CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- jline, jline jline3 +1 moreJLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables7.5 High
- jline, jline jline3 +1 moreJLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry7.5 High
- tinacms @tinacms/mdx, tinacms +1 moreTinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes4.8 Medium
io.karatelabs:karate-coreMavenKarate Mock Server RCE via embedded expression evaluation of request-derived data8.2 High- buddhathemes hydroHydro: Insufficient session expiration when recreating sessions6.9 Medium
- chimurai http-proxy-middlewarehttp-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`7.5 High
- ncalcNCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation4.8 Medium
- piscinajs piscinapiscina: Prototype Pollution Gadget → RCE via inherited options.filename8.1 High
- docker mcp-gatewayMCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway8.7 High
- xdan joditJodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()6.3 Medium
- gotenbergGotenberg: SSRF via LibreOffice document processing7.5 High
- strimzi strimzi-kafka-operatorStrimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator5.4 Medium
- red hat streams for apache kafka 2, streams for apache kafka 3.2.1, strimzi strimzi-kafka-operator +2 moreStrimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`8.0 High
- zitadelZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components2.3 Low
- ubb systems ubb.threadsDenial of Service in UBB.threads7.1 High
- ubb systems ubb.threadsRemote Code Execution via arbitrary file read and write in UBB.threads8.6 High
- ubb systems ubb.threadsBlind SQL Injection in UBB.threads8.6 High
- ubb systems ubb.threadsReflected XSS in UBB.threads5.1 Medium
- ubb systems ubb.threadsCross-Site Request Forgery in UBB.threads8.6 High
- ubb systems ubb.threadsStored XSS in UBB.threads5.1 Medium
- sonos tracttract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load6.1 Medium
- bitnami bitnami/mariadb-galera, bitnami/mariadb-galera helm chart +1 moreDefault replication credential monitor:monitor created5.3 Medium
- bitnami bitnami/cassandraDefault superuser cassandra:cassandra left active when CASSANDRA_USER is customized9.8 Critical
- google mcp toolbox for databases, mcp toolbox for databases (googleapis/mcp-toolbox) +1 moreMCP Toolbox for Databases: authenticated authorization bypass8.6 High
- google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 moregoogleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)9.3 Critical
- google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 moregoogleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)9.3 Critical
- ffmpeg, red hat ai inference server, enterprise linux ai (rhel ai) 3 +2 more +4 moreHeap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder8.8 High
- anssi dfir-orcLocal privilege escalation in ANSSI’s DFIR-ORC7.3 High
- frappe lmsReflected XSS in LMS2.1 Low
- frappe lmsOS Command Injection in LMS8.6 High
- frappe lmsSQL Injection in LMS8.6 High
- bricksable for bricks builderWordPress Bricksable for Bricks Builder plugin <= 1.6.83 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- claudiopizzillo piaf-hmsPIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query9.3 Critical
- socket engine.io, socketio socket.io +1 moreSocket.IO: Engine.IO WebTransport SID DoS7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +1 more +3 more.NET Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +1 more +3 moreASP.NET Core Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +14 more +16 more.NET Spoofing Vulnerability6.5 Medium
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more.NET Denial of Service Vulnerability7.5 High
- microsoft .net, .net framework, .net 10.0 runtime +13 more +15 more.NET Framework Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more.NET Security Feature Bypass Vulnerability8.2 High
- microsoft .net, .net framework, .net 10.0 runtime +13 more +15 more.NET Framework Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more.NET Tampering Vulnerability7.0 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +14 more +16 more.NET Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more.NET Framework Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 moreASP.NET Core Elevation of Privilege Vulnerability8.8 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +13 more +15 more.NET Denial of Service Vulnerability7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 moreASP.NET Core Elevation of Privilege Vulnerability8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +11 more +13 moreDracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module7.5 High
- oceanwp ocean product sharingWordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- iba ibadatcoordinator, ibapda +1 moreDeserialization vulnerability in ibaPDA and ibaDatCoordinator9.3 Critical
- Show moreLoading…