CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- geovision inc. geovisionGeoVision GV-VMS V20 GV-Cloud memory corruption vulnerability6.2 Medium
- repute info systems arformsARForms <= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter7.2 High
- xpro addons — 140+ widgets for elementorXpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets6.4 Medium
- style-dictionaryStyle Dictionary - Prototype Pollution in convertTokenData utility function8.8 High
ogreOSS-FuzzBad-cast to Ogre::HardwareBuffer from invalid vptrNo scoreharfbuzzOSS-FuzzUse-of-uninitialized-value in iup_delta_optimizeNo score- rsyslogRsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling8.2 High
- No product listedApple M1 GPUs retain register file data between compute shader dispatches from different...8.6 High
- gpacA buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project...7.5 High
- gpacA NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c)...5.5 Medium
- gpacA use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid...5.5 Medium
- gpacGPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is...5.5 Medium
- gpacA use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c)...7.5 High
- gpacA use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC...5.0 Medium
- anthropic claude desktop coworkAnthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use8.7 High
- caliptra core runtime firmwareMCU Firmware Update Authentication Bypass on Caliptra Core7.2 High
- caliptra core runtime firmwareAES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty5.1 Medium
- grokability snipe-itSnipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API8.5 High
- grokability snipe-itSnipe-IT's S3 signature image retrieval lacks authorization before temporary URL1.3 Low
- grokability snipe-itSnipe-IT: Improper Authorization in File Deletion (IDOR)5.4 Medium
- grokability snipe-itSnipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation4.9 Medium
- grokability snipe-itSnipe-IT: Multi-Tenancy Bypass via Bulk Asset Update6.3 Medium
- grokability snipe-itSnipe-IT: 2FA reset privilege bypass5.8 Medium
- grokability snipe-itSnipe-IT: User Account Escalation via CSV Import6.5 Medium
flask-securityPyPIFlask-Security has an Open Redirect issue4.7 Medium- grokability snipe-itSnipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`5.9 Medium
- open source opentofuOpenTofu before 1.11.7 Symlink Following Path Traversal7.0 High
- open-telemetry opentelemetry-ebpf-profileropentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent6.2 Medium
- fortra file integrity monitoring (fim), file integrity monitoring +1 morePrivilege Escalation in Fortra File Integrity Monitoring (FIM)4.4 Medium
- grokability snipe-itSnipe-IT's selectlist visibility is too permissive4.9 Medium
- grokability snipe-itSnipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment5.5 Medium
- flatpressFlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields8.4 High
- poweradminPoweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.9.6 Critical
- fortra file integrity monitoring (fim), file integrity monitoring +1 moreStored XSS in Fortra File Integrity Monitoring (FIM)5.5 Medium
- python software foundation cpythontarfile opened in streaming mode mishandles EOF8.2 High
- fasterxml jackson-databindjackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind6.5 Medium
- fasterxml jackson-databindjackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()6.3 Medium
- broadcom spring statemachine, spring statemachine +1 moreSpring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist8.8 High
- fasterxml jackson-databindjackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation8.1 High
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)8.1 High
- fasterxml jackson-databindjackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)5.3 Medium
- fasterxml jackson-databindjackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties5.3 Medium
- fasterxml jackson-databindjackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields5.3 Medium
- fasterxml jackson-databindjackson-databind: @JsonView bypass for setterless creator properties5.3 Medium
- fossbillingFOSSBilling: Broken Authorization in Client Transaction and Order Listings7.1 High
- gstreamer, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreGstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser4.4 Medium
- gstreamer, red hat enterprise linux 10, enterprise linux 8 +2 more +4 moreGstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser4.3 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +1 more +3 moreCommunity.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query string6.5 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +1 more +3 moreCommunity.general: community.general keyring_info — os keyring passphrase returned in plaintext5.5 Medium
- theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 moreForeman-mcp-server: mcp server: insecure sensitive http header sanitization6.2 Medium
- Show moreLoading…