CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- cap-go capgoCap-go - Privilege Inversion in Build Log Stream via SSE Disconnect7.1 High
- cap-go capgoCapgo - Denial of Service via Unlimited Demo App Creation5.3 Medium
- cap-go capgoCap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts7.1 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments6.3 Medium
- motioneye-project motioneyemotionEye: Authentication possible via password hash9.1 Critical
- linuxfoundation spinnakerSpinnaker: Non-safe yaml deserialization allowing RCE when using specific types8.8 High
- openidentityplatform openamOpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`7.0 High
- inspektor-gadgetInspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF2.9 Low
- paymenterPaymenter: Broken object level authorization via service reference manipulation on ticket creation5.4 Medium
- paymenterPaymenter doesn't reset email verification status after email change4.3 Medium
- paymenterPaymenter: Blind Unauthenticated SSRF on the Paypal gateway module5.3 Medium
- py-pdf pypdfpypdf: Possible infinite loop when processing threads/articles in writer6.9 Medium
- openidentityplatform openamOpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)8.3 High
- gophishGophish 0.12.1 Denial of Service via Office Document Upload7.1 High
- openidentityplatform openamOpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`5.3 Medium
- xwikisas xwiki-pro-macrosXWiki Pro Macros: excerpt-include title and content injection executes code9.9 Critical
- openidentityplatform openamOpenAM LDAP Injection via `_queryId` Parameter7.1 High
- wwbn avideoAVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data6.5 Medium
- wwbn avideoAVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration7.5 High
- ibm i, websphere application server +1 moreWebsphere Application Server is Affected By a Denial of Service5.9 Medium
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization...8.1 High
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization...8.8 High
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default...6.0 Medium
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution...7.8 High
- webp-sh webp server goWebP Server Go < 0.15.0 Path Traversal via Backslash Encoding on Windows8.7 High
- tp link systems inc. archer mr402 v1, tp-link systems inc. archer c20 v5, archer c20 v6 +4 more +6 moreUnauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers8.7 High
- wwbn avideoAVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions5.3 Medium
- jdx misemise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)9.6 Critical
- autodesk fusionMCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop9.6 Critical
- motioneye-project motioneyemotionEye: World-Readable Configuration File Exposes Admin Password Hash5.5 Medium
- motioneye-project motioneyemotionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint6.5 Medium
- gogsGogs: Authentication Bypass via Unvalidated Reverse Proxy Headers7.7 High
- gogsGogs: Denial of Service in repository/wiki file listing web pages4.9 Medium
- grafana, grafana enterprise, oss +2 morePre-authentication denial of service in the public dashboard query endpoint7.5 High
- alsa project alsa-libALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c7.0 High
- canonical ubuntu 20.04 lts, ubuntu 22.04 lts, ubuntu 24.04 lts +2 more +4 moreCanonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment9.0 Critical
- akauntingAkaunting 3.1.21 - Authenticated stored XSS in report description rendering4.8 Medium
- presire qsnapperCaching of Authentication allows Authentication Bypass between users in qSnapper8.4 High
- presire qsnapperCaching of Authentication allows Authentication Bypass in qSnapper8.4 High
- akauntingAkaunting 3.1.21 - Authenticated stored XSS in document timeline4.8 Medium
- presire qsnapperInformation leak via “diff” methods in qSnapper6.9 Medium
- ibm sterling b2b integrator, sterling file gateway, watson speech services cartridge +2 moreIBM Sterling File Gateway SQL Injection6.0 Medium
- keras-team keras-team/kerasPath Traversal in keras-team/keras6.1 Medium
- angular, angular language service, angular.ng-template +2 moreAngular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension8.7 High
- presire qsnapperpath traversal via `config` parameter in qSnapper7.3 High
- google cloud cloud console uisCross-Project Information Leakage in Google App Engine UI6.9 Medium
- akauntingAkaunting 3.1.21 - Stored XSS in delete confirmation modal4.8 Medium
- presire qsnapperWeak polkit authentication check in qSnapper8.1 High
- angular, angular language service +1 moreAngular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension8.7 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities5.9 Medium
- Show moreLoading…