CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- jleehr canto-saas-apicanto-saas-api: Authenticated API requests can be redirected via unencoded path variables4.8 Medium
- linux, linux kernel +1 moreRDMA: During rereg_mr ensure that REREG_ACCESS is compatible7.8 High
- tilt-dev tiltTilt: Missing authentication on the network-exposed Tilt HUD server9.2 Critical
- tilt-dev tiltTilt: Cross-site WebSocket hijacking of the Tilt HUD stream8.3 High
- tilt-dev tiltTilt: Unauthenticated pprof debug endpoints on the Tilt HUD server8.3 High
- ni grpc-device, instrumentstudio, grpc device server +2 moreIncorrect Conversion between Numeric Types in NI grpc-device due to missing range checks in CodeGen6.3 Medium
- sima gmbh bondix serverAuthenticated OS Command Injection in Bondix8.6 High
- ni grpc-device, instrumentstudio, grpc device server +2 moreInsecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present9.3 Critical
- ni grpc-device, instrumentstudio, grpc device server +2 moreMemory leak in NI grpc-device BeginSidebandStream6.0 Medium
- jovancoding network-aiNetwork-AI has an an OS Command Injection issue9.9 Critical
- ni grpc-device, instrumentstudio, grpc device server +2 moreUnchecked enum cast vulnerability in NI grpc-device in BeginSidebandStream7.1 High
- ni grpc-device, instrumentstudio, grpc device server +2 moreNULL pointer dereference vulnerability in NI grpc-device data moniker service8.7 High
- apache apisixApache APISIX: Improper authentication in cas-auth plugin5.3 Medium
- apache apisixApache APISIX: cas-auth login CSRF / session injection issue2.1 Low
- apache apisixApache APISIX: Session replay issue in hmac-auth6.3 Medium
- apache apisixApache APISIX: Cas-auth Host header influence on CAS service URL2.1 Low
- ni grpc-device, instrumentstudio, grpc device server +2 moreOut-of-bounds read vulnerability in the NI grpc-device streaming API8.7 High
- flexera flexnet manager suiteFlexNet Manager Suite Attachment File Disclosure7.1 High
- apache apisixApache APISIX: Identity spoofing issue in APISIX opa plugin2.3 Low
- apache apisixApache APISIX: Authentication bypass in jwe-decrypt6.3 Medium
- apache apisixApache APISIX: Cas-auth plugin open redirect via unsanitized cookie value2.1 Low
- apache apisixApache APISIX: Openid-connect plugin Identity Header Spoofing5.3 Medium
- dtwang line-desktop-mcpStreamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication8.8 High
- apache apisixApache APISIX: authz-casdoor incorrect session sharing5.3 Medium
- apache apisixApache APISIX: wolf-rbac plugin Identity Spoofing2.3 Low
- apache apisixApache APISIX: JWT Algorithm Confusion allows authentication bypass7.0 High
- ni grpc-device, instrumentstudio, grpc device server +2 moreUntrusted pointer dereference in NI grpc-device sideband streaming API9.3 Critical
- apache apisixApache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup5.8 Medium
- flexera flexnet manager suiteFlexNet Manager Suite Privilege Escalation Vulnerability8.7 High
- suse rancherCommand injection through unsanitized YAML parameter in Rancher9.4 Critical
- jetbrains hubIn JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430,...10.0 Critical
- jetbrains hubIn JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430,...9.6 Critical
- jetbrains hubIn JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430,...9.8 Critical
- jetbrains golandIn JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project...7.1 High
- red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 moreFfmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()6.5 Medium
- microsoft .net, .net framework, .net 8.0 runtime +10 more +12 more.NET Framework Elevation of Privilege Vulnerability7.8 High
- microsoft .net, .net 8.0 runtime, .net 9.0 runtime +10 more +12 more.NET Remote Code Execution Vulnerability7.8 High
- microsoft .net, .net framework, .net 8.0 runtime +12 more +14 more.NET Framework Remote Code Execution Vulnerability7.8 High
- llvm llvm-projectllvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow4.8 Medium
- llvm llvm-projectllvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow4.8 Medium
- cloudflare quicheUse-after-free in connection ID iterator and FFI functions5.6 Medium
- imagination technologies graphics ddkGPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference7.7 High
- imagination technologies graphics ddkGPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries7.7 High
- octopus deploy serverIn affected versions of Octopus Server with certain access levels it was possible to embed a...5.6 Medium
- eclipse threadx netx duo, eclipse foundation threadx - netx duo +1 moreThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally call…7.5 High
- ail-project ail-frameworkAuthenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files5.3 Medium
- dell server hardware managerDell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control...7.8 High
- 2download connector for 2dl hosted checkout2Download Connector for 2DL Hosted Checkout <= 0.1.5 - Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload_email' Parameter5.3 Medium
- strablengineering strabl – a checkout solutionSTRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint5.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers6.5 Medium
- Show moreLoading…