CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- revive adserverA stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user...0.0 None
- revive adserverA missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0...8.8 High
- revive adserverAn access control bypass allows an advertiser‑level user to activate or deactivate a banner in...5.4 Medium
- revive adserverA missing access control check when invoking various modify methods in the XML‑RPC API of Revive...4.3 Medium
- revive adserverLow‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is...0.0 None
- revive adserverLow‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API...4.3 Medium
- revive adserverA missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and...8.8 High
- revive adserverA missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and...6.1 Medium
- revive adserverA missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and...8.3 High
- revive adserverA missing access control check when linking trackers to campaigns through the campaign-trackers...4.3 Medium
- revive adserverA missing access control check when linking banners or campaigns to a zone through the zone...4.3 Medium
- dhcpcd project dhcpcddhcpcd Heap Use-After-Free via Control Socket Handling5.7 Medium
- abb 800xa for advant master, control builder a +1 moreAdvant Master Online Builder DLL vulnerability4.1 Medium
- dhcpcd project dhcpcddhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling7.1 High
- bootimusBootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass8.7 High
- dhcpcd project dhcpcddhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()6.0 Medium
- dhcpcd project dhcpcddhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW6.0 Medium
- python software foundation cpythontarfile extraction filter bypass allows escaping the destination directory7.8 High
- amazon web services language servers for awsArbitrary file write in Language Servers for AWS8.5 High
- amazon web services language servers for awsArbitrary Code Execution in Language Servers for AWS8.5 High
- tenable identity exposureInsecure Public Caching on REST API Endpoints in Tenable Identity Exposure8.5 High
podmanSUSESecurity update for podmanNo scorepodmanSUSESecurity update for podmanNo scorerekorSUSESecurity update for rekorNo score- hkuds openharnessOpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands5.3 Medium
- hkuds openharnessOpenHarness - Cross-Session Disclosure via /resume and /summary Commands7.1 High
- nanocoai nanoclawNanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback5.3 Medium
- nanocoai nanoclawNanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action6.8 Medium
- nanocoai nanoclawNanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles6.8 Medium
- nanocoai nanoclawNanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler7.1 High
- hclsoftware connectionsHCL Connections is vulnerable to broken access control3.5 Low
- pegasystems pega infinityPega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.7.1 High
- fossbillingFOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions10.0 Critical
libssh2ChainguardNo scorelibssh2ChainguardNo score- fossbillingFOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE9.4 Critical
- rasta-mouse pwnliftpwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in...7.4 High
sg3_utilsSUSESecurity update for sg3_utilsNo scoresg3_utilsSUSESecurity update for sg3_utilsNo scoresg3_utilsopenSUSESecurity update for sg3_utilsNo score- netcomm nf20meshNetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass9.2 Critical
- netcomm nf20meshNetComm NF20MESH < R6B032 Authenticated RCE via OS Command Injection8.7 High
- drimo cmsReflected XSS in DRIMO CMS5.1 Medium
- thekelleys dnsmasq, red hat enterprise linux 10, enterprise linux 6 +6 more +8 moreDnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation5.3 Medium
- redhat cluster logging operator, red hat logging subsystem for red hat openshift 6.5, redhat logging subsystem for red hat openshift +2 moreOpenshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization6.8 Medium
HTTPJuliaWebSocket reader data race in auto-PONG/CLOSE-echo handling in HTTP.jlNo scoreHTTPJuliaPath traversal in the HTTP.jl static file server via separator/absolute path segmentsNo scoreHTTPJuliaHTTP/2 client HPACK desynchronization via header blocks for unknown streams in HTTP.jlNo scoreHTTPJuliaWebSocket default Origin check ignores scheme and port in HTTP.jlNo scoreHTTPJuliaHTTP/1 request smuggling via bare-LF, lenient chunk size, and TE/CL handling in HTTP.jl serverNo score- Show moreLoading…