CVEs published in June 2026
8,400 vulnerabilities, 981 critical, 27 exploited.
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations...5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible3.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private...4.3 Medium
- dell container storage modulesDell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi...8.0 High
- intelbras incontrol, peplink intcontrol 2 +1 morePeplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access...7.7 High
- apache software foundation iotdbApache IoTDB: Path Traversal Vulnerability9.1 Critical
- apache software foundation iotdbApache IoTDB: Path Traversal Vulnerability9.1 Critical
- apache software foundation kerby, red hat amq clients, data grid 8 +4 more +6 moreApache Kerby: Kerberos Pre-Authentication Bypass7.3 High
- tim strifler exclusive addons elementorWordPress Exclusive Addons Elementor plugin <= 2.7.9.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- apache software foundation kerbyApache Kerby: StackOverflow on parsing deeply nested ASN1 structures6.5 Medium
- sahlberg libnfslibnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in...7.1 High
- reolink home hubA vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior...5.8 Medium
- trellix network security nx, ex, fx, ax, and cmsA Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally...7.1 High
- johnson & johnson audit tracking management systemJohnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of...7.5 High
- johnson & johnson campus recruitingJohnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by...7.5 High
- jupyter jupyter/jupyterCross-site Scripting (XSS) in jupyter/nbconvert5.4 Medium
sg3_utilsSUSESecurity update for sg3_utilsNo score- davido bytes::random::secure::tinyBytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes7.5 High
- davido bytes::random::secureBytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes7.5 High
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass6.5 Medium
- wso2 api managerUnauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager8.3 High
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized stack-based buffer overflow vulnerability (vlsvr)9.8 Critical
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized buffer overflow via RTSP Digest username (ssvr)9.8 Critical
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr)9.8 Critical
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (thttpd)9.8 Critical
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized format string vulnerability (vlsvr)8.6 High
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized out-of-bounds writing vulnerability (onvif.cgi)7.5 High
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability in packet parsing7.5 High
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (IEEE8021x_upload.cgi)7.5 High
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability (IEEE8021x_upload.cgi)7.5 High
- geovision inc. gv-lpclpc2011/2211GV-LPC2011/LPC2211 - unauthorized directory traversal vulnerability (get_fcont.cgi)7.5 High
- apache apache-airflow-providers-ftp, apache software foundation airflow ftp provider +1 moreApache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)7.5 High
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion6.5 Medium
- salesmanago & leadoo, unknown salesmanago & leadoo +1 moreSALESmanago & Leadoo < 3.11.3 - Subscriber+ SQL Injection7.7 High
- unknown ymc filterYMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure7.5 High
- printcart web to print product designer for woocommerce, unknown printcart web to print product designer for woocommerce +1 morePrintcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Unauthenticated Folder Content Disclosure via Path Traversal5.3 Medium
- nec corporation expressupdate agent for windowsAn access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a...8.5 High
- rapid7 insightconnect markdown pluginServer-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin4.8 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter6.5 Medium
- revive adserver, revive-adserver revive adserver +1 moreA missing sanitisation vulnerability exists with user input in the stats-video.php script. The...4.7 Medium
- revive adserver, revive-adserver revive adserver +1 moreA bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API...4.3 Medium
- revive adserver, revive-adserver revive adserver +1 moreA stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners...4.4 Medium
- revive adserver, revive-adserver revive adserver +1 moreBypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio...8.8 High
- revive adserver, revive-adserver revive adserver +1 moreA missing sanitisation vulnerability of user input in the zone-include.php script exists in...6.1 Medium
- revive adserver, revive-adserver revive adserver +1 moreA bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to...4.3 Medium
ogreOSS-FuzzHeap-use-after-free in Ogre::VertexData::convertPackedColourNo score- kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 moreKubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service3.8 Low
- kohaA stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha...5.4 Medium
- kohaA stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library...5.4 Medium
- Show moreLoading…