CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- mispMISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints9.4 Critical
- mispMISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields9.4 Critical
- jasei net::statsite::clientNet::Statsite::Client versions through 1.1.0 for Perl allow metric injections9.1 Critical
- digiwin easyflow .netDigiwin｜EasyFlow .NET - Session Fixation7.7 High
- digiwin easyflow .netDigiwin｜EasyFlow .NET - Stored Cross-Site Scripting5.1 Medium
- pilz pasvisu, pmi v8xx +1 morePilz: XSS vulnerability in Pilz PASvisu and PMI v8xx7.8 High
- pilz pasvisu, pmi v8xx +1 moreXSS vulnerability in Pilz PASvisu and PMI v8xx8.1 High
- pretix venuelessOpen redirect5.1 Medium
- pretix venuelessXLSX formula injection in exports5.1 Medium
- safeline sl6/sl6+Authentication Bypass for SafeLine SL6 and SL6+8.7 High
- apache atlasApache Atlas: Stored XSS in Create Entity page5.4 Medium
- apache nifiApache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents7.5 High
- apache nifiApache NiFi: Incorrect Authorization for Configuration Verification Requests2.3 Low
- apache nifiApache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL5.2 Medium
- apache nifiApache NiFi: Missing Validation for Proxy Host Headers6.3 Medium
- apache doris mcp serverApache Doris MCP Server: SQL injection leading the authentication bypass8.1 High
- appsbd viteposVitepos < 3.4.2 - Outlet Manager+ Privilege Escalation8.8 High
- stylemixthemes motorsMotors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media5.3 Medium
- unknown transbank webpayTransbank Webpay < 1.14.0 - Unauthenticated Stored XSS7.1 High
- unknown ultimate-woocommerce-auction-proUltimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctions7.1 High
- unknown ultimate-woocommerce-auction-proUltimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_list6.1 Medium
- genetech products pie registerPie Register < 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable Token5.3 Medium
- papercut print deployInsecure Search Path Vulnerability in PaperCut Print Deploy Client for Windows7.3 High
- line corporation central dogmaCentral Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion6.9 Medium
- line corporation central dogmaCentral Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover9.4 Critical
- line corporation central dogmaCentral Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)8.8 High
- asus armoury crateA permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform...7.1 High
- gnome libxml2libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling7.0 High
- hamlibHamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory Disclosure7.3 High
- microsoft github copilotGitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user...7.5 High
- browserbase skillsBrowserbase Skills Autobrowse Trace Artifact default permission4.8 Medium
- langflowlangflow-ai langflow Bundle URL Loader code injection4.8 Medium
- flowiseai flowiseFlowiseAI Flowise S3 Document Loader S3.ts path traversal5.3 Medium
- coollabsio coolifycoollabsio coolify Image Name os command injection5.3 Medium
- comfast cf-wr631ax v3Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection5.3 Medium
- No product listedactivepieces File URL file.ts handleUrlFile server-side request forgery5.3 Medium
- radware cyber controllerRadware Cyber Controller HTML Report Generation HTML injection5.1 Medium
- kortix-ai sunakortix-ai suna Auth Endpoint page.tsx router.push cross site scripting5.3 Medium
- edimax br-6478ac v2Edimax BR-6478AC V2 POST Request mp command injection5.3 Medium
- edimax br-6478ac v2Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection5.3 Medium
- edimax br-6478ac v2Edimax BR-6478AC V2 POST Request stainfo command injection5.3 Medium
- edimax br-6478ac v2Edimax BR-6478AC V2 POST Request setWAN command injection5.3 Medium
- edimax br-6478ac v2Edimax BR-6478AC V2 POST Request formWlSiteSurvey buffer overflow8.7 High
- offis dcmtkOFFIS DCMTK ofxml.cc parseFile heap-based overflow5.3 Medium
lemonldap-ngDebianlemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect5.3 Medium- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks...4.9 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morexmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.6.9 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morexmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.6.9 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morexmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir...6.5 Medium
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat before 2.8.2 has an integer overflow in copyString.6.9 Medium
- Show moreLoading…