CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- danny-avila librechatLibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization6.5 Medium
- danny-avila librechatLibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter5.3 Medium
- danny-avila librechatLibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs7.7 High
- danpros htmlyHTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave7.2 High
- danny-avila librechatLibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork6.5 Medium
- danny-avila librechatLibreChat: Missing Resource Parameter Validation in MCP OAuth Flow8.0 High
- danny-avila librechatLibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass5.9 Medium
- dest-unreach socatsocat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser9.2 Critical
- danny-avila librechatLibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification5.3 Medium
- hypr passwordlessMissing authentication for critical function vulnerability in HYPR Passwordless on Windows allows...6.7 Medium
- vimVim: Out-of-bounds Write in Spell File Word Count5.7 Medium
- vimVim: Out-of-bounds Read in Text Property Count5.3 Medium
- vimVim: Out-of-bounds Read with libsodium-encrypted Files5.5 Medium
- vimVim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction6.5 Medium
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.265.3 Medium
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.263.4 Low
- drolsky list::someutils::xsList::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function7.5 High
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.266.5 Medium
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.266.3 Medium
- vimVim: Out-of-bounds Read with Text Properties6.8 Medium
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.266.5 Medium
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.266.1 Medium
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.266.5 Medium
- vimVim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument4.0 Medium
- vimVim: Arbitrary Code Execution via Python Omni-Completion Docstrings8.4 High
- schneider electric powerlogic™ p7, schneider-electric powerlogic p7 firmware +1 moreCWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to...6.9 Medium
- schneider electric powerlogic™ p7, schneider-electric powerlogic p7 firmware +1 moreCWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection')...8.6 High
- schneider electric powerlogic™ p7, schneider-electric powerlogic p7 firmware +1 moreCWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service...8.7 High
- mhsanaei 3x-uiAuthenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation7.2 High
- schneider electric easylogic t150 (formerly saitel dr) remote terminal unit & controller, saitel dp remote terminal unit & controller, schneider-electric easylogic t150 firmware +1 more +3 moreCWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause...6.7 Medium
- schneider electric easylogic t150 (formerly saitel dr) remote terminal unit & controller, saitel dp remote terminal unit & controller, schneider-electric easylogic t150 firmware +1 more +3 moreCWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access...8.7 High
- pretixMalicious HTML content contained in the layout specification of a PDF ticket or badge layout was...8.8 High
- pretixMalicious HTML content could be injected into the page pretix shows when redirection to an...2.1 Low
- pretixContent injected to PDF rendering contexts could, in many places, include HTML content including ...2.1 Low
- pretixStored XSS in ticket confirmation page5.3 Medium
- alps electric co., ltd. remote keyless entry system (rkes) r53r0Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack6.9 Medium
- pretix pretix-pagesStored XSS in pretix-pages2.1 Low
- pretix pretix-mollieInsufficient validation of payment status in pretix-mollie6.3 Medium
- pretix pretix-oppwaInsufficient validation of payment status in pretix-oppwa6.3 Medium
- pretix pretix-computopInsufficient validation of payment status in pretix-computop6.3 Medium
- pretix pretix-digitalStored XSS in pretix-digital2.0 Low
- silabs.com emberznetImproper bounds validation in EmberZNet SDK5.3 Medium
- dell display and peripheral managerDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper...7.8 High
- tenable nessusSQL Injection in Nessus via Malicious Scan Result File Import1.6 Low
- tenable nessusSQL Injection in Nessus via Reverse DNS Lookup2.1 Low
- dell display and peripheral managerDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper...7.3 High
- silabs emberznetSimple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.27.1 High
- silabs emberznetLevel Control Step With On/Off divide-by-zero in EmberZNet v9.0.27.1 High
- silabs emberznetLevel Control Move divide-by-zero in EmberZNet v9.0.27.1 High
- silabs emberznetDoor Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.27.1 High
- Show moreLoading…