CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- kohaCross-Site Scripting (XSS) vulnerability in the patron restriction type administration page of...6.1 Medium
- No product listedLansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key...5.5 Medium
- No product listedAn issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a...7.5 High
- No product listedAn issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers...7.5 High
- No product listedCleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr...4.6 Medium
- No product listedA stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic...5.5 Medium
- No product listedA stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before...5.5 Medium
- No product listedAn issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of...7.5 High
- No product listedAn integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to...7.5 High
- No product listedA heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to...6.5 Medium
- shenzhen i365-tech co. ltd. setracker2 parental control app (android) package com.tgelec.setrackerSetracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication9.2 Critical
- shenzhen i365-tech co. ltd. setracker2 parental control app (android) package com.tgelec.setrackerSetracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic Algorithm8.7 High
- redhat pen drive, red hat pen drive powered by red hat lightspeed +1 morePen-drive: pen-drive: stored xss via unescaped cluster data in html report6.9 Medium
- kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 moreVirt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip6.4 Medium
- kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 moreKubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher4.2 Medium
- red hat build of apicurio registry 3.3.1, redhat build of apicurio registry +1 moreApicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset6.5 Medium
- shenzhen i365-tech co. ltd. setracker2 parental control app (android) package com.tgelec.setrackerSetracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key8.7 High
- shenzhen i365-tech co. ltd. setracker2 parental control app (android) package com.tgelec.setrackerSetracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers8.3 High
- fossbillingFOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution6.9 Medium
- cactiCacti: Package Import Signature Validation Bypass Allows Self-Signed Packages7.1 High
- cactiCacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter6.5 Medium
- cactiCacti: SQL Injection in managers.php7.2 High
- cactiCacti: Session Fixation via missing session_regenerate_id() after login5.4 Medium
- cactiCacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect6.1 Medium
- netflix lemurLemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR9.9 Critical
- netflix lemurLemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure4.8 Medium
- netflix lemurLemur: Plaintext password storage in Lemur user-update path4.9 Medium
- netflix lemurLemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership6.3 Medium
- netflix lemurLemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates6.3 Medium
- google chromeUse after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote...7.5 High
- google chromeUse after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local...6.8 Medium
- google chromeInteger overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who...8.3 High
- vtkvtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability8.1 High
- nextflow-io nextflowNextflow: Incorrect default permissions in the nextflow auth login command5.5 Medium
- wolfsslPKCS7_verify signer confusion allows forged signatures to be accepted5.9 Medium
- github github-mcp-serverGitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion6.0 Medium
- wolfssliPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined5.7 Medium
- wolfsslHMAC-BLAKE2 final discards message when key length exceeds block size5.9 Medium
- wolfsslOCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status6.3 Medium
- red hat build of apicurio registry 3.3.1, redhat build of apicurio registry +1 moreApicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation7.4 High
- wolfsslMissing SNI/ALPN binding on stateful (session-ID) TLS session resumption6.0 Medium
- wolfsslTLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify6.0 Medium
- red hat build of apicurio registry 3.3.1, redhat build of apicurio registry +1 moreApicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos8.5 High
- wolfsslEncrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured2.1 Low
- wolfsslOut-of-bounds write in SetSuitesHashSigAlgo on oversized signature algorithms list2.0 Low
- wolfsslPKCS#12 MAC verification uses attacker-controlled comparison length6.0 Medium
- wolfsslML-KEM ARM64 NEON ciphertext comparison only compares half of the input6.3 Medium
- evoke csmsEVoke Systems EVoke CSMS Missing Authentication for Critical Function9.3 Critical
- evoke csmsEVoke Systems EVoke CSMS Improper Restriction of Excessive Authentication Attempts8.7 High
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.4 +3 more +5 moreOrg.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion8.1 High
- Show moreLoading…