CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- progress chef chef360Hardcoded credentials in embedded content2.3 Low
- progress chef chef360Impact A security issue has been identified in Chef 360 that could allow unauthorized access to...8.6 High
- signalk signalk-serverSignal K Server: Server-Side Request Forgery via Remote Connection Endpoints5.8 Medium
- thorsten phpmyfaqphpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)6.5 Medium
web-token/jwt-libraryPackagistPHP JWT Library: RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle6.3 Mediumweb-token/jwt-bundlePackagist,web-token/jwt-experimentalPackagist,web-token/jwt-frameworkPackagist +1 more +3 morePHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks8.1 Highweb-token/jwt-frameworkPackagist,web-token/jwt-libraryPackagist +1 morePHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service8.7 Highweb-token/jwt-experimentalPackagist,web-token/jwt-libraryPackagist +1 morePHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption6.0 Medium- hashgraph guardianHashgraph Guardian Stored XSS via branding companyName field4.8 Medium
spomky-labs/otphpPackagistspomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError6.9 Medium- startreedata mcp-pinotmcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind10.0 Critical
- sztheory relyraRelyra SAML SignatureValue not cryptographically verified -> authentication bypass9.1 Critical
- conda-forge conda-smithyconda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository7.6 High
spomky-labs/otphpPackagistspomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation8.7 High- libssh2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c8.3 High
- deepstreamio deepstream.iodeepstream is vulnerable to prototype pollution9.9 Critical
- theonedev onedevOneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar8.3 High
- coturnCoturn: Stack buffer overflow in decode_oauth_token_gcm()8.1 High
- yandex punto switcherPunto Switcher 4.5.0.583 Unquoted Search Path via WinExec8.5 High
- coturnCoturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username5.4 Medium
- openbsd, netbsd src +1 moreOpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input6.9 Medium
- mcdope pam usbpam_usb: getenv() used in PAM context allows environment variable injection into local-check logic6.3 Medium
- mcdope pam usbpam_usb: TOCTOU race condition in pad directory creation allows symlink substitution5.8 Medium
- mcdope pam usbpam_usb: Missing O_EXCL on pad temp file creation allows concurrent update race5.8 Medium
- mcdope pam usbpam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c6.7 Medium
- hkuds nanobotnanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write8.7 High
- azeotech daqfactoryAccess of resource using incompatible type ('type confusion') in AzeoTech DAQFactory8.4 High
- cloud foundry foundation bpm-releasesetupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation...6.8 Medium
- nodejs node, node.js +1 moreA flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a...5.3 Medium
- nilfs-dev nilfs-utilsNILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size6.7 Medium
- hayajo mojolicious::sessions::storableMojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely5.3 Medium
- jtl software shopJTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer9.3 Critical
- mcdope pam usbpam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field5.5 Medium
- kidocode crawl4aiCrawl4AI unauthenticated SSRF in Docker streaming crawl endpoint8.6 High
- kidocode crawl4aiCrawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args10.0 Critical
- kidocode crawl4aiCrawl4AI arbitrary file write via download filename path traversal9.6 Critical
- budibaseBudibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL8.4 High
- antonio-castellon module-auth@acastellon/auth has an authentication bypass via spoofable headers in validateToken()8.7 High
- line corporation armeriaArmeria: External Control of File Name or Path in xDS SDS DataSource5.9 Medium
- labs64 netlicensing-mcpNetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction9.6 Critical
- agenticmail @agenticmail/claudecode, @agenticmail/codex, @agenticmail/core +1 more +3 moreAgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)8.2 High
- agenticmail @agenticmail/apiAgenticMail: Cross-agent task authorization bypass in AgenticMail API7.1 High
- mcdope pam usbpam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication4.7 Medium
- nl-portal nl-portal-backend-librariesNL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)6.5 Medium
- daytonaio daytonaDaytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape4.2 Medium
- mcdope pam usbpam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap4.7 Medium
- getgrav grav-plugin-apiStored XSS via missing XSS safety check in Admin2 Pages API partial validation5.1 Medium
- significant-gravitas autogptAutoGPT SignUp Page has DOM-Based XSS and Open Redirect8.8 High
- nodejs node, node.js +1 moreA flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()`...1.8 Low
- significant-gravitas autogptAutoGPT has a DoS vulnerability in MediaDurationBlock8.7 High
- Show moreLoading…