CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and...6.9 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that...6.9 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.2 has an integer overflow in getAttributeId.6.9 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.2 has an integer overflow in addBinding.6.9 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.2 has an integer overflow in storeAtts.6.9 Medium
- phpmyfaqphpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()8.7 High
- craftcms cmsCraft CMS - Authenticated Path Traversal in assets/icon Extension Parameter7.1 High
- craftcms cmsCraft CMS - Missing Authorization in assets/preview-thumb Endpoint5.3 Medium
- craftcms cmsCraft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController8.6 High
- cap-go capgoCap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*6.9 Medium
- cap-go capgoCapgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint6.9 Medium
- cap-go capgoCapgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC8.7 High
- cap-go capgoCapgo - Privilege Escalation via Broken Row Level Security in org_users7.0 High
- cap-go capgoCapgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC8.7 High
- cap-go capgoCapgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage7.2 High
- cap-go capgoCapgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs7.1 High
lopdfcrates.iolopdf has a stack overflow via deeply nested PDF objects7.5 High- berriai litellmBerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization5.3 Medium
- berriai litellmBerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery5.3 Medium
- berriai litellmBerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization5.3 Medium
- berriai litellmBerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration5.3 Medium
- berriai litellmBerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication6.9 Medium
- ilias learning management systemILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection5.1 Medium
- zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity reference5.3 Medium
- zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserialization5.3 Medium
- ezbsystems ultraiso premium editionEzbsystems UltraISO Premium Edition Kernel Driver bootpt64.sys access control8.5 High
- im-magic partition resizerIM-Magic Partition Resizer Kernel Driver MDA_NTDRV.sys access control8.5 High
- linux, linux kernel +1 moreksmbd: scope conn->binding slowpath to bound sessions only8.8 High
- easeus partition masterEaseUS Partition Master Kernel Driver EUEDKEPM.sys access control8.5 High
- easeus partition masterEaseUS Partition Master Kernel Driver epmntdrv.sys access control8.5 High
- aomei backupperAOMEI Backupper Kernel Driver amwrtdrv.sys access control8.5 High
- aomei dynamic disk managerAOMEI Dynamic Disk Manager Kernel Driver ddmdrv.sys access control8.5 High
- aomei partition assistantAOMEI Partition Assistant Kernel Driver ampa10.sys access control8.5 High
- montodel house-rental-managementMontodel House-Rental-Management index.php houses sql injection5.3 Medium
- montodel house-rental-managementMontodel House-Rental-Management login.php sql injection6.9 Medium
- berriai litellmBerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery5.3 Medium
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreBerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication6.9 Medium
- berriai litellmBerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration5.3 Medium
- berriai litellmBerriAI litellm M2M JWT user_api_key_auth.py improper authorization2.3 Low
- berriai litellmBerriAI litellm Admin Key key_management_endpoints.py improper authorization5.3 Medium
- gnu savaneGNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.3.7 Low
- avideoAVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter6.1 Medium
- prefect, prefecthq prefecthq/prefect +1 moreGit Argument Injection in prefecthq/prefect9.9 Critical
- cap-go capgoCapgo - Open Redirect via confirmation_url Parameter5.1 Medium
- cap-go capgoCapgo - Open Redirect via Unvalidated Stripe Billing URLs4.8 Medium
- cap-go capgoCapgo - App Existence Oracle via GET /statistics/app/:app_id5.3 Medium
- cap-go capgoCap-go - Broken Cursor Pagination in /private/devices Endpoint5.3 Medium
- cap-go capgoCapgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys5.3 Medium
- cap-go capgoCapgo - Information Disclosure via Unauthenticated /replication Endpoint6.9 Medium
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions6.9 Medium
- Show moreLoading…