CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- cmsjunkie classifiedsmanagerJoomla J-ClassifiedsManager 3.0.5 SQL Injection8.8 High
- cmsjunkie multiplehotelreservationJoomla J-MultipleHotelReservation 6.0.7 SQL Injection8.8 High
- pontedilana php-weasyprintPhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option6.5 Medium
- cmsjunkie j-cruiseportalJoomla J-CruisePortal 6.0.4 SQL Injection via cruises7.1 High
- pontedilana php-weasyprintPhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)8.1 High
- cmsjunkie jhotelreservationJoomla JHotelReservation 6.0.7 SQL Injection via search-hotels8.8 High
- pontedilana php-weasyprintPhpWeasyPrint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)8.2 High
- jcart for opencart, soft-php jcart for opencart +1 moreJoomla! Component jCart for OpenCart 2.0 SQL Injection8.8 High
- joomlaboat extra searchJoomla! Component Extra Search 2.2.8 SQL Injection8.8 High
xwaylandopenSUSESecurity update for xwaylandNo scorexwaylandSUSESecurity update for xwaylandNo score- myportfolioJoomla Component Myportfolio 3.0.2 SQL Injection via pid Parameter8.8 High
- extensions joomla payageJoomla Payage 2.05 SQL Injection via aid Parameter8.8 High
- joomboost joomrecipeJoomla JoomRecipe 1.0.3 SQL Injection via category parameter8.8 High
- joomboost joomla joomrecipeJoomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_author8.8 High
- simbunch simgenealogyJoomla! Component SIMGenealogy 2.1.5 SQL Injection8.8 High
- nokogiriNokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`1.7 Low
- nokogiriNokogiri: Possible Use-After-Free in XInclude Processing2.2 Low
- nokogiriNokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime1.7 Low
- nokogiriNokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type1.7 Low
- nokogiriNokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`6.3 Medium
- nokogiriNokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes1.7 Low
- nokogiriNokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-262472.6 Low
- nokogiriNokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception1.7 Low
github.com/opentofu/opentofuGo,rootio-github.com/opentofu/opentofuRoot +1 moreOpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL7.5 High- adobe bridgeJoomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter8.8 High
- king-products lms king professional, learning management system king +1 moreJoomla LMS King Professional 3.2.4.0 SQL Injection via learningpath8.8 High
- red hat ai inference server, ai inference server 3.2, ai inference server 3.3 +11 more +13 moreLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames7.1 High
- red hat ai inference server, ai inference server 3.2, ai inference server 3.3 +11 more +13 moreLibaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id7.1 High
- red hat ai inference server, ai inference server 3.2, ai inference server 3.3 +11 more +13 moreLibaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack7.1 High
- red hat ai inference server, ai inference server 3.2, ai inference server 3.3 +23 more +25 moreLibaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode7.6 High
- joomalshowroom event registration pro calendarJoomla Event Registration Pro Calendar 4.1.3 SQL Injection8.8 High
- faboba ultimate property listingJoomla Ultimate Property Listing 1.0.2 SQL Injection via sf_selectuser_id8.8 High
- nordmograph streetguessr gameJoomla StreetGuessr Game 1.1.8 SQL Injection via catid8.8 High
- raindropsinfotech twitch tvJoomla! Component Twitch Tv 1.1 SQL Injection8.8 High
- terrywcarter kissgalleryJoomla! Component KissGallery 1.0.0 SQL Injection8.8 High
- zcontent zap calendar liteJoomla! Component Zap Calendar Lite 4.3.4 SQL Injection8.8 High
- joomla calendar plannerJoomla! Component Calendar Planner 1.0.1 SQL Injection8.8 High
- joomshaper sp movie databaseJoomla SP Movie Database 1.3 SQL Injection via searchword8.8 High
- pulseextensions flip wallJoomla! Component Flip Wall 8.0 SQL Injection7.1 High
- microchip gridtime 3000, gridtime 3000 firmware +1 moreAccess Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server4.6 Medium
- pulseextensions sponsor wallJoomla! Component Sponsor Wall 8.0 SQL Injection7.1 High
- focalpointx focalpoint, focalpoint pro / free +1 moreJoomla! FocalPoint Pro Free 1.2.3 SQL Injection via location8.8 High
- microchip gridtime 3000, gridtime 3000 firmware +1 moreCross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server5.3 Medium
- webkul ajax quizJoomla! Component Ajax Quiz 1.8 SQL Injection8.8 High
- microchip gridtime 3000, gridtime 3000 firmware +1 moreOpen Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time Server5.3 Medium
- weborange bargain product vm3Joomla! Component Bargain Product VM3 1.0 SQL Injection8.8 High
- weborange price alertJoomla! Component Price Alert 3.0.2 SQL Injection8.8 High
- joomlashack osdownloadsJoomla OSDownloads 1.7.4 SQL Injection via item view8.8 High
- microchip gridtime 3000, gridtime 3000 firmware +1 moreGridTime™ 3000 GNSS Time Server CSRF to XSS5.1 Medium
- Show moreLoading…