CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- msi centerInsecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote...7.5 High
- No product listedInsecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote...7.5 High
- No product listedGROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a...7.7 High
- nlnet labs nsdBypass of client certificate verification with transfer over TLS8.2 High
- nlnet labs nsdOut of bounds stack write with crafted APL RR7.2 High
- nlnet labs nsdDenial of DNS over TLS service by any DoT client8.7 High
- nlnet labs nsdHeap overflow and crash with crafted SVCB RR8.7 High
- gpacA use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC...6.1 Medium
- gpacA use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC...7.8 High
- rapid7 insightconnect rpm plugin, insightconnect rpm +1 moreOS Command Injection in Rapid7 InsightConnect RPM Plugin6.0 Medium
- cactiCacti: Command Injection via escape_command() no-op in RRDtool execution8.6 High
- quest netvault backupQuest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability8.8 High
- cactiCacti: Stored SQL Injection via graph_name_regexp in Reports feature7.6 High
- quest netvault backupQuest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability8.8 High
- cactiCacti has SQL Injection via rfilter parameter in RLIKE clauses9.3 Critical
- cactiCacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php9.8 Critical
- cactiCacti: Unauthenticated RCE on Graph Image9.8 Critical
- cactiCacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context5.3 Medium
- cactiCacti: Path Traversal via filename parameter in package_import.php6.9 Medium
- cactiCacti has a Reflected XSS Vulnerability via html_auth_footer5.3 Medium
- cactiCacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting2.9 Low
- cactiCacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php9.8 Critical
- appsmithAppsmith: Caddy admin API exposed without authentication9.9 Critical
- aten unizonATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability7.2 High
- aten unizonATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability7.2 High
- aten unizonATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability7.2 High
- aten unizonATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability7.5 High
- aten unizonATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability5.5 Medium
- aten unizonATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability5.5 Medium
- appsmithAppsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist5.3 Medium
- composerMosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 High
- unraidUnraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability8.8 High
- unraidUnraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability8.8 High
- appsmithAppsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route8.9 High
- zephyrproject zephyrUnbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control6.5 Medium
- chromedevtools chrome-devtools-mcpchrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots6.1 Medium
- getsentry sentrySentry: Inefficient Regular Expression Complexity in sentry7.5 High
- siyuan-note siyuanSiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)9.0 Critical
- siyuan-note siyuanSiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron client8.7 High
- ueberdosis tiptap-phpTiptap for PHP < 2.1.1 DoS via Malformed href Attribute7.1 High
- siyuan-note siyuanSiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content9.9 Critical
- siyuan-note siyuanSiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()9.9 Critical
- Show moreLoading…