CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- google chromeOut of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197...8.8 High
- google chromeUse after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote...9.6 Critical
- google chromeUse after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote...9.6 Critical
- drupal paragraphsParagraphs - Less critical - Access bypass - SA-CONTRIB-2026-0606.5 Medium
- drupal wisskiWissKI - Critical - Access bypass - SA-CONTRIB-2026-0596.5 Medium
- drupal commerce realex / global payments, stella commerce realex \/ global payments +1 moreCommerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-0584.8 Medium
- drupal ai agents, artificial intelligence project intelligence +1 moreAI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-0574.8 Medium
- drupal ai agents, artificial intelligence project intelligence +1 moreAI Agents - Less critical - Access bypass - SA-CONTRIB-2026-0564.2 Medium
- artificial intelligence project intelligence, drupal ai (artificial intelligence) +1 moreAI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-0553.3 Low
- artificial intelligence project intelligence, drupal ai (artificial intelligence) +1 moreAI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-0546.1 Medium
- drupal openai provider, openai provider project provider +1 moreOpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-0533.3 Low
- anuaralfetahe advanced content feedback, drupal advanced content feedback (aka admin feedback) +1 moreAdvanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-0523.1 Low
- anuaralfetahe advanced content feedback, drupal advanced content feedback (aka admin feedback) +1 moreAdvanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-0516.1 Medium
- jellyfinJellyfin: Potential XSS in user management5.7 Medium
- jellyfinJellyfin: Potential FFmpeg argument injection via unescaped subtitle file path8.8 High
- jellyfinJellyfin: Potential MKV attachment filename path traversal to RCE1.7 Low
- jellyfinJellyfin: Potential Authenticated path traversal in /ClientLog/Document8.8 High
- tryghost ghostGhost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header9.6 Critical
- tp-link systems inc. tapo c200 v3, tp-link tapo c200 firmware +1 moreDenial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C2007.1 High
- tryghost ghostGhost: Private IP filtering bypass to make server-side requests to internal services5.8 Medium
- tryghost ghostGhost: Server-side request forgery via DNS rebinding in external request handling4.0 Medium
- tryghost ghostGhost: Mobiledoc image-size fetch SSRF5.4 Medium
- tryghost ghostGhost: Member existence leak via magic link sign-in response5.3 Medium
- tryghost ghostGhost: File Upload Content-Type Spoofing5.4 Medium
- tryghost ghostGhost Content API filter bypass reveals private fields5.3 Medium
- tryghost ghost@tryghost/activitypub: XSS in Ghost's ActivityPub client7.5 High
- olivetinOliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering4.3 Medium
- fatpipe warpWarp Markdown notebook links may open executable local files8.8 High
- fatpipe warpWarp branch selector command injection via Git branch names8.0 High
- fatpipe warpWarp: SSH remote output can lead to local file overwrite and persistence8.8 High
- openidentityplatform openamOpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints9.3 Critical
- fatpipe warpWarp: Env-var prefixes can lead to denylisted command autoexecution8.6 High
- fatpipe warpWarp: Linux external editor command injection7.8 High
- fatpipe warpWarp: Remote SSH cwd can lead to unauthorized remote command execution8.8 High
- fatpipe warpWarp: DCS lifecycle hook spoofing can alter terminal session metadata4.3 Medium
- fatpipe warpWarp: OS command injection when opening terminal links from WSL7.7 High
- fatpipe warpWarp: Command Injection via Warp code search tool arguments7.8 High
- openidentityplatform openamOpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage9.2 Critical
- fatpipe warpWarp may allow terminal output to access the local clipboard through OSC 528.1 High
- mintplex-labs anything-llmAnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)0.0 None
- mintplex-labs anything-llmAnythingLLM: Windows path containment bypass in document folder route4.3 Medium
- lepture mistune, red hat migration toolkit for applications 8, openshift ai (rhoai) +3 more +5 moreMistune: Potential DoS via quadratic-time parsing in parse_link_text8.7 High
- linux, linux kernel +1 morefs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START7.8 High
- linux, linux kernel +1 morefs/mbcache: cancel shrink work before destroying the cache7.8 High
- linux, linux kernel +1 moredrbd: Balance RCU calls in drbd_adm_dump_devices()5.5 Medium
- linux, linux kernel +1 moreblock: fix zones_cond memory leak on zone revalidation error paths5.5 Medium
- linux, linux kernel +1 moreblk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()5.5 Medium
- linux, linux kernel +1 moremd: fix array_state=clear sysfs deadlock5.5 Medium
- linux, linux kernel +1 moreublk: reset per-IO canceled flag on each fetch5.5 Medium
- linux, linux kernel +1 moremd: wake raid456 reshape waiters before suspend5.5 Medium
- Show moreLoading…