CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption7.5 High
- ibm websphere application serverIBM WebSphere Application Server is affected by server-side request forgery7.4 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities7.4 High
- ibm websphere application serverIBM WebSphere Application Server is affected by an authentication bypass vulnerability7.3 High
rpcbindopenSUSESecurity update for rpcbindNo scorerpcbindSUSESecurity update for rpcbindNo scorerpcbindSUSESecurity update for rpcbindNo score- ibm engineering workflow managementIBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed6.5 Medium
- ibm db2, db2 on cloud pak for data and db2 warehouse on cloud pak for data, db2 warehouse +2 moreMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.5.3 Medium
- ibm datacap, datacap navigator +1 moreMultiple Vulnerabilities in IBM Datacap2.3 Low
- ibm i, websphere application server +1 moreWebSphere Application Server Remote Code Execution8.1 High
- chainlitChainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration8.8 High
- ibm i, websphere application server +1 moreWebSphere Application Server Remote Code Execution7.5 High
- ibm datacap, datacap navigator +1 moreMultiple Vulnerabilities in IBM Datacap5.5 Medium
- ibm datacap, datacap navigator +1 moreMultiple Vulnerabilities in IBM Datacap6.1 Medium
- ibm langflow oss, langflow +1 moreUnauthenticated Flow Execution via Webhook Endpoint in Langflow OSS9.8 Critical
- ibm tririga application platformIBM TRIRIGA Cross-Site Scripting Vulnerability5.4 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver4.8 Medium
- thekelleys dnsmasq, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreDnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies5.9 Medium
- ibm storage protect client, storage protect snapshot for windows, storage protect +2 moreHardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system9.1 Critical
- mattermost, mattermost server +1 moreUser Manager can demote bot accounts to guest without bot-management permission3.8 Low
- mattermost, mattermost server +1 moreIDOR in Jira plugin subscription edit endpoint6.4 Medium
- mattermost, mattermost server +1 moreMattermost Jira plugin had unauthenticated {{/ac/installed}} lifecycle callback during pending Jira Cloud install6.4 Medium
- mattermost, mattermost server +1 moreImproper Permission Check Allows User Manager to Deactivate Bot Accounts3.8 Low
- mattermost, mattermost server +1 moreGlobal session revocation does not invalidate active WebSocket connections4.3 Medium
- mattermost, mattermost server +1 moreGitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration5.4 Medium
- ibm langflow oss, langflow +1 moreUnauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection10.0 Critical
- grafana snowflake, snowflake datasource +1 moreLocal File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT9.6 Critical
- ibm engineering workflow managementIBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed5.4 Medium
- ibm db2, db2 on cloud pak for data and db2 warehouse on cloud pak for data, db2 warehouse +2 moreMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.6.0 Medium
- grafana oss, grafana +1 moreStored XSS in the Geomap panel tile-layer attribution7.3 High
- grafana, grafana oss +1 morePath traversal in the Tempo and Loki data source plugins5.4 Medium
- grafana oss, loki datasource +1 morePath traversal in the Loki data source plugin7.7 High
- ibm db2, db2 on cloud pak for data and db2 warehouse on cloud pak for data, db2 warehouse +2 moreMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.6.5 Medium
- thinkst canarytokensHTML injection in the Canarytoken Google Chat notification2.0 Low
- ail project frameworkAIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes5.1 Medium
- ail project frameworkAuthenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read8.3 High
- gaudire assassin gameMultiple vulnerabilities in the Assassin game by Gaudire6.9 Medium
- vimVim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename5.7 Medium
- vimVim: Out-of-bounds Write in Spell File Prefix Dump5.5 Medium
- gaudire assassin gameMultiple vulnerabilities in the Assassin game by Gaudire9.2 Critical
- gaudire assassin gameMultiple vulnerabilities in the Assassin game by Gaudire9.4 Critical
- redhat openshift container platform, windows machine config operator, red hat openshift container platform 4 +4 more +6 moreWindows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft8.3 High
- redhat openshift container platform, windows machine config operator, red hat openshift container platform 4 +5 more +7 moreWindows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters8.8 High
- mispMISP remote code execution via arbitrary rdkafka configuration path9.3 Critical
- aruba arubasignIncorrect permissions in ArubaSign by Aruba8.8 High
- mispAuthenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP8.7 High
- mispMISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection9.3 Critical
- mispBroken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models7.1 High
- quinn-rs quinnquinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly7.5 High
- Show moreLoading…