CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- faraday project faraday, red hat 3scale api management platform 2, satellite 6 +5 more +7 moreFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters7.5 High
- containerdcontainerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull9.4 Critical
- ohler55 ojOj: Stack Buffer Overflow in Oj.dump via Large Indent6.3 Medium
- containerdcontainerd: CRI checkpoint import allows local image tag poisoning5.6 Medium
- symfony uxSymfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data5.1 Medium
- symfony uxSymfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted2.1 Low
- symfony uxSymfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding6.9 Medium
- symfony uxSymfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil6.9 Medium
- symfony uxSymfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag2.3 Low
- symfony uxSymfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests5.3 Medium
- proxysqlProxySQL MCP run_sql_readonly executes side-effecting MySQL multi-statements despite read-only contract7.5 High
- ohler55 ojOj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle6.3 Medium
- proxysqlProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL10.0 Critical
- proxysqlProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling9.8 Critical
- symfony uxSymfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor6.9 Medium
- dbarzin mercatorMercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)5.3 Medium
- miurahr py7zrpy7zr: Arbitrary File Write Vulnerability8.0 High
- dbarzin mercatorMercator has a Personal Identifiable Information Leak from Query Executor feature7.1 High
typeormnpm,@rootio/typeormRoot +1 moreTypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)5.9 Medium- radvd-project radvdump, radvd.litech radvd +1 moreradvdump's Route Information Option Parser has a Stack Buffer Overflow7.7 High
- gohugo hugoHugo security.http.urls deny rules bypassed by alternate IPv4 encodings4.6 Medium
- lsegal yardYARD static cache reads raw traversal paths before router sanitization5.3 Medium
- sentriz gonicgonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host8.1 High
- sentriz gonicSubsonic API: any authenticated user can delete or read any other user's playlist (IDOR)7.1 High
- grafana tempo, enterprise traces (get) +1 moreTempo TraceQL query with exemplar hint could result in unbounded memory usage6.5 Medium
- red hat ansible automation platform 2Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential6.3 Medium
- wpgmaps wp go maps – google map, openstreetmap, leaflet mapWP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation5.3 Medium
- sentriz gonicPath traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist7.1 High
- microsoft kiota-typescript@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter5.5 Medium
- sunnyadn js-tomlCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals7.5 High
- statamic cmsStatamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources4.3 Medium
- doobidoo mcp-memory-servicemcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call8.1 High
- artio book it\!, joomla! com booking component +1 moreJoomla com_booking 2.4.9 Information Disclosure via Account Enumeration8.7 High
- joomboost joomprojectJoomla! Component JoomProject 1.1.3.2 Information Disclosure8.7 High
- alchemycms alchemy cmsAlchemy: Unauthenticated nested page API leaks restricted & unpublished content7.5 High
- gohugo hugoHugo symlink confinement bypass in os.ReadFile5.9 Medium
- gohugo hugoHugo default code block renderer XSS via unescaped code-fence language5.1 Medium
- joomboost joomcrmJoomla! Component JoomCRM 1.1.1 SQL Injection via deal_id7.1 High
- @openzeppelin wizard, wizard-cairo, wizard-stellar +2 more +4 moreOpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source3.3 Low
- joomtech easy shopJoomla! Component Easy Shop 1.2.3 Local File Inclusion6.9 Medium
- wdmtech vbizzJoomla! Component vBizz 1.0.7 SQL Injection7.1 High
- statamic cmsStatamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction7.4 High
- wdmtech vbizzJoomla! Component vBizz 1.0.7 Remote Code Execution8.7 High
- wdmtech vwishlistJoomla vWishlist 1.0.1 SQL Injection via vproductid Parameter7.1 High
- byrongamatos slopsmithSlopsmith has path traversal in archive extractors that allows arbitrary file write → potential RCE7.6 High
- wdmtech vaccountJoomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard8.8 High
- wdmtech vreviewJoomla vReview 1.9.11 SQL Injection via editReview8.8 High
- wdmtech vrestaurantJoomla vRestaurant 1.9.4 SQL Injection via menu-listing-layout8.8 High
- wdmtech vmapJoomla! Component VMap 1.9.6 SQL Injection via loadmarker8.8 High
- cmsjunkie j-businessdirectoryJoomla! Component J-BusinessDirectory 4.9.7 SQL Injection8.8 High
- Show moreLoading…