CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- ihor-sokoliuk mcp-searxngmcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`7.5 High
- jovancoding network-aiEnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data6.1 Medium
- jovancoding network-aiNetwork-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups5.5 Medium
- jovancoding network-aiNetwork-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions5.9 Medium
- jovancoding network-aiNetwork-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory6.5 Medium
- jovancoding network-aiNetwork-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning7.1 High
- bitbonsai mcpvaultMCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested6.9 Medium
@sveltia/cmsnpmSveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe1.1 Low- symfony uxSymfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest7.8 High
- symfony uxSymfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses6.1 Medium
- authzed spicedbSpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected3.7 Low
- openbaoOpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types6.5 Medium
- openbaoOpenBao's System Backend allows Unauthorized Management of the containing Namespace2.3 Low
- openbaoOpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-458082.1 Low
- openbaoOpenBao: LDAPi ldaputil (wrong escape func)6.8 Medium
- starcitizenwiki mediawiki-extensions-embedvideoEmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled7.5 High
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC8.7 High
- cap-go capgoCap-go - Account Lockout via 2FA Misconfiguration on Unverified Email9.3 Critical
- cap-go capgoCap-go - Authentication Logic Flaw in Enforce Password Policy6.9 Medium
- cap-go capgoCapgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access7.1 High
- cap-go capgoCap-go - OTP Bypass via Response Manipulation in Email Verification9.3 Critical
- outerbase studioOuterbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure4.4 Medium
- langflowLangflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit9.6 Critical
- langflowLangflow: Unauthenticated DoS through multipart form boundary file upload7.5 High
- langflowLangflow: Logout button does not clear session6.1 Medium
- langflowLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow8.4 High
- miurahr py7zrpy7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()8.7 High
- miurahr py7zrpy7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size8.7 High
- axllent mailpitMailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)5.8 Medium
- miniflux v2Miniflux 2: Open Redirect Bypass5.1 Medium
- http4khttp4k before 6.48.0.0 Digest Authentication Replay Protection Bypass8.2 High
- http4khttp4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage8.3 High
org.http4k:http4k-coreMavenhttp4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`8.2 High- http4khttp4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy6.3 Medium
- traefikTraefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails5.9 Medium
- allure-framework allure2, io.qameta.allure allure-generator +1 moreAllure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering6.1 Medium
- allure-framework allure2Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read6.2 Medium
vcrpyPyPIVCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files7.8 High- dbt-labs dbt-mcpdbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens6.8 Medium
ultimate-sitemap-parserPyPIUltimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser7.5 Highultimate-sitemap-parserPyPIUltimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit7.5 High- qbee-io transportqbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)6.0 Medium
- tinacms @tinacms/app, tinacms +1 moreTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover7.6 High
- craftcms commerceCraft Commerce: Coupon Code Brute-Force via Rate Limit Bypass6.9 Medium
craftcms/commercePackagistCraft Commerce: Partial Payment Amount Without Lower Bound Validation6.9 Medium- craftcms cmsCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs6.9 Medium
- tinacms@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels7.8 High
- starcitizenwiki mediawiki-extensions-embedvideoEmbedVideo Extension : Stored XSS via unsanitized class passed to template8.6 High
- starcitizenwiki mediawiki-extensions-embedvideoEmbedVideo Extension: Stored XSS via unsanitized service name in exception text7.5 High
github.com/crossplane/crossplaneGo,github.com/crossplane/crossplane/v2Go +1 moreCrossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag9.0 Critical- Show moreLoading…