric vulnerability8.6 High
- shaarliShaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links5.8 Medium
- tinyproxyTinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers9.3 Critical
- tinyproxyTinyproxy - HTTP Request Smuggling via CL/TE Desynchronization9.3 Critical
- jovancoding network-aiNetwork-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)9.1 Critical
- tinyproxyTinyproxy - Stathost Detection Bypass via Host Header Manipulation8.8 High
- hackplayers evil-winrmEvil-WinRM - Path Traversal in download_dir() Function7.4 High
- libssh2libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c9.2 Critical
- sonatype nexus repository managerNexus Repository Manager - Incorrect Authorization allows credential disclosure via proxy repository configuration5.9 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Improper validation - SA-CORE-2026-0095.4 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-0083.1 Low
- drupal, drupal core +1 moreDrupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-0075.9 Medium
- drupal, drupal core +1 moreDrupal core - Moderately critical - Gadget chain - SA-CORE-2026-0065.9 Medium
- drupal, drupal core +1 moreDrupal core - Critical - PHP object injection - SA-CORE-2026-0055.9 Medium
- cakephp authentication, cakephp +1 moreCakePHP: Open redirect weakness via backslash bypass5.1 Medium
- avo-hq avoAvo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation9.6 Critical
- denoDeno: Denial of service via non-ASCII bytes in WebSocket response headers4.3 Medium
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory8.7 High
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS7.5 High
- libssh2libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler8.2 High
- devolutions unigetuiUse of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI...7.5 High
- langflowLangflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak9.3 Critical
- jknack handlebars.javahandlebars.java FileTemplateLoader Path Traversal7.5 High
- filamentphp filamentFilament: Disabled RichEditor field state can be used for XSS7.6 High
- drupal plotly.js graphingPlotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-0508.1 High
- Show moreLoading…