CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- linux, linux kernel +1 moredrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size7.8 High
- linux, linux kernel +1 moredrm/amd/display: Clamp VBIOS HDMI retimer register count to array size7.8 High
- linux, linux kernel +1 moredrm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: nft_fib: fix stale stack leak via the OIFNAME register5.5 Medium
- linux, linux kernel +1 moreRDMA/umem: Fix truncation for block sizes >= 4G7.8 High
- linux, linux kernel +1 morevsock/virtio: fix potential unbounded skb queue7.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenetfilter: require Ethernet MAC header before using eth_hdr()9.4 Critical
- apache software foundation kvrocksApache Kvrocks: Improper permission for the APPLYBATCH command9.4 Critical
- apache software foundation kvrocksApache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling2.4 Low
- apache software foundation kvrocksApache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, res…5.5 Medium
- apache software foundation kvrocksApache Kvrocks: Stack buffer overflow in Lua bit.tohex()10.0 Critical
- apache software foundation kvrocksApache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS6.4 Medium
- dynabook inc. generic io & memory access driverGeneric IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc....6.8 Medium
- themefic tourfic – ai powered travel booking, hotel booking & car rental wordpress pluginTourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter7.5 High
- inspirelabs inpost plInPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking7.5 High
- till krüss email address encoder, unknown email-encoder-premium +1 moreEmail Address Encoder (Free < 1.0.25, Premium < 0.3.12) - Unauthenticated Stored XSS8.8 High
- unknown masteriyo lmsMasteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion6.5 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- ljharb shell-quoteshell-quote parse() is quadratic in token count, enabling denial of service8.7 High
- gitlabIncorrect Authorization in GitLab3.8 Low
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab5.3 Medium
- gitlabMissing Authorization in GitLab3.1 Low
- gitlabAuthorization Bypass Through User-Controlled Key in GitLab5.4 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabInsertion of Sensitive Information into Log File in GitLab4.4 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.0 High
- gitlabIncorrect Authorization in GitLab5.3 Medium
- gitlabInsertion of Sensitive Information into Log File in GitLab8.6 High
- gitlabReliance on Reverse DNS Resolution for a Security-Critical Action in GitLab0.0 None
- gravitymore gravity bookingsGravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'6.5 Medium
- dokan pro, wedevs dokan pro +1 moreDokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters7.5 High
- dokan pro, wedevs dokan pro +1 moreDokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter6.5 Medium
- wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patternsGutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute6.4 Medium
- rapid7 insightconnect tcpdump plugin, insightconnect tcpdump +1 moreOS Command Injection in Rapid7 InsightConnect Tcpdump Plugin6.0 Medium
- rapid7 insightconnect compression plugin, insightconnect compression +1 morePath Traversal in Rapid7 InsightConnect Compression Plugin3.3 Low
- rapid7 insightconnect traceroute plugin, insightconnect traceroute +1 moreOS Command Injection in Rapid7 InsightConnect Traceroute Plugin7.7 High
- rapid7 insightconnect awk plugin, insightconnect awk +1 moreOS Command Injection in Rapid7 InsightConnect AWK Plugin7.7 High
- rapid7 insightconnect finger plugin, insightconnect finger +1 moreOS Command Injection in Rapid7 InsightConnect Finger Plugin6.0 Medium
- rapid7 insightconnect translate, insightconnect tr plugin +1 moreOS Command Injection in Rapid7 InsightConnect Translate Plugin7.7 High
- rapid7 insightconnect ping plugin, insightconnect ping +1 moreOS Command Injection in Rapid7 InsightConnect Ping Plugin7.7 High
- openbsdsys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege...7.4 High
- gnu sed, rapid7 insightconnect sed plugin +1 moreArbitrary File Read in Rapid7 InsightConnect Sed Plugin6.5 Medium
- gnu sed, rapid7 insightconnect sed plugin +1 moreArbitrary File Write in Rapid7 InsightConnect Sed Plugin7.1 High
- gnu sed, rapid7 insightconnect sed plugin +1 moreOS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.8.8 High
- rapid7 insightconnect sqlmap plugin, insightconnect sqlmap +1 moreOS Command Injection in Rapid7 InsightConnect SQLmap Plugin6.0 Medium
- No product listedA reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows...7.5 High
- No product listedAn issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers...7.5 High
- msi centerInsecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote...7.5 High
- Show moreLoading…